PowerShell: Active Directory – Find and Disable Stale Computers

.\Find-StaleComputerAccounts.ps1

.\Find-StaleComputerAccounts.ps1 -DaysInactive 60 -SearchBase "OU=Workstations,DC=corp,DC=example,DC=com" -ReportPath "C:\Reports\stale-computers.csv"

.\Find-StaleComputerAccounts.ps1 -Disable -TargetOU "OU=Disabled Computers,DC=corp,DC=example,DC=com" -WhatIf

.\Find-StaleComputerAccounts.ps1 -Disable -TargetOU "OU=Disabled Computers,DC=corp,DC=example,DC=com" -ReportPath "C:\Reports\stale-disabled.csv"

Cutoff: 2025-04-01 (90 days). Searching DC=corp,DC=example,DC=com ...
4 stale computer account(s) found.

Name        LastLogonDate        PasswordLastSet      DaysInactive OperatingSystem                 OU
----        -------------        ---------------      ------------ ---------------                 --
KIOSK-LOBBY                      2023-11-02 09:14:55           606 Windows 10 Enterprise           OU=Kiosks,DC=corp,DC=example,DC=com
FIN-DESK11  2024-12-19 15:03:02  2024-12-05 10:41:17           193 Windows 11 Enterprise           OU=Finance,DC=corp,DC=example,DC=com
OLD-LAP03   2025-01-04 08:12:41  2024-12-22 16:20:09           177 Windows 11 Enterprise           OU=Workstations,DC=corp,DC=example,DC=com
LAB-SQL02   2025-02-11 22:05:37  2025-01-30 03:11:48           139 Windows Server 2019 Datacenter  OU=Lab,DC=corp,DC=example,DC=com

Get-ADComputer -Identity "OLD-LAP03" -Properties Description | Select-Object -Property Name, Description
Enable-ADAccount -Identity "OLD-LAP03"
Move-ADObject -Identity (Get-ADComputer -Identity "OLD-LAP03").DistinguishedName -TargetPath "OU=Workstations,DC=corp,DC=example,DC=com"

<#
.SYNOPSIS
    Finds Active Directory computer accounts that have not authenticated recently, and
    optionally disables and relocates them.
.DESCRIPTION
    Queries enabled computer objects under a search base with an LDAP filter on
    lastLogonTimestamp, then keeps only accounts whose lastLogonTimestamp AND pwdLastSet
    are both older than the threshold (accounts created inside the window are skipped).
    Reports every match. With -Disable, each match is disabled and the original OU and date
    are added to the front of its description (existing description text is kept); with
    -TargetOU as well, it is moved to a quarantine OU so it is easy to find, restore or,
    later, delete.
.PARAMETER DaysInactive
    Days since both the last logon timestamp and the last machine password change before
    an account counts as stale.
.PARAMETER SearchBase
    Distinguished name to search under. Defaults to the domain root.
.PARAMETER Disable
    Disables each stale account and adds the original OU and date to the front of its
    description, keeping any existing description text.
.PARAMETER TargetOU
    Distinguished name of an OU to move disabled accounts into. Only used with -Disable.
.PARAMETER ReportPath
    Path to a CSV file the results are written to, in addition to the console.
.EXAMPLE
    .\Find-StaleComputerAccounts.ps1 -DaysInactive 60 -Disable -TargetOU "OU=Disabled Computers,DC=corp,DC=example,DC=com" -WhatIf
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-06-30)
    Requires: ActiveDirectory module (RSAT-AD-PowerShell), Windows Server 2003 domain functional level or higher
#>
[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [ValidateRange(1, 3650)]
    [int]$DaysInactive = 90,

    [string]$SearchBase,

    [switch]$Disable,

    [string]$TargetOU,

    [string]$ReportPath
)

