Finding Stale Computer Accounts in Active Directory with PowerShell
In small organizations, a decommissioned computer is often removed from the domain while its account is left in place. Over the years these leftover accounts accumulate and clutter the directory. To find them, start with the built-in cmdlet:
powershell
Get-ADComputer -Identity 'CL1'It returns:
text
DistinguishedName : CN=CL1,CN=Computers,DC=domain,DC=local
DNSHostName : cl1.domain.local
Enabled : True
Name : CL1
ObjectClass : computer
ObjectGUID : 91a78b7b-fae8-4f15-866d-e2d051fad1ac
SamAccountName : CL1$
SID : S-1-5-21-2105492826-702646196-2230886998-1103
UserPrincipalName :We need more properties than that, so add the -Properties parameter:
powershell
Get-ADComputer -Identity 'CL1' -Properties *text
AccountExpirationDate :
accountExpires : 9223372036854775807
AccountLockoutTime :
AccountNotDelegated : False
...
DistinguishedName : CN=CL1,CN=Computers,DC=domain,DC=local
DNSHostName : CL1.domain.local
...
KerberosEncryptionType : {RC4, AES128, AES256}
LastBadPasswordAttempt :
LastKnownParent :
lastLogoff : 0
lastLogon : 132129930895749474
LastLogonDate : 9/14/2019 11:18:09 AM
lastLogonTimestamp : 132129586898666176
...
whenCreated : 9/14/2019 11:17:29 AMThe LastLogonDate property shows when the account was last used. To get it for every computer, use the -Filter parameter. I also specify the server to query and a privileged account. I treat any computer that has not been used in the last 365 days as stale.
powershell
# Prompt for credentials
$cred = Get-Credential
# Cut-off date for the last account use
$date = (Get-Date).AddDays(-365)
Get-ADComputer `
-Server AD1 `
-Credential $cred `
-Filter * `
-Properties LastLogonDate |
Where-Object LastLogonDate -lt $date |
Select-Object Name, LastLogonDateThis works well for small and medium-sized directories. In a large directory, use the variant below, which moves the date check into -Filter so the domain controller does the filtering instead of returning every computer object. I also export the results to a CSV file so I can review the list once more before deleting anything:
powershell
# Prompt for credentials
$cred = Get-Credential
# Cut-off date for the last account use
$date = (Get-Date).AddDays(-365)
Get-ADComputer `
-Server AD1 `
-Credential $cred `
-Filter {LastLogonDate -lt $date} `
-Properties LastLogonDate |
Select-Object Name, LastLogonDate |
Export-Csv -Path 'C:\oldpc.csv' -NoTypeInformationoldpc.csv now lists every computer whose LastLogonDate is more than a year old. Next, delete these computers with Remove-ADComputer:
powershell
Import-Csv -Path 'C:\oldpc.csv' | ForEach-Object {
Remove-ADComputer -Identity $_.Name -Server AD1 -Credential $cred
}Remove-ADComputer asks you to confirm each deletion by default. Once you have reviewed the list and are sure, add -Confirm:$false to remove the accounts without prompting.
0 comments