How about something like:
(name of it, last logon of it as string | “n/a”, account disabled flag of it, full name of it | “n/a”, account expiration of it as string | “n/a”) of users
For reference, please see the following for the ‘user’ inspector:
https://developer.bigfix.com/relevance/reference/user.html
Note that the analysis should likely have applicability relevance to exclude Domain Controllers:
product type of it != nt domain controller product type