[lwears]

Hey Guys,

Just been assigned a job to do with Active Directory, I have got to clear out any out-of-date computer names that have been idle for over a month. Is there a tool integrated into AD to do this? If not how can I get this done, are there any other tools? We have got a working install of system centre if that helps.

Thanks
Liam

[jmwills]

If you go into the standard querys for AD, you will see one that does what you want for 45 day inactive users. Export the query and change the parameters so that computers are defined.

Send me a private message and we can work offline on this if you want to, since this could contain sensitive data.

[lwears]

Hello JMWILLS

Can You explain this in a bit more detail? I know where the queries are, but how do i copy the parameters across? I can only find the saved queries aswell, this only gives me the option to create new queries. BTW we are using 2003

Thanks Liam

[jmwills]

You need to export the existing query for 45 days user to a file somewhere on a local machine. Right click the XML file and edit. That will open the file in notepad.
There will be three parameters you need to change:

Name
Description
OU Name

Save the file and import it into your Saved AD queries.

The query actually looks at last logon but since you only have one DC this will suffice your needs.

[lwears]

Where is the existing query to open? I have found Hyena this looks interesting, have you used this?

[StumpedTechy]

I have to wonder why your wasting time using a bunch of other tools? Look here -

http://www.windowsnetworking.com/kba...ountsinAD.html

dsquery computer -inactive 4 -limit 0
will give you anything more than 4 weeks inactive

dsquery computer -inactive 4 -limit 0 | dsrm
will delete them

You have to ensure the workstation your using has the Server 2003 support pack on it.

BTW with a little VBS you can DSquery to get the information and then pump the information to ADSI to do something else, What I did was set a query for 6 weeks and then set it so the VBS notes the machines as being disabled on the date I ran the script in the comments and then disables the computer accounts. This way I can renable the account if its a traveling user or something.

[jmwills]

Nice tool and it works great. The saved query is there without having to do anything else. However, as with Windows, there are several way to do the same thing.

The saved queires are teh the top fo the list for all AD Objects. this also depends on the schema of your AD.

[lwears]

Thanks StumpedTechy found your post really useful, and it this very moment I am testing dsquery.