Over time, an enterprise's Active Directory, especially a large one, gets cluttered with objects that haven't been used for a long time. These can be disabled accounts, computer accounts lost from the domain, security groups that are no longer needed or used, etc.
Manually browsing through Active Directory objects and finding old, long-unused (inactive) items among them is a time-consuming job, and for an enterprise with several hundred or even thousands of users, it's simply unrealistic.
In this topic I'll show how to find all outdated records in the domain.
We'll need the dsquery utility, which comes as part of the Windows Server 2003 Support Tools package. This package ships together with Service Pack 2 for Windows Server (i.e., Windows Server 2003 SP2 already has it built in, as do Windows Server 2003 R2 and Windows Server 2008, including R2).
All commands should be entered in a CMD window (Start -> Run -> CMD). Run the utility on one of your domain controllers.
Inactive computers
dsquery computer -inactive 24 -limit 10000
This command will display a list of all computers whose accounts haven't been used for 24 weeks or more. The -inactive parameter takes a value as the number of weeks the account has been idle.
-limit 10000 overrides the number of objects output by the utility. The default is 100.
And the following output will be written to a text file, which you can view at any time:
dsquery computer -inactive 24 -limit 10000 > C:\result.txt
Inactive users
dsquery user -inactive 12 -limit 10000
This command will find all users who have been inactive for the last 12 weeks (i.e., users who haven't logged into the system during that time).
Automatically delete inactive computers or usersDelete computers whose accounts haven't been used for more than 24 weeks:
dsquery computer -inactive 24 -limit 10000 | dsrm -noprompt
Delete users whose accounts haven't been used for more than 48 weeks:
dsquery user -inactive 48 -limit 10000 | dsrm -noprompt
WARNING! Be very careful with automatic deletion - don't set too short a search period, or you may end up in a situation where a person has been away for an extended time but will return, while you assumed that since there was no activity for a couple of months, the account shouldn't exist either.
MoreAnd for more - via the command
dsquery /?
It can show much more than just outdated records
Comments