[{"data":1,"prerenderedAt":2234},["ShallowReactive",2],{"post:\u002F2025\u002F06\u002F30\u002Fpowershell-active-directory-find-and-disable-stale-computer-accounts\u002F":3},{"post":4,"newer":2184,"older":2196,"related":2205,"series":2232},{"id":5,"title":6,"body":7,"canonical":2165,"categories":2166,"date":2169,"description":2170,"extension":2171,"featured":2172,"hero":2173,"image":2173,"meta":2174,"navigation":736,"path":2175,"readingTime":464,"seo":2176,"series":2173,"seriesOrder":2173,"sites":2177,"source":2173,"stem":2178,"tags":2179,"updated":2173,"url":2182,"__hash__":2183},"blog\u002Fblog\u002F2025\u002F06\u002F30\u002Fpowershell-active-directory-find-and-disable-stale-computer-accounts.md","PowerShell: Active Directory – Find and Disable Stale Computers",{"type":8,"value":9,"toc":2157},"minimark",[10,23,37,42,81,85,190,204,208,211,232,235,274,277,307,310,338,341,349,352,435,439,1998,2002,2097,2101,2153],[11,12,13,14,18,19,22],"p",{},"Every Active Directory I've ever inherited has the same problem: a computers container full of machines that were retired, re-imaged under a different name, or shipped back to a leasing company years ago, and nobody ever cleaned up the account. Stale computer accounts aren't just clutter. They inflate counts in every tool that keys off AD, they show up as false positives in vulnerability and patch-compliance reports, and each one is still an enabled security principal in the domain. This script finds enabled computers that have stopped authenticating, using two independent signals (",[15,16,17],"code",{},"lastLogonTimestamp"," and the machine password age in ",[15,20,21],{},"pwdLastSet","), reports on them, and, only when you ask it to, disables them, stamps the original location into the description, and moves them to a quarantine OU instead of deleting them.",[11,24,25,26,30,31,33,34,36],{},"Why two signals: a domain-joined Windows machine changes its own account password every 30 days by default (the ",[27,28,29],"strong",{},"Domain member: Maximum machine account password age"," policy). A computer whose ",[15,32,21],{}," is months old and whose ",[15,35,17],{}," is equally old has almost certainly not been on the network in that time. Requiring both keeps a machine with one odd attribute from being swept up.",[38,39,41],"h2",{"id":40},"requirements","Requirements",[43,44,45,57,63,78],"ul",{},[46,47,48,49,52,53,56],"li",{},"Windows PowerShell 5.1 or PowerShell 7 on Windows, with the ActiveDirectory module (RSAT). On a server: ",[15,50,51],{},"Install-WindowsFeature RSAT-AD-PowerShell",". On Windows 10\u002F11: ",[15,54,55],{},"Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0",".",[46,58,59,60,62],{},"Domain functional level Windows Server 2003 or higher, which is what makes ",[15,61,17],{}," update and replicate.",[46,64,65,66,69,70,73,74,77],{},"Read access to computer objects under the search base. For ",[15,67,68],{},"-Disable",": rights to disable accounts and write ",[15,71,72],{},"description"," in the source OUs. For ",[15,75,76],{},"-TargetOU",": rights to move objects out of the source OUs (delete child) and create computer objects in the target OU.",[46,79,80],{},"The quarantine OU must already exist.",[38,82,84],{"id":83},"parameters","Parameters",[86,87,88,107],"table",{},[89,90,91],"thead",{},[92,93,94,98,101,104],"tr",{},[95,96,97],"th",{},"Name",[95,99,100],{},"Type",[95,102,103],{},"Required",[95,105,106],{},"Description",[108,109,110,130,145,160,176],"tbody",{},[92,111,112,118,121,124],{},[113,114,115],"td",{},[15,116,117],{},"DaysInactive",[113,119,120],{},"Int",[113,122,123],{},"No",[113,125,126,127,56],{},"Days since both the last logon timestamp and the last machine password change before an account counts as