This is required for Sox compliance and it’s relatively easy to use the pwsh get-aduser.

I would disagree they’re hard to find… lastlogondate yes depending which ad server queries back there used to be an issue but not so much anymore.