Nov 04, 2016

Teaching a System Center Configuration Manager class a couple of weeks ago I was asked if there was a PowerShell command to find dead or stale computers in Active Directory.

Often computers are removed from a domain and rejoined after a new build with a new name, new operating system etc., and cleaning the account out of AD is missed. In general a computer resets is computer account password every 30 days, so if this has not been done for a period of time such as 90 to 120 days we can use the steps below in PowerShell to find the dead/stale computers.

1. Ensure the Active Directory module for PowerShell is installed, if not, in the PowerShell command shell run Import-Module ActiveDirectory

2. Create Variable below

3. Run the command below

This will create an output with the below information

• DistinguishedName
• DNSHostName
• Enabled
• Name
• ObjectClass
• ObjectGUID
• PasswordLastSet
• SamAccountName
• SID

Which can then be used to delete or remove the offending machines.

For more information, check out our PowerShell training courses.