stale. Defaults to ",[15,128,129],{},"90",[92,131,132,137,140,142],{},[113,133,134],{},[15,135,136],{},"SearchBase",[113,138,139],{},"String",[113,141,123],{},[113,143,144],{},"Distinguished name to search under. Defaults to the domain root.",[92,146,147,152,155,157],{},[113,148,149],{},[15,150,151],{},"Disable",[113,153,154],{},"Switch",[113,156,123],{},[113,158,159],{},"Disables each stale account and adds the original OU and date to the front of its description, keeping any existing description text. Without it the script only reports.",[92,161,162,167,169,171],{},[113,163,164],{},[15,165,166],{},"TargetOU",[113,168,139],{},[113,170,123],{},[113,172,173,174,56],{},"Distinguished name of an OU to move disabled accounts into. Only used with ",[15,175,68],{},[92,177,178,183,185,187],{},[113,179,180],{},[15,181,182],{},"ReportPath",[113,184,139],{},[113,186,123],{},[113,188,189],{},"Path to a CSV file the results are written to, in addition to the console.",[11,191,192,193,196,197,200,201,56],{},"The script also honours the common ",[15,194,195],{},"-WhatIf"," and ",[15,198,199],{},"-Confirm"," switches, because it declares ",[15,202,203],{},"SupportsShouldProcess",[38,205,207],{"id":206},"usage","Usage",[11,209,210],{},"Report only, no changes, 90-day threshold, whole domain:",[212,213,218],"pre",{"className":214,"code":215,"language":216,"meta":217,"style":217},"language-powershell shiki shiki-themes github-dark",".\\Find-StaleComputerAccounts.ps1\n","powershell","",[15,219,220],{"__ignoreMap":217},[221,222,225,228],"span",{"class":223,"line":224},"line",1,[221,226,56],{"class":227},"s95oV",[221,229,231],{"class":230},"sDLfK","\\Find-StaleComputerAccounts.ps1\n",[11,233,234],{},"Report on one OU with a tighter 60-day window and save the results for review:",[212,236,238],{"className":214,"code":237,"language":216,"meta":217,"style":217},".\\Find-StaleComputerAccounts.ps1 -DaysInactive 60 -SearchBase \"OU=Workstations,DC=corp,DC=example,DC=com\" -ReportPath \"C:\\Reports\\stale-computers.csv\"\n",[15,239,240],{"__ignoreMap":217},[221,241,242,244,247,251,254,257,259,262,266,268,271],{"class":223,"line":224},[221,243,56],{"class":227},[221,245,246],{"class":230},"\\Find-StaleComputerAccounts.ps1",[221,248,250],{"class":249},"snl16"," -",[221,252,253],{"class":227},"DaysInactive ",[221,255,256],{"class":230},"60",[221,258,250],{"class":249},[221,260,261],{"class":227},"SearchBase ",[221,263,265],{"class":264},"sU2Wk","\"OU=Workstations,DC=corp,DC=example,DC=com\"",[221,267,250],{"class":249},[221,269,270],{"class":227},"ReportPath ",[221,272,273],{"class":264},"\"C:\\Reports\\stale-computers.csv\"\n",[11,275,276],{},"Preview exactly what a disable run would touch, without changing anything:",[212,278,280],{"className":214,"code":279,"language":216,"meta":217,"style":217},".\\Find-StaleComputerAccounts.ps1 -Disable -TargetOU \"OU=Disabled Computers,DC=corp,DC=example,DC=com\" -WhatIf\n",[15,281,282],{"__ignoreMap":217},[221,283,284,286,288,290,293,296,299,302,304],{"class":223,"line":224},[221,285,56],{"class":227},[221,287,246],{"class":230},[221,289,250],{"class":249},[221,291,292],{"class":227},"Disable ",[221,294,295],{"class":249},"-",[221,297,298],{"class":227},"TargetOU ",[221,300,301],{"class":264},"\"OU=Disabled Computers,DC=corp,DC=example,DC=com\"",[221,303,250],{"class":249},[221,305,306],{"class":227},"WhatIf\n",[11,308,309],{},"Disable and quarantine:",[212,311,313],{"className":214,"code":312,"language":216,"meta":217,"style":217},".