How do I find the occurrence of certain user accounts (by prefix or suffix)?

When you’re working with very large numbers of user accounts, and trying to understand the naming conventions that might be in use (because they’re probably not documented), this script can come in handy by showing us the occurrence of accounts with the same n characters at the beginning of their username (prefix).

The data set I’m working with is about 100,000 user accounts, so this can take some time to process.  Keep that in mind if you do have a large environment.

This script gets the top results (by count) of users with the same first 3 letters.

The resulting output should look something like this:

Great – now I can see there are large numbers of accounts that look like service accounts (both the sa- and svc prefixes) and delegate accounts (_de).  Also, the occurrence of bma and mra appear to be prefixes that denote certain business units.  Handy…


More interesting in my case is a similar script to find accounts by suffix.  Here we’re looking at grouping by just the last 2 characters:

And the results:

There seems to be quite a lot of accounts that end in 9, as well as accounts that end in 91, 92 and possibly more (will need to remove the -first 20 switch to see more).

An interesting naming convention, for sure, that will require investigation to unravel.

Leave a Reply

Your email address will not be published. Required fields are marked *