First of all, please note that  there is no disabled time stamp attribute in AD. Having said that, here are some tips to find when an account was disabled in Active directory: You can use ADSIedit to look at an account’s properties. Scroll all the way down and look at the Attribute called “whenChanged”. This will tell you when the account was disabled.