User Account Audit Reference

The User Account Audit inspects local user accounts and alerts on locked accounts, inactive users, and enabled default administrator accounts.

Configuration fields

Collected metrics

• Account statistics: total, enabled, disabled, admin, locked, and inactive account counts
• Full account inventory — every inspected account with username, enabled/admin/locked tags, last-login timestamp when known, days inactive, and the per-account result
• List of flagged accounts — each entry carries the username, the reason it was flagged (for example Account is locked, Inactive for N days, Default admin account is enabled, or Never logged in or last login date unknown), the last-login timestamp when known, and the per-account result severity

Result views

The check result is shown in two views. The Detail view renders the latest run as a point-in-time snapshot: the account statistics above, the flagged accounts highlighted with their reasons, and the full account inventory table. The History view renders the recorded run history.

History view

The History view keeps a per-run record so you can follow the audit over time. It has two parts.

A trend chart (labelled Total accounts) plots the total account count of each recorded run in chronological order, with the date of the first and last run on the axis and the most recent total called out alongside the label. It is a trend you read from the rising or falling line, not an explicit accounts-added or accounts-removed metric. The chart is drawn only when at least two runs carry a total count.

Below the chart, a per-run table lists each recorded run with the following columns:

Platform support

Notes

• On Windows, the check enumerates local user accounts by invoking PowerShell Get-LocalUser (via EncodedCommand to avoid locale-dependent net user output). Domain accounts are not included.
• On Linux, the check reads /etc/passwd for the account list, uses passwd -S <user> to detect locked accounts, and reads last-login times via lastlog -u <user> with a last -1 -F <user> fallback when lastlog is unavailable.
• On macOS, the check enumerates accounts via dscl . list /Users, reads dscl . read /Users/<user> AuthenticationAuthority to detect DisabledUser / LockedAccount markers, and uses last -1 -y <user> for the last-login time.
• The "last login" metric uses the OS-reported last interactive login time. Service accounts that authenticate via APIs may appear as inactive.
• The check runs every 24 hours (1440 minutes) by default.

See also: Configure the User Account Audit