Jump to content
  • entries
    78
  • comments
    135
  • views
    2,223

Spring Cleaning your AD


That time of year again (well - for us anyway), after doing a load of machine rebuilds - and name changes etc - your AD may look a bit cluttered. Even more so as we moved from using RIS (groan - old tech alert) to SCCM...

 

So - rather than resurrect some old threads, here is a collection of highly useful powershell scripts to hunt out those old computers and remove them or move them to another OU so you can spot them all together.

 

Credit to original posters: Boz_l and Rabbieburns

 

For this, you will need to install and run the Quest Powershell console.

 

Quest AD Cmdlets are free to download from PowerShell Commands (CMDLETs) for Active Directory by Quest Software

 

:mad: GOTCHA: these commands do not seem to run in the standard shell even with the cmdlets installed. A bit like exchange 2010 seems to need its own shell.

 

 

Outputs to shell console:

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } 

 

 

Outputs to csv:

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\outdated.csv

 

 

 

Moves to alternate OU:

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | Move-QADObject -to my.corp/obsolete 

 

Tack this to the end to disable the accounts:

 

| disable-QADComputer

 

Check Locate obsolete computer records in AD « Dmitry’s PowerBlog: PowerShell and beyond for more.

 

And QAD cmdlets reference - PowerGUI Wiki

 

Enjoy :-)

3 Comments


Recommended Comments

RabbieBurns

Posted

If you run the following command

 

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue

in a standard shell, you can then run the above Quest cmdlets

FN-GM

Posted

Thanks allot. I was wondering if you know how i can make the script put a date of when it disabled a computer in the computers description field in AD?

 

Thanks

TheScarfedOne

Posted

You probably can. I dont see any reason why not. It would just be a read in the variable, and do a compare against another variable taking the date to disable.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...