Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
PowerShell: Cleanup inactive AD computer objects
Import-Module ActiveDirectory
# Set the number of days since last logon
$DaysInactive = 90
$InactiveDate = (Get-Date).Adddays(-($DaysInactive))
#-------------------------------
# FIND INACTIVE COMPUTERS
#-------------------------------
# Below are three options to find inactive computers. Select the one that is most appropriate for your requirements:
# Get AD Computers that haven't logged on in xx days
$Computers = Get-ADComputer -Filter { LastLogonDate -lt $InactiveDate -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Get AD Computers that have never logged on
$Computers = Get-ADComputer -Filter { LastLogonDate -notlike "*" -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Automated way (includes never logged on computers)
$Computers = Search-ADAccount -AccountInactive -DateTime $InactiveDate -ComputersOnly | Select-Object Name, LastLogonDate, Enabled, DistinguishedName
#-------------------------------
# REPORTING
#-------------------------------
# Export results to CSV
$Computers | Export-Csv C:\Temp\InactiveComputers.csv -NoTypeInformation
#-------------------------------
# INACTIVE COMPUTER MANAGEMENT
#-------------------------------
# Below are two options to manage the inactive computers that have been found. Either disable them, or delete them. Select the option that is most appropriate for your requirements:
# Disable Inactive Computers
ForEach ($Item in $Computers){
$DistName = $Item.DistinguishedName
Set-ADComputer -Identity $DistName -Enabled $false
Get-ADComputer -Filter { DistinguishedName -eq $DistName } | Select-Object Name, Enabled
}
# Delete Inactive Computers
ForEach ($Item in $Computers){
Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false
Write-Output "$($Item.Name) - Deleted"
}
@Caesar008

This comment has been minimized.

Copy link

@Caesar008 Caesar008 commented Oct 2, 2020

Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false not always remove computer object if it contains other objects inside.
Using Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false will remove also these computer objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment