Report inactive computers in Active Directory

[HMCTech]

does anyone have a safe peice of software that will query active directory and generate a report on computers that have been inactive for over a period of time.

[somabc]

You can use dsquery to get a list eg. to find all computers unused for 8 weeks

 

dsquery computer -inactive 8 -limit 0

 

To delete the computers

 

dsquery computer -inactive 8 -limit 0 | dsrm

Edited April 26, 2010 by somabc

[3s-gtech]

You can use WSUS for this

[HMCTech]

thanks somabc,

 

Could you give some detail about the number after inactive and limit? I assume in your example 8 means it will show any computers inactive for over 8 weeks, and no limit ont he number of results?

[somabc]

Dsquery computer has details - inactive is no of weeks and limit is no of objects in AD to show with 0 being unlimited

[MatthewL]

I use oldcmp and run this batch file

 

oldcmp -report -age 120 -format csv

 

You can change the format and age, I then just go through Active Directory and disable and move the accounts to another OU. You can get it to disable and delete the accounts I think but I wanted a little more control. Did 1800 machines the other week. You can download oldcmp if you just Google it.

[robk]

I use a small VB Script to pick out old machines and user details. Shout if you want a copy

[PiqueABoo]

I use oldcmp

 

Me too & can't think of anything better (it's from joeware.net amongst some other very good free utils)

[box_l]

I Have successfully used Quest AD Cmdlets for this task.

 

You will need to install and run the Quest Powershell console, these commands do not seem to run in the standard shell even with the cmdlets installed. A bit like exchange 2010 seems to need its own shell.

 

Quest AD Cmdlets are free to download from PowerShell Commands (CMDLETs) for Active Directory by Quest Software

 

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) }

Outputs to shell console

 

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\outdated.csv

Outputs to csv

 

get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | Move-QADObject -to my.corp/obsolete

Moves to alternate OU

 

tack this to the end to disable the accounts

| disable-QADComputer

 

Check Locate obsolete computer records in AD « Dmitry’s PowerBlog: PowerShell and beyond for more.

 

And QAD cmdlets reference - PowerGUI Wiki

 

BoX

[Guest TheLibrarian]

Me too & can't think of anything better (it's from joeware.net amongst some other very good free utils)

 

I love the warranty on the utilities he offers... warranty and license

[ColinP]

Cjwdev | AD Tidy Free software can tell you the last time a pc was seen on the network, what dc it logged on to, and you can disable and move computer / user accounts all at the same time

[zag]

We use Dovestone True Last Logon

 

Active Directory True Last Logon - dovestones software

 

Just change the option to show when a computer was last logged on and sort it by date. I usually do this once a term.

[round2it]

admanager plus is good for this it also lets you export info about groups

 

install on your workstation you dont need to touch the server