Old Computer Accounts in Active Directory
I needed to find out which computer accounts where stale in a Active Directory Environment. I
first tried to use Powergui to get the information that I required by exporting all the computer
objects to a csv. When I opened the csv that
I exported I could not find the attribute that
I was looking for. After a bit of searching I found the
following script in Power Shell that worked
100%.
$old = (Get-Date).AddDays(-90)
The above is to create a variable that points to objects older than 90 days from the current date.
After running that then I ran the below script to get the information that I required. Bear in mind
that you require the Active Roles Management Shell for Active Directory from Quest.
Get-QADComputer -IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le $old } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\temp\outdated.csv
More here:
http://dmitrysotnikov.wordpress.com/2007/09/07/locate-obsolete-computer-records-in-ad/