\\Find-StaleComputerAccounts.ps1 -Disable -TargetOU \"OU=Disabled Computers,DC=corp,DC=example,DC=com\" -ReportPath \"C:\\Reports\\stale-disabled.csv\"\n",[15,314,315],{"__ignoreMap":217},[221,316,317,319,321,323,325,327,329,331,333,335],{"class":223,"line":224},[221,318,56],{"class":227},[221,320,246],{"class":230},[221,322,250],{"class":249},[221,324,292],{"class":227},[221,326,295],{"class":249},[221,328,298],{"class":227},[221,330,301],{"class":264},[221,332,250],{"class":249},[221,334,270],{"class":227},[221,336,337],{"class":264},"\"C:\\Reports\\stale-disabled.csv\"\n",[11,339,340],{},"Sample console output from a report-only run:",[212,342,347],{"className":343,"code":345,"language":346,"meta":217},[344],"language-text","Cutoff: 2025-04-01 (90 days). Searching DC=corp,DC=example,DC=com ...\n4 stale computer account(s) found.\n\nName        LastLogonDate        PasswordLastSet      DaysInactive OperatingSystem                 OU\n----        -------------        ---------------      ------------ ---------------                 --\nKIOSK-LOBBY                      2023-11-02 09:14:55           606 Windows 10 Enterprise           OU=Kiosks,DC=corp,DC=example,DC=com\nFIN-DESK11  2024-12-19 15:03:02  2024-12-05 10:41:17           193 Windows 11 Enterprise           OU=Finance,DC=corp,DC=example,DC=com\nOLD-LAP03   2025-01-04 08:12:41  2024-12-22 16:20:09           177 Windows 11 Enterprise           OU=Workstations,DC=corp,DC=example,DC=com\nLAB-SQL02   2025-02-11 22:05:37  2025-01-30 03:11:48           139 Windows Server 2019 Datacenter  OU=Lab,DC=corp,DC=example,DC=com\n","text",[15,348,345],{"__ignoreMap":217},[11,350,351],{},"To roll one back later, the description tells you where it came from:",[212,353,355],{"className":214,"code":354,"language":216,"meta":217,"style":217},"Get-ADComputer -Identity \"OLD-LAP03\" -Properties Description | Select-Object -Property Name, Description\nEnable-ADAccount -Identity \"OLD-LAP03\"\nMove-ADObject -Identity (Get-ADComputer -Identity \"OLD-LAP03\").DistinguishedName -TargetPath \"OU=Workstations,DC=corp,DC=example,DC=com\"\n",[15,356,357,392,405],{"__ignoreMap":217},[221,358,359,362,364,367,370,372,375,378,381,383,386,389],{"class":223,"line":224},[221,360,361],{"class":230},"Get-ADComputer",[221,363,250],{"class":249},[221,365,366],{"class":227},"Identity ",[221,368,369],{"class":264},"\"OLD-LAP03\"",[221,371,250],{"class":249},[221,373,374],{"class":227},"Properties Description ",[221,376,377],{"class":249},"|",[221,379,380],{"class":230}," Select-Object",[221,382,250],{"class":249},[221,384,385],{"class":227},"Property Name",[221,387,388],{"class":249},",",[221,390,391],{"class":227}," Description\n",[221,393,395,398,400,402],{"class":223,"line":394},2,[221,396,397],{"class":230},"Enable-ADAccount",[221,399,250],{"class":249},[221,401,366],{"class":227},[221,403,404],{"class":264},"\"OLD-LAP03\"\n",[221,406,408,411,413,416,418,420,422,424,427,429,432],{"class":223,"line":407},3,[221,409,410],{"class":230},"Move-ADObject",[221,412,250],{"class":249},[221,414,415],{"class":227},"Identity (",[221,417,361],{"class":230},[221,419,250],{"class":249},[221,421,366],{"class":227},[221,423,369],{"class":264},[221,425,426],{"class":227},").DistinguishedName ",[221,428,295],{"class":249},[221,430,431],{"class":227},"TargetPath ",[221,433,434],{"class":264},"\"OU=Workstations,DC=corp,DC=example,DC=com\"\n",[38,436,438],{"id":437},"script","Script",[212,440,442],{"className":214,"code":441,"language":216,"meta":217,"style":217},"\u003C#\n.SYNOPSIS\n    Finds Active Directory computer accounts that have not authenticated recently, and\n    optionally disables and relocates them.\n.DESCRIPTION\n    Queries enabled computer objects under a search base with an LDAP filter on\n    lastLogonTimestamp, then keeps only accounts whose lastLogonTimestamp AND pwdLastSet\n    are both older than the threshold (accounts created inside the window are skipped).