<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div><div>I should add that I do not have the "disable last success" option enabled for the IPA server</div><div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Justean</font></font></div></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Justean Giger <<a href="mailto:jgiger@one.verizon.com">jgiger@one.verizon.com</a>><br><span style="font-weight:bold">Date: </span> Friday, January 6, 2017 at 9:10 AM<br><span style="font-weight:bold">To: </span> "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br><span style="font-weight:bold">Subject: </span> disable inactive accounts and delete old accounts<br></div><div><br></div><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
I am trying to use the krblastsuccessfulauth attribute to detect accounts that have been inactive for >90 days as per this post: <a href="https://www.redhat.com/archives/freeipa-users/2015-March/msg00052.html">https://www.redhat.com/archives/freeipa-users/2015-March/msg00052.html</a></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
I need to be able to disable these accounts at 90 days then delete them after 180 days.</div><div><font face="Calibri,sans-serif">However, I find most of my users do not have the krblastsuccessfulauth attribute populated. This is not because their accounts have never been used as I see they do have valid passwords which expire in the future so they
had to login at least once (not necessarily with Kerberos though). </font><span style="color: rgb(0, 0, 0); font-family: Calibri; font-size: 14px;">Is there another attribute we can/should use for this?</span></div><div><br></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><span style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri;">Justean</span></div></div></div></span></body></html>