Automating CrowdStrike User Cleanup – Seeking Script Guidance

[troyboy14k]

Hi All,

I'm working on a script that runs daily to identify and disable CrowdStrike Console users who have been inactive for 45 days or more. The goal is to streamline stale account management and improve overall console hygiene.
Has anyone implemented something similar or have insights on best practices for this type of automation? I'd appreciate any examples, tips, or lessons learned. I've been reviewing Get-FalconUser, but haven't had much luck.

Thanks in advance!

[bk-cs]

The last_login_date provided in a Get-FalconUser -Detailed result can be used to track the last time a user accessed the console. Here's a simple Where-Object example that can be used to filter users seen more than 45 days ago (not considering timezone differences):

Get-FalconUser -Detailed -All | Where-Object { (Get-Date).AddDays(-45) -lt $_.last_login_at }