How do you workout which computers are no longer needed in AD

[TwistedHelixis]

Just taken a look at some of my computer OUs in AD and there are a load of computers listed, I am sure most are no longer even in service.

 

Is there an easy way to workout which computers I can delete?

[psydii]

Disable ones whos password last change date is greater than 3 months. (if its the middle of the academic year, you can tighten this up to those that haven't updated in a month.

 

But better would be to implement processes whereby as a computer is replaced their account is automatically disables and moved to an OU pending deletion at some later time.

 

Imaged devices should re-use their accounts automatically, but if the technician at the console notices it asks for a new name, its old name should be manually archived as above.

 

I think we have a script processing old computer accounts, but fairly sure it came from stackexchange.

[Oaktech]

Delete them and see who complains.

 

[Koldov]

Looking at the properties of a computer in AD and the 'Attribute Editor' tab has a 'lastLogonTimestamp' value and this seems to correspond with the properties of the 'Object' 'tab 'Modified' date/time value.

 

I'm presuming this is the date/time of the last interaction with AD, so maybe you could find a PS script to query either of these values and produce a list, then work through starting from the oldest.

 

Interesting point as to why there are so many, any reason?

[psydii]

looking at the code... I wonder if this didn't from from stackexchange, but was actually written by me. lol. anyway, code isn't tricky

 

$ListOfMachines = get-adcomputer -properties * -filter * | where { $_.lastLogonDate -lt (get-date).addmonths(-1) }

 

#Lets export that as an object, so if we need to do anything with this info / restore things later we can.

Export-Clixml -InputObject $ListOfMachines -Path .\THISFILENAMESHOULDBEGENERATEDPROGRAMATICALLYSOWEDONTHAVETOEDITITEACHTIME.xml

 

 

#Now move any machine that hadn't logged on in the above time to a special OU

foreach ($machine in $ListOfMachines) {move-adobject $machine -targetpath "OU=BLAH,OU=BLAh,OU=BLAH,DC=school,DC=LocalAuthority,DC=sch,DC=uk"}

 

 

The -properties * and the export step gives us a huge amount of meta data about the old accounts, so if at some point after we delete them, and then we need to know something (like group membership, SID or SPN) we have a record of it.

 

Also above I suggested password change date, but clearly when I set this up, I decided last logon time was a more appropriate value to filter on.

[Jobos]

I've use OldCmp in the past and it worked well producing a html list of computers. OldCmp

[Davit2005]

Previous place we had an asset system. Once a year would go around and check rooms. All rooms had their own OU which made Group Policy printer deployment very easy.

[Rob_D]

We'd just make sure everything that's physically there is turned on and then ping every computer name in AD. Any that don't respond are deleted.

[HPlum78]

$ous = ("OU=Win7,OU=StaffPC,OU=Workstations,DC=yourdomain,DC=ac,DC=uk","OU=Win7,OU=StudentPC,OU=Workstations,DC=yourdomain,DC=ac,DC=uk")
$inactiveDays=180
$inactiveCMPs = @()
write-output "Inactive computer objects, based on inactive days filter of: $inactiveDays"
foreach ($ou in $ous){
   $inactiveCMP1 = Search-ADaccount -ComputersOnly -AccountInactive -Timespan (New-TimeSpan -Days $inactiveDays) -SearchBase $ou
   $allcomps = (Get-ADComputer -Filter * -SearchBase $ou | measure).count
   
   foreach ($comp in $inactiveCMP1){
       $mycomp = Get-ADObject $comp.DistinguishedName -Properties operatingsystem,canonicalName,Modified,operatingsystemversion
       $comp | Add-Member -MemberType NoteProperty -Name canonicalName -Value $( $mycomp.canonicalName.substring(0, $mycomp.canonicalName.lastIndexOf("/")) ) -Force
       $comp | Add-Member -MemberType NoteProperty -Name Modified -Value $mycomp.Modified -Force
       $comp | Add-Member -MemberType NoteProperty -Name OS -Value $mycomp.OperatingSystem -Force
       $comp | Add-Member -MemberType NoteProperty -Name OSVersion -Value $mycomp.operatingsystemversion -Force
      
