+ Post New Thread
Results 1 to 15 of 15
Windows Thread, AD Clean Up Tips in Technical; Hey People, Started a new job at a college and looking at their AD now it’s a mess!! Stuff never ...
  1. #1
    RobFuller's Avatar
    Join Date
    Feb 2007
    Location
    Chelmsford
    Posts
    312
    Thank Post
    82
    Thanked 39 Times in 29 Posts
    Rep Power
    22

    AD Clean Up Tips

    Hey People,

    Started a new job at a college and looking at their AD now it’s a mess!! Stuff never been deleted like user and computer accounts etc.
    Does anyone have any good tools that could do a ‘scavenge’ and look for accounts that haven’t been used for a long time (i.e. for leavers) or for computer accounts that are no longer in use.

    Anything would help at the moment, otherwise it’s just a good old clean up job! Any tips or anything much appreciated!

    Cheers people,
    Rob

  2. #2

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,343
    Thank Post
    624
    Thanked 1,584 Times in 1,421 Posts
    Rep Power
    414

  3. #3
    RobFuller's Avatar
    Join Date
    Feb 2007
    Location
    Chelmsford
    Posts
    312
    Thank Post
    82
    Thanked 39 Times in 29 Posts
    Rep Power
    22

    Re: AD Clean Up Tips

    Thank you, that looks good. Ill give that a try!

  4. #4

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: AD Clean Up Tips

    OldCmp is great for deleting old computer accounts
    http://www.joeware.net/freetools/tools/oldcmp/index.htm
    It will only let you disable computers first as a safety mechanism

    For accounts I just use an AD query to filter user accounts not logged on in xx amount of days. Then I disable them for a while and if I hear no moans they get deleted

  5. #5
    RobFuller's Avatar
    Join Date
    Feb 2007
    Location
    Chelmsford
    Posts
    312
    Thank Post
    82
    Thanked 39 Times in 29 Posts
    Rep Power
    22

    Re: AD Clean Up Tips

    OldCmp is good, giving me a decent list of users and comps that need attention so to speak. Format needs working on but that nothing that I can’t sort out in Excel.
    Thanks guys!

  6. #6

    Join Date
    Jul 2007
    Location
    Miami, Fl
    Posts
    3
    Thank Post
    4
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: AD Clean Up Tips

    We use Active Directory Janitor for this. A pretty simple tool. I just use it to run reports to find dead computer accts. It can also find user accts that havent logged in forever. Disable everything, delete later! Ive used oldcmp with good results as well.

  7. #7

    Join Date
    Nov 2006
    Location
    Reading, UK
    Posts
    487
    Thank Post
    30
    Thanked 14 Times in 8 Posts
    Rep Power
    18

    Re: AD Clean Up Tips

    I've used this for testing and so forth. May find it useful?

    http://manageengine.adventnet.com/pr...ger/index.html

  8. #8
    Richie1972's Avatar
    Join Date
    Apr 2006
    Location
    Blackburn
    Posts
    239
    Thank Post
    2
    Thanked 6 Times in 6 Posts
    Rep Power
    18

    Re: AD Clean Up Tips

    Alternatively just run an Active Directory query against user or computer accounts based on last logon

  9. #9

    Join Date
    Aug 2005
    Location
    London
    Posts
    3,154
    Thank Post
    114
    Thanked 527 Times in 450 Posts
    Blog Entries
    2
    Rep Power
    123

    Re: AD Clean Up Tips

    Last logon is not always accurate. If you have more than 1 DC then you're only seeing the logon time at the DC you query.

    If you have a Windows 2003 domain (at 2003 FFL) then there is also Last-Logon-Timestamp which is more useful (because it's replicated between servers) and would be good for this (but is not always good for telling you when someone most recently logged on - it can be up to 14 days out of date)

  10. #10

    Join Date
    Nov 2006
    Location
    Reading, UK
    Posts
    487
    Thank Post
    30
    Thanked 14 Times in 8 Posts
    Rep Power
    18

    Re: AD Clean Up Tips

    To get last logon information we have placed a command in the login script to write to a text file with the following variables, %username$, %time% and %date%.

    This is then outputted to two different files, one named with the computer name and the other named by the username. This is so we can track computer and user usage.

  11. #11
    Nick_Parker's Avatar
    Join Date
    Jan 2008
    Location
    Dainfern, South Africa
    Posts
    436
    Thank Post
    95
    Thanked 18 Times in 13 Posts
    Rep Power
    17

    Re: AD Clean Up Tips

    I'm pretty sure I'm being daft, but what Fields to you use in your AD filter to show users who haven't logged on in more than 60 days?

    I'd assume it'd be under User, but I can't find anything there that links to "Last Logon" or anything similar?

  12. #12

    Join Date
    Jul 2007
    Location
    Devon
    Posts
    233
    Thank Post
    8
    Thanked 9 Times in 8 Posts
    Rep Power
    16

    Re: AD Clean Up Tips

    I believe that it's one of the many millions (well, ok, not millions) of hidden fields which exist for user/computer accounts.

    you can see it using ADSI Edit, but I am unsure if you can search for acounts and do stuff like that in ADSI Edit (you can set values and view them though...)

    From what I've read and noticed, this is largely something that is automated using VB scripts and the such...

  13. #13

    Join Date
    Nov 2007
    Posts
    554
    Thank Post
    3
    Thanked 3 Times in 3 Posts
    Rep Power
    15
    Quote Originally Posted by plock View Post
    To get last logon information we have placed a command in the login script to write to a text file with the following variables, %username$, %time% and %date%.

    This is then outputted to two different files, one named with the computer name and the other named by the username. This is so we can track computer and user usage.
    Any chance you can post up the login script you use please?

    Thanks. .

  14. #14
    gshaw's Avatar
    Join Date
    Sep 2007
    Location
    Essex
    Posts
    2,650
    Thank Post
    164
    Thanked 217 Times in 200 Posts
    Rep Power
    66
    Could anyone upload the oldcmp.exe file please as the whole joeware site seems to be down

  15. #15
    bizzel's Avatar
    Join Date
    Jul 2007
    Location
    Cambridge
    Posts
    654
    Thank Post
    102
    Thanked 204 Times in 72 Posts
    Rep Power
    51
    Quote Originally Posted by srochford View Post
    Last logon is not always accurate. If you have more than 1 DC then you're only seeing the logon time at the DC you query.
    Yes, be careful with that as I've had users I know to be active thrown up in LDAP queries using last logon.

SHARE:
+ Post New Thread

Similar Threads

  1. clean up PC
    By Uraken in forum General Chat
    Replies: 9
    Last Post: 23rd February 2007, 08:03 AM
  2. Replies: 3
    Last Post: 9th September 2006, 08:13 PM
  3. Clean permanent marker off projector lens
    By ken_kaniff in forum How do you do....it?
    Replies: 12
    Last Post: 25th May 2006, 06:20 PM
  4. Replies: 5
    Last Post: 5th March 2006, 01:22 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •