As a administrator, I need to deactivate accounts after 90 days of inactivity. While AD prevents login both AD and local accounts are still active and potentially subject to a password hack. Collaboator account are the most important.