Should I only disable, but never delete an account from ActiveDirectory?

Question

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.

Is this a practice I should continue in Windows 2008R2?

How should locations with seasonal user accounts handle this? For example a school could give every student an AD account, and then disable them at the end of the semester. In just a few semesters, the quantity of accounts in "dormant mode" would grow quickly.

What is the best way to handle this situation?

Answer 1

Years ago I worked at a school board of 40,000+ users/staff, and each user had an AD account.

There was an Identity Management System in place, so the student records would populate AD. As long as the records were in the student system in a given state, the students existed in AD, but disabled if they had graduated, or whatever. Once the state of the student changed, the user was removed from AD, which if memory serves was a few years after graduation. I don't recall exactly, but I believe they were moved into a seperate OU too. They were kept because there was always a possibility that students would return for an extra semester, or work over the summer, or whatever.

The moral of the story: AD can easily handle large amounts of users, but removing them is dependent on the case of the user. If you need to keep the audit trail, leave the user but disable them and move them into a different OU. If they are seasonal, but may return leave them but disable them until they don't return for n number of seasons.