Created
July 4, 2016 12:06
-
-
Save 9to5IT/ce47adee89e9611050d89e2ae210eb74 to your computer and use it in GitHub Desktop.
PowerShell: Cleanup inactive AD computer objects
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Import-Module ActiveDirectory | |
# Set the number of days since last logon | |
$DaysInactive = 90 | |
$InactiveDate = (Get-Date).Adddays(-($DaysInactive)) | |
#------------------------------- | |
# FIND INACTIVE COMPUTERS | |
#------------------------------- | |
# Below are three options to find inactive computers. Select the one that is most appropriate for your requirements: | |
# Get AD Computers that haven't logged on in xx days | |
$Computers = Get-ADComputer -Filter { LastLogonDate -lt $InactiveDate -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName | |
# Get AD Computers that have never logged on | |
$Computers = Get-ADComputer -Filter { LastLogonDate -notlike "*" -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName | |
# Automated way (includes never logged on computers) | |
$Computers = Search-ADAccount -AccountInactive -DateTime $InactiveDate -ComputersOnly | Select-Object Name, LastLogonDate, Enabled, DistinguishedName | |
#------------------------------- | |
# REPORTING | |
#------------------------------- | |
# Export results to CSV | |
$Computers | Export-Csv C:\Temp\InactiveComputers.csv -NoTypeInformation | |
#------------------------------- | |
# INACTIVE COMPUTER MANAGEMENT | |
#------------------------------- | |
# Below are two options to manage the inactive computers that have been found. Either disable them, or delete them. Select the option that is most appropriate for your requirements: | |
# Disable Inactive Computers | |
ForEach ($Item in $Computers){ | |
$DistName = $Item.DistinguishedName | |
Set-ADComputer -Identity $DistName -Enabled $false | |
Get-ADComputer -Filter { DistinguishedName -eq $DistName } | Select-Object Name, Enabled | |
} | |
# Delete Inactive Computers | |
ForEach ($Item in $Computers){ | |
Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false | |
Write-Output "$($Item.Name) - Deleted" | |
} |
@Caesar008 Sorry Im noob, where do you put the Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false
?
@Keymi06 you would replace line 41 in the gist above wit the line @Caesar008 has specified.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false
not always remove computer object if it contains other objects inside.Using
Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false
will remove also these computer objects.