Spring cleaning: Collect AD stale accounts and move them to an OU

There are many PowerShell scripts and commands available to get stale computer accounts from an Active Directory domain. Some PowerShell scripts are bundled to move the stale accounts to an organizational unit and some PowerShell scripts provide a function to email the stale accounts report. In this article we will explain what it takes to collect stale accounts from Active Directory domains and how to move them to an organizational unit.

Which PowerShell commands can be used?

To get stale computer accounts, you can use Get-ADComputer PowerShell cmdlets. The Get-ADComputer PowerShell cmdlet is provided as part of the Active Directory PowerShell modules. Let’s take a look at some of the examples of using Get-ADComputer cmdlet.

PowerShell Get-ADComputer command examples

The Get-ADComputer PowerShell cmdlet supports specifying parameters to get stale accounts. Note that there is not a straightforward parameter that can be used to fetch stale accounts — you would be required to specify a combination of parameters such as LastLogonTimeStamp and inactive days as shown in the PowerShell script below:

$ThisDomain = “TechGenix.com”
$InactiveDaysNow = 90
$time = (Get-Date).Adddays(-($InactiveDaysNow))
$CompsInactiveCount=Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Server $ThisDomain -Properties Name,OperatingSystem,SamAccountName,DistinguishedName
$CompsInactiveCount

Executing the above PowerShell commands will give you a list of inactive computer accounts from the domain specified in the “$ThisDomain” variable. If you would like to limit your query to a particular organizational unit, you will be required to use “-SearchBase” parameter as it is reflecting in the PowerShell script below:

$ThisDomain = “TechGenix.com”
$InactiveDaysNow = 90
$time = (Get-Date).Adddays(-($InactiveDaysNow))
$CompsInactiveCount=Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Server $ThisDomain –SearchBase “OU=Test1, DC=TechGenix,DC=Com” -Properties Name,OperatingSystem,SamAccountName,DistinguishedName
$CompsInactiveCount

Note: The PowerShell commands above can only be used against a single Active Directory domain. If you would like to use for a multiple domain, you will be required to create a file that contains the Active Directory domain names and use ForEach loop to process all domains one by one. Here is the PowerShell script that checks all Active Directory domains specified in C:\Temp\ADDomains.CSV:

$DomFile = "C:\Temp\ADDomains.CSV"
ForEach ($ThisDomain in GC $DomFile)
{
$InactiveDaysNow = 90
$time = (Get-Date).Adddays(-($InactiveDaysNow))
$CompsInactiveCount=Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Server $ThisDomain -Properties Name,OperatingSystem,SamAccountName,DistinguishedName
$CompsInactiveCount
}

Moving stale accounts to an organizational unit

Moving stale accounts requires you to use the Move-ADObject PowerShell cmdlet. If you need to move a specific computer account from one organizational unit to another organizational unit, you will need the source Distinguished Name of the computer account and target Distinguished Name of the organizational unit. For example, to move a computer named Computer1 to another organizational unit in the same domain, using this PowerShell command will work:

Move-ADObject –Identity (Get-ADComputer Computer1).ObjectGUID –TargetPath “OU=TestOU, DC=TechGenix, DC=Com”

To use Move-ADObject with earlier PowerShell commands that we used to fetch the stale computer accounts, you can add Move-ADObject at the end of the PowerShell command as shown in the commands below:

$DomFile = "C:\Temp\ADDomains.CSV"
$DisabledCompsOU = “OU=DisabledComps, DC=TechGenix, DC=Com”
ForEach ($ThisDomain in GC $DomFile)
{
$InactiveDaysNow = 90
$time = (Get-Date).Adddays(-($InactiveDaysNow))
$CompsInactiveCount=Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Server $ThisDomain | Move-ADObject –TargetPath $DisabledCompsOU
$CompsInactiveCount
}

In the script, you will need to be changing the following items to make sure script is usable in your production environment:

  • Change the path of the organizational unit where the stale computer accounts will be moved to. You will be need to modify “$DisabledCompsOU” variable in above script.
  • Enter the Active Directory domain names in the C:\Temp\ADDomains.CSV so script can process all Active Directory domains in an Active Directory forest.

Ossisto 365 provides a similar tool for free which can be used to search for both stale user and computer accounts and then move to a specific organizational unit periodically.

A powerful PowerShell cmdlet

We learned that Get-ADComputer PowerShell cmdlet can be used to retrieve the stale computer accounts from Active Directory domains. We provided PowerShell commands as well as PowerShell scripts to get the information from multiple Active Directory domains. We also learned how to move stale computer accounts to a specific organizational unit using the Move-ADObject PowerShell cmdlet.

Nirmal Sharma

Nirmal Sharma is a MCSEx3, MCITP and was awarded the Microsoft MVP award in Directory Services and Windows Networking. He specializes in Microsoft Azure, Office 365, Directory Services, Failover Clusters, Hyper-V, PowerShell Scripting and System Center products. Nirmal has been involved with Microsoft Technologies since 1994. In his spare time, he likes to help others and share some of his knowledge by writing tips and articles on various sites.

Share
Published by
Nirmal Sharma

Recent Posts

Hardware RAID vs. software RAID: Pros and cons for each

RAID is a technique to virtualize independent disks into arrays for improved performance. Should you…

4 days ago

After the plague: What IT will look like in a post-COVID-19 world

COVID-19 has changed everything, but once it disappears, we will not go back to how…

4 days ago

Solved: Outlook defaults to Microsoft 365 version with Exchange server

An Exchange server with a hybrid connection to Microsoft 365 is usually pretty seamless —…

4 days ago

How chatbots are changing the way teams communicate internally

Chatots are primarily thought of as consumer-facing solutions. They bring life to customer interactions by…

4 days ago

Hakbit ransomware campaign targeting specific European countries

The newly uncovered Hakbit ransomware campaign spread via spear-phishing emails may indicate a shift in…

5 days ago

Credential stuffing: Everything you need to know to avoid being a victim

Credential stuffing is yet another weapon being used by cybercriminals. Here’s what credential stuffing is…

5 days ago