Skip to content

Instantly share code, notes, and snippets.

@9to5IT
Created July 4, 2016 12:06
Show Gist options
  • Star 35 You must be signed in to star a gist
  • Fork 11 You must be signed in to fork a gist
  • Save 9to5IT/ce47adee89e9611050d89e2ae210eb74 to your computer and use it in GitHub Desktop.
Save 9to5IT/ce47adee89e9611050d89e2ae210eb74 to your computer and use it in GitHub Desktop.
PowerShell: Cleanup inactive AD computer objects
Import-Module ActiveDirectory
# Set the number of days since last logon
$DaysInactive = 90
$InactiveDate = (Get-Date).Adddays(-($DaysInactive))
#-------------------------------
# FIND INACTIVE COMPUTERS
#-------------------------------
# Below are three options to find inactive computers. Select the one that is most appropriate for your requirements:
# Get AD Computers that haven't logged on in xx days
$Computers = Get-ADComputer -Filter { LastLogonDate -lt $InactiveDate -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Get AD Computers that have never logged on
$Computers = Get-ADComputer -Filter { LastLogonDate -notlike "*" -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Automated way (includes never logged on computers)
$Computers = Search-ADAccount -AccountInactive -DateTime $InactiveDate -ComputersOnly | Select-Object Name, LastLogonDate, Enabled, DistinguishedName
#-------------------------------
# REPORTING
#-------------------------------
# Export results to CSV
$Computers | Export-Csv C:\Temp\InactiveComputers.csv -NoTypeInformation
#-------------------------------
# INACTIVE COMPUTER MANAGEMENT
#-------------------------------
# Below are two options to manage the inactive computers that have been found. Either disable them, or delete them. Select the option that is most appropriate for your requirements:
# Disable Inactive Computers
ForEach ($Item in $Computers){
$DistName = $Item.DistinguishedName
Set-ADComputer -Identity $DistName -Enabled $false
Get-ADComputer -Filter { DistinguishedName -eq $DistName } | Select-Object Name, Enabled
}
# Delete Inactive Computers
ForEach ($Item in $Computers){
Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false
Write-Output "$($Item.Name) - Deleted"
}
@Caesar008
Copy link

Caesar008 commented Oct 2, 2020

Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false not always remove computer object if it contains other objects inside.
Using Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false will remove also these computer objects.

@Keymi06
Copy link

Keymi06 commented Dec 19, 2023

@Caesar008 Sorry Im noob, where do you put the Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false ?

@9to5IT
Copy link
Author

9to5IT commented Dec 20, 2023

@Keymi06 you would replace line 41 in the gist above wit the line @Caesar008 has specified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment