I remember when I was ~14 at a private day school with a 1:1 laptop program in the early 00s, we were on AD. There was essentially one mac user in the IT department and the rest was windows, and inadvertently his mac created a hidden folder, I think it was "FindByContent" or something, that allowed full permission to all users in AD. Kids quickly noticed this, made a new AD group that was just us and locked it down a bit more, and for years interesting things started building up in that directory, pirated games (halo 1 for pc), artwork, test answers, even some porn if I remember correctly. Years later I worked for two years in that IT department and it was still there, with a whole decade of built-up content. We decommissioned it but it was super interesting to see how it had been used over the years.
This is required for Sox compliance and it’s relatively easy to use the pwsh get-aduser.
I would disagree they’re hard to find… lastlogondate yes depending which ad server queries back there used to be an issue but not so much anymore.
You just query all the domain controllers and use the most recent date