What method is generally used to disable unused user accounts?

Marking unused user accounts as inactive is a widely accepted method for managing user accounts effectively within organizations. This approach allows administrators to effectively disable access without permanently deleting the account. By marking an account as inactive, the organization maintains a record of the user account, which can be useful for auditing purposes or if the account needs to be reactivated in the future.

Moreover, this method helps in ensuring compliance with data retention policies and reduces the risk of accidental data loss. Other options, though they might seem effective, may lead to complications. For example, changing passwords could lead to confusion if an account is reactivated later, and permanent deletion removes valuable historical data about user activity. Auditing and locking accounts out are typically measures taken after suspicious activity is detected, rather than as a regular practice for simply disabling unused accounts. Hence, marking accounts as inactive provides a balanced approach that supports both security and operational needs.