Import-Module ActiveDirectory -ErrorAction Stop

if ($TargetOU -and -not $Disable) {
    Write-Warning "-TargetOU was supplied without -Disable; accounts will be reported only, not moved."
}

if (-not $SearchBase) {
    $SearchBase = (Get-ADDomain).DistinguishedName
}

$now = Get-Date
$cutoffDate = $now.AddDays(-$DaysInactive)
$cutoffFileTime = $cutoffDate.ToFileTime()

# Enabled computers whose lastLogonTimestamp is older than the cutoff or was never set.
# The userAccountControl bit 2 (ACCOUNTDISABLE) test excludes accounts already disabled.
$ldapFilter = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(lastLogonTimestamp<=$cutoffFileTime)(!(lastLogonTimestamp=*))))"

Write-Host "Cutoff: $($cutoffDate.ToString('yyyy-MM-dd')) ($DaysInactive days). Searching $SearchBase ..."

$candidates = Get-ADComputer -LDAPFilter $ldapFilter -SearchBase $SearchBase -Properties LastLogonDate, PasswordLastSet, WhenCreated, OperatingSystem, Description

$staleComputers = foreach ($computer in $candidates) {
    # Skip accounts created inside the window: a new, never-used account is not stale yet.
    if ($computer.WhenCreated -gt $cutoffDate) {
        continue
    }

    # Require the machine password to be old too; a live domain member rotates it every 30 days by default.
    if ($computer.PasswordLastSet -and $computer.PasswordLastSet -gt $cutoffDate) {
        continue
    }

    $newestSignal = @($computer.LastLogonDate, $computer.PasswordLastSet, $computer.WhenCreated) |
        Where-Object { $_ } |
        Sort-Object -Descending |
        Select-Object -First 1

    [PSCustomObject]@{
        Name              = $computer.Name
        LastLogonDate     = $computer.LastLogonDate
        PasswordLastSet   = $computer.PasswordLastSet
        DaysInactive      = [math]::Floor(($now - $newestSignal).TotalDays)
        OperatingSystem   = $computer.OperatingSystem
        OU                = ($computer.DistinguishedName -split '(?<!\\),', 2)[1]
        Description       = $computer.Description
        DistinguishedName = $computer.DistinguishedName
    }
}

$staleComputers = @($staleComputers | Sort-Object -Property DaysInactive -Descending)

if ($staleComputers.Count -eq 0) {
    Write-Host "No stale computer accounts found."
    return
}

Write-Host "$($staleComputers.Count) stale computer account(s) found."
$staleComputers | Format-Table -Property Name, LastLogonDate, PasswordLastSet, DaysInactive, OperatingSystem, OU -AutoSize

if ($ReportPath) {
    $staleComputers | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8
    Write-Host "Report written to $ReportPath"
}

if ($Disable) {
    $stamp = $now.ToString('yyyy-MM-dd')

    foreach ($computer in $staleComputers) {
        if ($PSCmdlet.ShouldProcess($computer.Name, "Disable computer account (inactive $($computer.DaysInactive) days)")) {
            try {
                # Keep the existing description (owner, asset tag) after the sweep note; AD caps description at 1024 characters.
                $description = "Stale sweep $stamp; was in $($computer.OU)"
                if ($computer.Description) {
                    $description = "$description | $($computer.Description)"
                }
                if ($description.Length -gt 1024) {
                    Write-Warning "Description of $($computer.Name) truncated to 1024 characters. Original: $($computer.Description)"
                    $description = $description.Substring(0, 1024)
                }

                Disable-ADAccount -Identity $computer.DistinguishedName -ErrorAction Stop
                Set-ADComputer -Identity $computer.DistinguishedName -Description $description -ErrorAction Stop

                if ($TargetOU) {
                    Move-ADObject -Identity $computer.DistinguishedName -TargetPath $TargetOU -ErrorAction Stop
                }

                Write-Host "Disabled $($computer.Name)"
            } catch {
                Write-Warning "Failed on $($computer.Name): $($_.Exception.Message)"
            }
        }
    }
}