\n    Reports every match. With -Disable, each match is disabled and the original OU and date\n    are added to the front of its description (existing description text is kept); with\n    -TargetOU as well, it is moved to a quarantine OU so it is easy to find, restore or,\n    later, delete.\n.PARAMETER DaysInactive\n    Days since both the last logon timestamp and the last machine password change before\n    an account counts as stale.\n.PARAMETER SearchBase\n    Distinguished name to search under. Defaults to the domain root.\n.PARAMETER Disable\n    Disables each stale account and adds the original OU and date to the front of its\n    description, keeping any existing description text.\n.PARAMETER TargetOU\n    Distinguished name of an OU to move disabled accounts into. Only used with -Disable.\n.PARAMETER ReportPath\n    Path to a CSV file the results are written to, in addition to the console.\n.EXAMPLE\n    .\\Find-StaleComputerAccounts.ps1 -DaysInactive 60 -Disable -TargetOU \"OU=Disabled Computers,DC=corp,DC=example,DC=com\" -WhatIf\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2025-06-30)\n    Requires: ActiveDirectory module (RSAT-AD-PowerShell), Windows Server 2003 domain functional level or higher\n#>\n[CmdletBinding(SupportsShouldProcess = $true)]\nparam(\n    [ValidateRange(1, 3650)]\n    [int]$DaysInactive = 90,\n\n    [string]$SearchBase,\n\n    [switch]$Disable,\n\n    [string]$TargetOU,\n\n    [string]$ReportPath\n)\n\nImport-Module ActiveDirectory -ErrorAction Stop\n\nif ($TargetOU -and -not $Disable) {\n    Write-Warning \"-TargetOU was supplied without -Disable; accounts will be reported only, not moved.\"\n}\n\nif (-not $SearchBase) {\n    $SearchBase = (Get-ADDomain).DistinguishedName\n}\n\n$now = Get-Date\n$cutoffDate = $now.AddDays(-$DaysInactive)\n$cutoffFileTime = $cutoffDate.ToFileTime()\n\n# Enabled computers whose lastLogonTimestamp is older than the cutoff or was never set.\n# The userAccountControl bit 2 (ACCOUNTDISABLE) test excludes accounts already disabled.\n$ldapFilter = \"(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(lastLogonTimestamp\u003C=$cutoffFileTime)(!(lastLogonTimestamp=*))))\"\n\nWrite-Host \"Cutoff: $($cutoffDate.ToString('yyyy-MM-dd')) ($DaysInactive days). Searching $SearchBase ...\"\n\n$candidates = Get-ADComputer -LDAPFilter $ldapFilter -SearchBase $SearchBase -Properties LastLogonDate, PasswordLastSet, WhenCreated, OperatingSystem, Description\n\n$staleComputers = foreach ($computer in $candidates) {\n    # Skip accounts created inside the window: a new, never-used account is not stale yet.\n    if ($computer.WhenCreated -gt $cutoffDate) {\n        continue\n    }\n\n    # Require the machine password to be old too; a live domain member rotates it every 30 days by default.\n    if ($computer.PasswordLastSet -and $computer.PasswordLastSet -gt $cutoffDate) {\n        continue\n    }\n\n    $newestSignal = @($computer.LastLogonDate, $computer.PasswordLastSet, $computer.WhenCreated) |\n        Where-Object { $_ } |\n        Sort-Object -Descending |\n        Select-Object -First 1\n\n    [PSCustomObject]@{\n        Name              = $computer.Name\n        LastLogonDate     = $computer.LastLogonDate\n        PasswordLastSet   = $computer.PasswordLastSet\n        DaysInactive      = [math]::Floor(($now - $newestSignal).TotalDays)\n        OperatingSystem   = $computer.OperatingSystem\n        OU                = ($computer.DistinguishedName -split '(?\u003C!\\\\),', 2)[1]\n        Description       = $computer.Description\n        DistinguishedName = $computer.DistinguishedName\n    }\n}\n\n$staleComputers = @($staleComputers | Sort-Object -Property DaysInactive -Descending)\n\nif ($staleComputers.Count -eq 0) {\n    Write-Host \"No stale computer accounts found.