<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">I am trying to use the krblastsuccessfulauth attribute to detect accounts that have been inactive for >90 days as per this post: https://www.redhat.com/archives/freeipa-users/2015-March/msg00052.html</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">I need to be able to disable these accounts at 90 days then delete them after 180 days.</div><div><font face="Calibri,sans-serif">However, I find most of my users do not have the krblastsuccessfulauth attribute populated. This is not because their accounts have never been used as I see they do have valid passwords which expire in the future so they had to login at least once (not necessarily with Kerberos though). </font><span style="color: rgb(0, 0, 0); font-family: Calibri; font-size: 14px;">Is there another attribute we can/should use for this?</span></div><div><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><span style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri;">Justean Giger</span></div></body></html>