Active Directory Clean up

[Jake]

Morning all,

 

Spent yesterday diagnosing a login issue and in doing so I realised how much of a mess our AD is, redundant accounts, empty OUs, empty groups, groups that contain another group as a member and that group has the initial group as a member, so effectively just looping around on itself and achieving nothing.

 

Just wondered what methods you all use to clean up AD, redundant accounts are easy enough to manage by last login date, but the looping groups thing I'm not so sure of the best way to get an idea of , which doesnt involve me having to check every group.

[FN-GM]

Morning all,

 

Spent yesterday diagnosing a login issue and in doing so I realised how much of a mess our AD is, redundant accounts, empty OUs, empty groups, groups that contain another group as a member and that group has the initial group as a member, so effectively just looping around on itself and achieving nothing.

 

Just wondered what methods you all use to clean up AD, redundant accounts are easy enough to manage by last login date, but the looping groups thing I'm not so sure of the best way to get an idea of , which doesnt involve me having to check every group.

 

I just try to keep it as simple as possible. I also use some powershell scripts that will disbale inactive accounts and diable and eventually delete old computers.

[deano]

That sounds nice! Any chance of a look?

[FN-GM]

Yep, I am away from the office until next week. I am going to make a blog about them soon

[deano]

that would be nice to see. We were about to embark on a manual process of this task ourselves over summer, but this would be great!

[zag]

I use Dovestone Tools utilities.

 

Active Directory Tools, Active Directory Software

 

They have a last logon and last computer seen features that can show which computers and users are now redundant.

 

I tend to clean any computer or user that has not been "seen" on the network in the last 6 months.

 

Keeps things very clean.

 

EDIT: This is the actual app. Costs $99 and well worth it.

 

http://www.dovestones.com/products/True_Last_Logon.asp

Edited June 28, 2012 by zag

[Heebeejeebee]

Don't let it get into a mess in the first place

 

 

HBJB

[tumbleweed]

OldCmp

[beany1]

the solarwinds "trio of AD tools" work well for deleting old computers / user accounts:

 

Download FREE trials from SolarWinds

[Synkrox]

Check out AD Tidy from cjwdev dot co dot uk - its free and will help you clear all the mess out - certainly did for me when I inherited a network with loads of old muck lying about.