\"\n    return\n}\n\nWrite-Host \"$($staleComputers.Count) stale computer account(s) found.\"\n$staleComputers | Format-Table -Property Name, LastLogonDate, PasswordLastSet, DaysInactive, OperatingSystem, OU -AutoSize\n\nif ($ReportPath) {\n    $staleComputers | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8\n    Write-Host \"Report written to $ReportPath\"\n}\n\nif ($Disable) {\n    $stamp = $now.ToString('yyyy-MM-dd')\n\n    foreach ($computer in $staleComputers) {\n        if ($PSCmdlet.ShouldProcess($computer.Name, \"Disable computer account (inactive $($computer.DaysInactive) days)\")) {\n            try {\n                # Keep the existing description (owner, asset tag) after the sweep note; AD caps description at 1024 characters.\n                $description = \"Stale sweep $stamp; was in $($computer.OU)\"\n                if ($computer.Description) {\n                    $description = \"$description | $($computer.Description)\"\n                }\n                if ($description.Length -gt 1024) {\n                    Write-Warning \"Description of $($computer.Name) truncated to 1024 characters. Original: $($computer.Description)\"\n                    $description = $description.Substring(0, 1024)\n                }\n\n                Disable-ADAccount -Identity $computer.DistinguishedName -ErrorAction Stop\n                Set-ADComputer -Identity $computer.DistinguishedName -Description $description -ErrorAction Stop\n\n                if ($TargetOU) {\n                    Move-ADObject -Identity $computer.DistinguishedName -TargetPath $TargetOU -ErrorAction Stop\n                }\n\n                Write-Host \"Disabled $($computer.Name)\"\n            } catch {\n                Write-Warning \"Failed on $($computer.Name): $($_.Exception.Message)\"\n            }\n        }\n    }\n}\n",[15,443,444,450,457,462,468,476,482,488,494,500,506,512,518,529,535,541,551,557,567,573,579,589,595,605,611,619,625,633,639,645,651,657,681,690,711,731,738,751,756,769,774,786,791,801,807,812,826,831,849,858,864,869,883,899,904,909,920,936,947,952,958,964,981,986,1025,1030,1075,1080,1100,1106,1121,1127,1133,1138,1144,1161,1166,1171,1176,1203,1220,1233,1247,1252,1269,1280,1291,1302,1324,1335,1365,1376,1387,1392,1397,1402,1429,1434,1451,1460,1466,1471,1476,1497,1539,1544,1552,1578,1592,1597,1602,1610,1625,1630,1643,1677,1686,1692,1720,1729,1756,1762,1777,1808,1827,1832,1837,1852,1871,1876,1884,1903,1908,1913,1932,1943,1976,1982,1988,1993],{"__ignoreMap":217},[221,445,446],{"class":223,"line":224},[221,447,449],{"class":448},"sAwPA","\u003C#\n",[221,451,452,454],{"class":223,"line":394},[221,453,56],{"class":230},[221,455,456],{"class":249},"SYNOPSIS\n",[221,458,459],{"class":223,"line":407},[221,460,461],{"class":448},"    Finds Active Directory computer accounts that have not authenticated recently, and\n",[221,463,465],{"class":223,"line":464},4,[221,466,467],{"class":448},"    optionally disables and relocates them.\n",[221,469,471,473],{"class":223,"line":470},5,[221,472,56],{"class":230},[221,474,475],{"class":249},"DESCRIPTION\n",[221,477,479],{"class":223,"line":478},6,[221,480,481],{"class":448},"    Queries enabled computer objects under a search base with an LDAP filter on\n",[221,483,485],{"class":223,"line":484},7,[221,486,487],{"class":448},"    lastLogonTimestamp, then keeps only accounts whose lastLogonTimestamp AND pwdLastSet\n",[221,489,491],{"class":223,"line":490},8,[221,492,493],{"class":448},"    are both older than the threshold (accounts created inside the window are skipped).