Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
PowerShell: Cleanup inactive AD computer objects
Import-Module ActiveDirectory
# Set the number of days since last logon
$DaysInactive = 90
$InactiveDate = (Get-Date).Adddays(-($DaysInactive))
#-------------------------------
# FIND INACTIVE COMPUTERS
#-------------------------------
# Below are three options to find inactive computers. Select the one that is most appropriate for your requirements:
# Get AD Computers that haven't logged on in xx days
$Computers = Get-ADComputer -Filter { LastLogonDate -lt $InactiveDate -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Get AD Computers that have never logged on
$Computers = Get-ADComputer -Filter { LastLogonDate -notlike "*" -and Enabled -eq $true } -Properties LastLogonDate | Select-Object Name, LastLogonDate, DistinguishedName
# Automated way (includes never logged on computers)
$Computers = Search-ADAccount -AccountInactive -DateTime $InactiveDate -ComputersOnly | Select-Object Name, LastLogonDate, Enabled, DistinguishedName
#-------------------------------
# REPORTING
#-------------------------------
# Export results to CSV
$Computers | Export-Csv C:\Temp\InactiveComputers.csv -NoTypeInformation
#-------------------------------
# INACTIVE COMPUTER MANAGEMENT
#-------------------------------
# Below are two options to manage the inactive computers that have been found. Either disable them, or delete them. Select the option that is most appropriate for your requirements:
# Disable Inactive Computers
ForEach ($Item in $Computers){
$DistName = $Item.DistinguishedName
Set-ADComputer -Identity $DistName -Enabled $false
Get-ADComputer -Filter { DistinguishedName -eq $DistName } | Select-Object Name, Enabled
}
# Delete Inactive Computers
ForEach ($Item in $Computers){
Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false
Write-Output "$($Item.Name) - Deleted"
}
@Caesar008

This comment has been minimized.

Copy link

@Caesar008 Caesar008 commented Oct 2, 2020

Remove-ADComputer -Identity $Item.DistinguishedName -Confirm:$false not always remove computer object if it contains other objects inside.
Using Get-ADComputer $Item.DistinguishedName | Remove-ADObject -Recursive -Confirm:$false will remove also these computer objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.