Find inactive users

[Anthony khan]

Hi,

I am tying to find inactive users or the users never login, I think finger command or -mtime can help, so I can remove those inactive users...Is anyone have a script to get this done.


Thanks

[James R. Ferguson · Accepted solution]

Hi Anthony:

A couple of tricks help. You can use 'find' to traverse the $HOME directories of the users looking at the last access date for their '.profile' [assuming their default shell is the Posix or ksh shell] and collect a list for culling.

You can examine the /var/adm/wtmp file (if you keep it) using 'last' and compare its contents to /etc/passwd in a fashion which returns a list of users who do *not* appear in 'wtmp'.

Regards!

...JRF...

[harry d brown jr]

Anthony,

Convert your system to trusted, and set passwd expire and inactivity.

live free or die
harry

[Sachin Patel]

Hi
You can use who to find old logins.
#who -a |grep old
then run ps -e to find out that pid if you can means that login is old you can remove it.

for example
#who -a |grep old
sachin ttyp1 Jan 8 09:47 old 8071 10.20.46.71:0.0
#ps -e |grep 8071
8071 ttyp1 0:00 csh

means that login is been inactive for logtime and it is been old.
#kill 8071

Sachin

[Victor_5]

Don't use finger since it is a danger command for system security, one solution is implement C2 Trusted System, and turn on auditing system, you can get those info from logs.

[Justo Exposito]

Hi Anthony,

Do you know the command "last"?

Regards,

Justo.

[Roger Baptiste]

hi,

first, get list of users on the box:
cat /etc/passwd | awk '{FS=":";print $1}' >/tmp/list_users

Next, run last command and see when they logged in last on the system, somthing like:
while read -r name
do
last $name | head -1 >>/tmp/user_activity
done
Then, decide on what sort of cut of date you are using for inactivity. If it is for users not logged in this year, do a simple:
grep "2001" /tmp/list_users > inactive_users

BAsed on what you are looking for, you can use greap search pattern accordingly.

Finally to remove those users run
userdel on the list of inactive users.

HTH
raj