Great AD Management Tools

Solar Winds have some excellent free (you need to register though) tools to help get the mundane stuff done in AD.

• List old User Accounts
• List old Computer Accounts
• Bulk import User Accounts

This link came from my petri.co.il subscription, so you can see their details in it. I'm not sure how long Solar Winds will offer this either.

http://www.solarwinds.com/register/registrationb.aspx?program=1800&c=70150000000PH8s&CMP=BIZ-EML-PETRI-130214_Top5MicrosoftFT_Petri-MSFT-DL&email=%%EMAIL%%

Find Old Computers in AD

For Windows 2003/2008
(Must be 2003 Native domain or newer)
In a Command Prompt window type:

dsquery computer -inactive <num>

Where <num> is the minimum number of weeks the device has been inactive for. Advice seems to be to use at least 2, as anything less than that is not fully reliable.

For Windows 2008 R2+
In a PowerShell  window type:

$time=Read-host "Enter a date in format mm/dd/yyyy"

then

Get-ADComputer -Filter * | Get-ADObject -Properties lastlogontimestamp | where {(([DateTime]::FromFileTime($_.lastlogontimestamp) - ([system.datetime]$time)).totaldays) -lt 0 } | select name

You can change what you include in the select command at the end to get more or different info.

If you want to then remove all resulting computer accounts use the following command:

Remove-ADObject -recursive

in place of the select name

That is, to remove all computers older than $time use the following command:

Get-ADComputer -Filter * | Get-ADObject -Properties lastlogontimestamp | where {(([DateTime]::FromFileTime($_.lastlogontimestamp) - ([system.datetime]$time)).totaldays) -lt 0 } | Remove-ADObject -recursive

For more detail or a better example (of which this is basically a cut and paste at the moment), see reference site below.

References:
http://blog.mattvogt.net/powershell-last-logon-timestamp-for-single-ho