I'm tasked with searching for all users that have been disabled in the last thirty days, these are employees no longer in the company (cessation), to ensure that out IT matches the payroll and no one that doesn't work here anymore has access still .
Maybe in your windows the field name could be different.
But probably it could be better for you to list all the user name anche check if someone should be disabled and he isn't.
E.g. you could insert in a lookup (called e.g. user_check.csv) all the employees no longer in the company (cessation) in the last 30 days and run something like this: