How to do it:
1. Build a table about users
Start off by going into Table Explorer. This is where we build reports and documentation about basically anything IT related.
Hit, New Table and select “User accounts”.
If done correctly you will now see a list of all user accounts found by vScope, both domain and local. Next step is to add some information about them. In this case I’m going to add Groups and Time since last logon:
This is already a fantastic documentation of our user setup that only took me 10 seconds to build. So please take a few minutes to just scroll through your list to see if you can find anything interesting before continuing to the next step.
2. Translate your licensing rules into filters
Finished? Good, the next step is to add rules to only show user accounts relevant for our use case (user accounts with a license). I know that there are a lot of test and SYS accounts in the list so how can we make it more relevant? With filters of course!
For instance, I know that we have Office 365 E3 licenses connected to all users in the “Office 365 E3” user group. What I need to do is to filter this in vScope.
NOTICE: obviously you should use your rules here i.e. group names of users connected to any kind of license you want to find.
Let’s add a filter so that only users in the group “Office 365 E3”…
The result will now show all user accounts in the group “Office 365 E3”.
Take a few minutes and scroll through your result and see if you find anything interesting (if not, I will show you something in the next step).
3. Find unused licenses
I’ve noticed that a few of my accounts are obsolete and not anything I’m paying a license for. So let us refine the result by only showing Active accounts:
Better… in this case I won’t exclude “Disabled” user accounts since our policy is to deactivate accounts if they are not supposed to have licenses. If your organization think differently, you can exclude disabled accounts as well by setting “Disabled = NOT true”.
To translate this table into cost savings I will filter and only show user accounts that have not authenticated to the Active Directory in 180 days. This can of course be any day range you want but 180 days are good for me since this will exclude eg. vacations or parental leave from the result (you can of course set this to any date range depending on your policies for deactivation of accounts).
Add 180 days-filter (expressed “180d-” in the ‘Range-’ filter panel)
Also, consider to scroll through this list and hide any accounts that still might be in use all though not being active for a long time.
Great! Let’s read out this report together:
- in a group which I know is connected to a licensing cost…
- but have not logged in for 180 days
In my case I’ve found 34 user accounts. That’s about SEK200 a month per account (approx. $20/month) resulting in about SEK80.000 a year! (approx $8000/year). Not bad for a two minutes job, right?
Next for me is to send this report to the one responsible for deactivating these accounts and ensure that we don’t need to pay for these licenses. SEK80.000 a year!
Let’s not stop there. You can with these steps continue to build reports about user accounts. Why not look for active domain admins or external users (consultants) still active in the AD? I will leave all craftsmanship to you. A hint is that you will use the exact same method.
Most importantly, how much did you save from using this guide?