How to audit and remove stale admin accounts across tenants in Active Directory. Stale accounts are a silent risk in most environments. Left unchecked, these identities increase your attack surface and complicate compliance audits. In this video, we'll walk through five step-by-step methods to identify, control, and clean up stale accounts in Active Directory. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Procedures to find and clean up stale accounts in Active Directory. Method one: Auditing cloud admin accounts with Microsoft Graph. PowerShell and Microsoft Graph provide the most accurate way to identify inactive cloud-based admin accounts. Open PowerShell as administrator, then use this script to connect to Microsoft Graph with directory and audit log permissions. Make sure to authenticate when prompted. From there, you can identify users assigned to admin roles, review their last sign-in activity, and flag accounts that have been inactive for 30 days or more as stale. As an example, this script lists all admin accounts. The blog includes the full audit logic, inactivity calculations, and CSV export examples. Method two: Identify local admin accounts with PowerShell. Of course, cloud audits alone aren't enough. Local administrator accounts on endpoints are often overlooked. Open PowerShell with administrative privileges, then run the following. To list all local admins on a Windows 11 device, run. To check the last logon time. To disable or remove stale accounts. To scale to all devices using the RMM script. Method three: Using CMD and registry audits for local persistence. When PowerShell isn't available, command prompt and manual checks can still expose risky or hidden accounts. Open Command Prompt as administrator, then run these commands. List all local admins with. Use this to check the last login for a specific account, making sure to replace old admin with the suspect username. Lastly, run these commands for a manual registry check. As always, make sure to back up your system or registry before making any changes. Method four: Preventing local admin persistence with Group Policy. You can use Group Policy Management Editor to run the following tasks. Restrict admin group membership of the local administrators group. Explicitly define allowed admin groups. Deny interactive logon. Enforce password rotation using LAPS. Here's one example policy path used to restrict local admin membership. Create the administrators group, then define permitted members using. Additional GPO paths for logon denial and LAPS enforcement are covered in the blog. Method five: Automating audits, cleanup, and verification. You can automate the account cleanup process by using PowerShell to enable transcript logging, run scheduled audit scripts, automatically disable accounts, archive logs, trigger alerts. As an example, use this to start an audit log transcript. Then, run an audit script outlined in method one or two. Use Stop-Transcript to create tamper-resistant records. The blog includes full automation workflows, alerting logic, and cleanup scripts. By combining cloud audits, endpoint checks, group policy enforcement, and automation, you can consistently identify inactive accounts, remove unnecessary access, and maintain a clean identity environment. For more information, check out our official blog post on how to audit and remove stale admin accounts across tenants in Active Directory. Link in the description below.