How to isolate inactive user accounts by moving them to another OU

Last updated on:

In this page

Objective

Moving inactive or unused user accounts to a dedicated container or OU is a recommended security practice. Isolating these accounts helps prevent them from being exploited as potential security vulnerabilities and ensures better management of inactive identities.

Prerequisites

  • A destination OU or container must already exist in Active Directory.
  • You must be logged in as an ADManager Plus administrator or a help desk technician with the move users role delegated for the target domain or OUs.
  • The user accounts to be isolated should be identifiable through an appropriate user report (such as Account Expired Users, Disabled Users, or Inactive Users).

Steps to isolate inactive user accounts by moving them to another OU

Method 1: Isolate users manually

  1. Navigate to Reports > User Reports.
  2. Select the appropriate report based on your requirement. For example, Account Expired Users to identify expired user accounts.
  3. Choose the required Domain and click Generate.
  4. From the generated report, select the user accounts you want to isolate. Use the Quick Search option to locate specific users if needed.
    Using Quick Search within the Account Expired Users report in ADManager Plus
    The Quick Search option in the Account Expired Users report in ADManager Plus
  5. Click More Actions at the top of the report.
    Accessing additional actions for users in the Account Expired Users report
    The Account Expired Users report in ADManager Plus with the More Actions menu available for selected users
  6. In the Action dropdown, select Move Users from the General Attributes category, and then click Go.
    Selecting the Move Users action for expired user accounts in ADManager Plus
    The bulk action menu in the Account Expired Users report with the Move Users option selected.
  7. On the Move Users to a different container page, verify the selected user accounts.
  8. Click the + icon next to Select Container and choose the destination OU or container.
    Moving expired user accounts to a different Active Directory container
    The Move Users page in ADManager Plus with a destination container selected for expired user accounts.
  9. Select the required users and click Apply.
  10. The selected user accounts will be moved to the chosen container or OU.

Method 2: Isolate users automatically

  1. Navigate to Automation tab.
  2. In the Scheduled Automations page, click Create New Automation.
  3. Enter a suitable Name and Description for the automation.
  4. Select User Automation as the Automation Category.
  5. Choose the required Domain and OUs.
  6. In the Tasks to automate section, select Move Users from the Automation Task/Policy dropdown.
  7. In the Select objects section, choose how the target user accounts should be identified:
    • From Report: Select the report that contains the user accounts to be moved. Click + next to From Reports and choose the appropriate report. For example, Account Expired Users.
    • Data Source: Choose Direct CSV and upload a CSV file with the user accounts to be moved.
  8. Configure the Execution Time, including the schedule and frequency for the automation.
  9. Click Save to schedule the automation, or Save &Run to schedule it and execute it immediately.
    Configuring an automation policy to move expired user accounts in ADManager Plus
    Scheduled automation configuration in ADManager Plus to automatically move expired user accounts to a specified container.

Tips

  • Create a dedicated OU specifically for inactive, disabled, or expired accounts to simplify management and auditing.
  • Review user reports periodically to ensure inactive accounts are identified promptly.
  • Use automation to isolate inactive accounts consistently and reduce manual effort.
  • Test the automation with a small set of users before deploying it organization-wide.
  • Ensure only authorized administrators have permissions to move user accounts between OUs.