question

rnangel avatar image
0 Votes"
rnangel asked LazarPetrov-0974 answered

Disable state computer objects after 30 days

We've been using the DOS command "dsquery computer -inactive 13 | dsrm -subtree -noprompt -c" to remove computers more than 90 days stale. I would like to add something to disable the accounts after 30 days. Is there a command similar to dsrm that would disable but not remove?

Second question. Is there a way to specify days rather than weeks? 13 weeks equals 91 days so that math works out well for a 90-day policy. 4 weeks is 28 days, but I prefer to use syntax that is exactly 30 days if that is possible since this will be documented in a company security policy.

I've seen some PowerShell examples but they all were calculating stale based on LastLogon which yields different results from dsquery. So if there is a PowerShell equivalent of dsquery I'm happy to use that instead. Please advise. Thanks.

windows-active-directory
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @rnangel ,

We are checking in to see if the provided information was helpful. If the reply is helpful, we would appreciate you to accept it as answer.

Please let us know if you would like further assistance. Thanks.

Best Regards,
Hannah Xiong

0 Votes 0 ·
Thameur-BOURBITA avatar image
0 Votes"
Thameur-BOURBITA answered HannahXiong-MSFT commented

Hi @rnangel

Thanks for the reply. After running this command how do I see the list of computers more than 30 days inactive? This command run by itself seems to list all computers in the AD. Then I after seeing the list I would need to be able to disable them. I could use "Set-ADComputer -Remove" to delete the computers but I would prefer to disable them first and delete them later. Do you have any suggestions?

 #The first command let you to disable all inactive computer since 30 days
  Get-ADComputer -filter (Enabled -eq '$True')  -Properties PasswordLastSet | Where {$_.Passwordlastset -ge (Get-date).AddDays(-30)} | Disable-ADAccount
    
    
 #The second command let you to delete disabled and inactive computer after 60 days 
  Get-ADComputer -filter filter (Enabled -eq '$false')  -Properties PasswordLastSet | Where {$_.Passwordlastset -ge (Get-date).AddDays(-60)} | Remove-ADobject


You can customize the command above following to your needs.



please don't forget to mark helpful reply as answer


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Is there a way for me to see a listing of the computer names and their PasswordLastSet values before I disable and remove? Thanks.

0 Votes 0 ·

Hello @rnangel

We could try the below command:

Get-ADComputer -Filter -Properties |select name,pwdLastSet

62350-11.png

To convert it to Time/Date, we could use the below command:

[datetime]::FromFileTime(132382809183912141)

62401-12.png

Best regards,
Hannah Xiong





0 Votes 0 ·
11.png (14.3 KiB)
12.png (14.9 KiB)
Thameur-BOURBITA avatar image
0 Votes"
Thameur-BOURBITA answered rnangel commented

Hi,

You can get the inactive computer list based on PasswordLastset value instead of lastlogon.

 Get-ADComputer -filter * -Properties PasswordLastSet | Where {$_.Passwordlastset -ge (Get-date).AddDays(-30)}



Please don't forget to mark helpful reply as answer


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for the reply. After running this command how do I see the list of computers more than 30 days inactive? This command run by itself seems to list all computers in the AD. Then I after seeing the list I would need to be able to disable them. I could use "Set-ADComputer -Remove" to delete the computers but I would prefer to disable them first and delete them later. Do you have any suggestions?

0 Votes 0 ·
HannahXiong-MSFT avatar image
0 Votes"
HannahXiong-MSFT answered

Hello,

Thank you so much for posting here.

Hope something here might be helpful.
https://gallery.technet.microsoft.com/scriptcenter/Move-and-disable-inactive-b1cf86c3#content


Best regards,
Hannah Xiong

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LazarPetrov-0974 avatar image
0 Votes"
LazarPetrov-0974 answered

What recommendations do you guys use for deciding when a object should be removed/disabled etc. ?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.