   }
   $inactiveCMPs += $inactiveCMP1
   
   Write-output "$ou, All computers: $allcomps, inactive computers: $(($inactiveCMP1 | measure).count)"
   #$inactiveCMP1 | group canonicalname | select name, count

}
$mydate = get-date -Format HH-mm_dd-MM-yyyy
$inactiveCMPs | export-csv C:\temp\inactivecomputerreport_daysinactive_$inactiveDays_$mydate.csv

[simpsonj]

Might be worth looking at AD Tidy, I think the free version can pull a list of Computer accounts and Last Logon.

[timbo343]

Have a look at this:

https://www.manageengine.com/products/free-windows-tools/free-system-inventory-tool.html

 

install, add your domain, add all your computers and you'll see when machines were last switched on

[MrKJLS]

We use the Dovestones tools before look for unused devices

 

https://dovestones.com/active-directory-reporting/

[speakercon]

I have an OU with a GPO that prevents staff/students from logging in and has a logon image saying 'Contact IT Support'. Any machines that are unknown get put in there, if they are in use we are quickly made aware of it.

 

Also a look in the attribute editor 'lastlogon' for the machine shows the last login time/date which is a pretty good indication if it no longer exists.

Edited May 9, 2023 by speakercon

[PotNoodleTech]

I have an OU with a GPO that prevents staff/students from logging in and has a logon image saying 'Contact IT Support'. Any machines that are unknown get put in there, if they are in use we are quickly made aware of it.

 

Also a look in the attribute editor 'lastlogon' for the machine shows the last login time/date which is a pretty good indication if it no longer exists.

 

That's a great way of doing it!

 

*gets out notebook and looks over sepakercon's shoulder *

[HPlum78]

 

So the script I posted above will give you an output like the one in the picture giving you the total computer accounts in the given OU's and the number that have a lastlogoon time stamp older than 180 (this is a var and can be changed!), the script will also output a csv file. If you really want to you can grab the csv output and use test-netconnection (more advanced ping) and check if the computers are indeed on the network or not (bit over kill as after 180 days there are other questions I would have about the workstation in question...) but like @phydii has said this script also moves the account to a pending deletion OU along with disabling the accounts in question (not included here as you will all have different requirements).

[Ex-MGSTech]

Try these free tools from Solar Winds:

https://www.solarwinds.com/free-tools/active-directory-admin-tools-bundle

[TwistedHelixis]

Think i have worked out a nice, very simple solution. Simply add the modified column to AD window.

 

Not 100% sure, but I think the modified date is the last time the device accessed AD.

[FN-GM]

I have made a script that automatically sends an email when computers haven’t been used in x amount of days and sends the data in an email. I can share if you like?

[clareq]

Think i have worked out a nice, very simple solution. Simply add the modified column to AD window.

 

Not 100% sure, but I think the modified date is the last time the device accessed AD.

 

Not sure it is - I have machines I know are currently in use, with a modified date in AD over 2 weeks ago.

[LeMarchand]

Not sure it is - I have machines I know are currently in use, with a modified date in AD over 2 weeks ago.

 

Could the date be last time they were powered up from shut down?

[clareq]

We have a power off script run every night, so I would expect machines in use to have been powered up this morning

[FN-GM]

Could the date be last time they were powered up from shut down?

 

There is a last login time stamp for computers. But this doesn’t update frequently, every 14 days or so. I just make an allowance for this with my automated scripting.

[CHiLL]

There are last "lastLogon" and "whenChanged" extended attributes that could be queried. Looking at one machine, I can see that "lastLogon" was modified today at 11:36:58, about just over 20 minutes before posting this. However, I don't know how I'd actually query this in PowerShell and get a useful result.

[psydii]

Another way, more work, but would make finance/auditors happier is to actually eyeball every computer and check them off against accounts in AD. If you can't physically find the computer, its account gets disabled.