Inactive Users Tracing

We have allowed internet few hundred LAN users internet via there MAC addressess. They are created under

"Access Mgt > User Management > User Binding". Also by policy we have set to remove any active session (online users) at 5am daily for security purposes.

How can we track for inactive users who have not logged in / inactive internet users , or there last logged in date?

I am glad to see lots of replies, but most of them were posted without any proper solution. If sangfor IAG could have the column to display the LAST LOGGED IN DATE in the users binding section, life would have become so easy. Strange that this simple task is this much annoying to find.

Using the Entra ID Governance Access Review feature, it's possible to identify accounts that have not been actively used

To track inactive users who have not logged in or inactive internet users along with their last logged-in dates, you can implement a monitoring system within your network infrastructure. This system should log the MAC addresses of devices accessing the internet and their corresponding timestamps of last activity. By regularly querying this log, you can identify devices that have not accessed the network for a certain period, indicating inactive users. You can cross-reference this data with the user binding records in your Access Management system to correlate MAC addresses with specific users. This approach allows you to efficiently trace inactive users and manage network access effectively.

You can check the logs on the users login and activities

Hi, you can explore the "Custom Reports" on Log & Reports, so you can build an report where you can get all information that you want.

User Activity Logs:

    Filter by User Binding: Go to "Log & Report > Security Log".
    Apply Filters:
        Set "Log Type" to "User Binding".
        Select "Source MAC Address" from the dropdown and enter the desired MAC address or use wildcards (*) for broader searches.
        Consider additional filters like "Action" (e.g., "Successful Login", "Successful Logout") and "Interface" (if relevant) to refine results.
    Analyze Logs:
        Look for "Successful Login" events followed by no subsequent "Successful Logout" entries. This indicates an inactive user still consuming resources.
        Note the login timestamps to determine user inactivity duration.

Active User List:

    Access List: Go to "Security > User Mgmt > Active User List".
    Review Entries: This list shows currently active users and their relevant details (MAC address, login time, session duration).
    Identify Inactive Users: Compare the timestamps here with your expected user activity patterns. Users absent from this list for extended periods beyond their typical active hours are likely inactive.

Custom Reports:

    Generate Report: Go to "Log & Report > Custom Report".
    Select Elements: Include relevant fields like "User Name", "Source MAC Address", "First Login Time", "Last Activity Time", "Status" (e.g., "Active", "Inactive").
    Filter Criteria: Apply filters based on MAC address range, desired inactivity duration, or other criteria to pinpoint inactive users efficiently.
    Schedule Reports: Consider automating report generation and delivery for regular monitoring.

Additional Recommendations:

    Set a Clear Inactivity Threshold: Define a reasonable timeframe for considering a user inactive based on your organization's security policies and user behavior patterns.
    Incorporate Additional Factors: While MAC address binding offers basic monitoring, consider integrating user login credentials or endpoint management solutions for more granular tracking.
    Regularly Review and Update: Periodically assess and adjust your tracking methods and thresholds to adapt to evolving needs and security best practices.

By effectively combining these strategies, you can accurately track inactive users, ensure optimal internet resource utilization, and enhance your overall network security posture.

Set up scheduled scans or scripts that run at specific intervals to identify inactive users. These scans can query logs or network devices to gather information about user activities.

If you have a proxy server in your network, review its logs to see user activities. Proxy logs can provide information about which users accessed the internet and when.

Network Access Control solutions often provide insights into user activities and can help identify inactive users. Check the reporting features of your NAC solution.

Since you mentioned that users are managed under "Access Mgt > User Management > User Binding," check the access management system for logs or reports on user logins and activities.