Report inactive computers in Active Directory

[HMCTech]

does anyone have a safe peice of software that will query active directory and generate a report on computers that have been inactive for over a period of time.

[somabc]

You can use dsquery to get a list eg. to find all computers unused for 8 weeks

dsquery computer -inactive 8 -limit 0

To delete the computers

dsquery computer -inactive 8 -limit 0 | dsrm

[3s-gtech]

You can use WSUS for this

[HMCTech]

thanks somabc,

Could you give some detail about the number after inactive and limit? I assume in your example 8 means it will show any computers inactive for over 8 weeks, and no limit ont he number of results?

[somabc]

Dsquery computer has details - inactive is no of weeks and limit is no of objects in AD to show with 0 being unlimited

[Hell-bent]

does anyone have a safe peice of software that will query active directory and generate a report on computers that have been inactive for over a period of time.

In case anyone is interested in solving issues of this kind using a third party solution, my personal advice is Softerra Adaxes. The software contains a vast list of AD reports, and the one particular that solves the issue is called "Inactive Computers". It allows to view computers inactive during a period of time. Thank you.

[MatthewL]

I use oldcmp and run this batch file

oldcmp -report -age 120 -format csv

You can change the format and age, I then just go through Active Directory and disable and move the accounts to another OU. You can get it to disable and delete the accounts I think but I wanted a little more control. Did 1800 machines the other week. You can download oldcmp if you just Google it.

[robk]

I use a small VB Script to pick out old machines and user details. Shout if you want a copy

[PiqueABoo]

I use oldcmp

Me too & can't think of anything better (it's from joeware.net amongst some other very good free utils)

[box_l]

I Have successfully used Quest AD Cmdlets for this task.

You will need to install and run the Quest Powershell console, these commands do not seem to run in the standard shell even with the cmdlets installed. A bit like exchange 2010 seems to need its own shell.

Quest AD Cmdlets are free to download from PowerShell Commands (CMDLETs) for Active Directory by Quest Software

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) }

Outputs to shell console

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\outdated.csv

Outputs to csv

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | Move-QADObject -to my.corp/obsolete

Moves to alternate OU

tack this to the end to disable the accounts

| disable-QADComputer

Check Locate obsolete computer records in AD « Dmitry’s PowerBlog: PowerShell and beyond for more.

And QAD cmdlets reference - PowerGUI Wiki

BoX

[TheLibrarian]

Me too & can't think of anything better (it's from joeware.net amongst some other very good free utils)

I love the warranty on the utilities he offers... warranty and license