How to configure a process to disable ad user account whose last logon date is older than 15 days?

There are various factors here. Do you watch the LastLogon column? If not, you should do that. Then, it will be stored in DialogWatchProperty.

You can run a process plan then which selects all entries where LastLogon column was earlier than 15 days, and using a combibation of DialogWatchOperation and DialogWatchProperty you should be able to find the ADSAccounts which need disabling, which can finally be done using a simple process.

Apologies for the concise explanation, but hope that helps

There are various factors here. Do you watch the LastLogon column? If not, you should do that. Then, it will be stored in DialogWatchProperty.

You can run a process plan then which selects all entries where LastLogon column was earlier than 15 days, and using a combibation of DialogWatchOperation and DialogWatchProperty you should be able to find the ADSAccounts which need disabling, which can finally be done using a simple process.

Apologies for the concise explanation, but hope that helps

The last logon time stamp should be read by the sync already. So just create a process on ADSAccount that sets the ad user account to disabled listening to an custom event (e.g. "NotUsedIn15Days"). The process will be triggered by a daily schedule firing the custom event on ADSAccount for all ADSAccounts where last logon is lower than today - 15 days.