\n",[221,495,497],{"class":223,"line":496},9,[221,498,499],{"class":448},"    Reports every match. With -Disable, each match is disabled and the original OU and date\n",[221,501,503],{"class":223,"line":502},10,[221,504,505],{"class":448},"    are added to the front of its description (existing description text is kept); with\n",[221,507,509],{"class":223,"line":508},11,[221,510,511],{"class":448},"    -TargetOU as well, it is moved to a quarantine OU so it is easy to find, restore or,\n",[221,513,515],{"class":223,"line":514},12,[221,516,517],{"class":448},"    later, delete.\n",[221,519,521,523,526],{"class":223,"line":520},13,[221,522,56],{"class":230},[221,524,525],{"class":249},"PARAMETER",[221,527,528],{"class":249}," DaysInactive\n",[221,530,532],{"class":223,"line":531},14,[221,533,534],{"class":448},"    Days since both the last logon timestamp and the last machine password change before\n",[221,536,538],{"class":223,"line":537},15,[221,539,540],{"class":448},"    an account counts as stale.\n",[221,542,544,546,548],{"class":223,"line":543},16,[221,545,56],{"class":230},[221,547,525],{"class":249},[221,549,550],{"class":249}," SearchBase\n",[221,552,554],{"class":223,"line":553},17,[221,555,556],{"class":448},"    Distinguished name to search under. Defaults to the domain root.\n",[221,558,560,562,564],{"class":223,"line":559},18,[221,561,56],{"class":230},[221,563,525],{"class":249},[221,565,566],{"class":249}," Disable\n",[221,568,570],{"class":223,"line":569},19,[221,571,572],{"class":448},"    Disables each stale account and adds the original OU and date to the front of its\n",[221,574,576],{"class":223,"line":575},20,[221,577,578],{"class":448},"    description, keeping any existing description text.\n",[221,580,582,584,586],{"class":223,"line":581},21,[221,583,56],{"class":230},[221,585,525],{"class":249},[221,587,588],{"class":249}," TargetOU\n",[221,590,592],{"class":223,"line":591},22,[221,593,594],{"class":448},"    Distinguished name of an OU to move disabled accounts into. Only used with -Disable.\n",[221,596,598,600,602],{"class":223,"line":597},23,[221,599,56],{"class":230},[221,601,525],{"class":249},[221,603,604],{"class":249}," ReportPath\n",[221,606,608],{"class":223,"line":607},24,[221,609,610],{"class":448},"    Path to a CSV file the results are written to, in addition to the console.\n",[221,612,614,616],{"class":223,"line":613},25,[221,615,56],{"class":230},[221,617,618],{"class":249},"EXAMPLE\n",[221,620,622],{"class":223,"line":621},26,[221,623,624],{"class":448},"    .\\Find-StaleComputerAccounts.ps1 -DaysInactive 60 -Disable -TargetOU \"OU=Disabled Computers,DC=corp,DC=example,DC=com\" -WhatIf\n",[221,626,628,630],{"class":223,"line":627},27,[221,629,56],{"class":230},[221,631,632],{"class":249},"NOTES\n",[221,634,636],{"class":223,"line":635},28,[221,637,638],{"class":448},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[221,640,642],{"class":223,"line":641},29,[221,643,644],{"class":448},"    Version : 1.0 (2025-06-30)\n",[221,646,648],{"class":223,"line":647},30,[221,649,650],{"class":448},"    Requires: ActiveDirectory module (RSAT-AD-PowerShell), Windows Server 2003 domain functional level or higher\n",[221,652,654],{"class":223,"line":653},31,[221,655,656],{"class":448},"#>\n",[221,658,660,663,666,669,672,675,678],{"class":223,"line":659},32,[221,661,662],{"class":227},"[",[221,664,665],{"class":230},"CmdletBinding",[221,667,668],{"class":227},"(",[221,670,203],{"class":671},"s9osk",[221,673,674],{"class":249}," =",[221,676,677],{"class":230}," $true",[221,679,680],{"class":227},")]\n",[221,682,684,687],{"class":223,"line":683},33,[221,685,686],{"class":249},"param",[221,688,689],{"class":227},"(\n",[221,691,693,696,699,701,704,706,709],{"class":223,"line":692},34,[221,694,695],{"class":227},"    [",[221,697,698],{"class":230},"ValidateRange",[221,700,668],{"class":227},[221,702,703],{"class":230},"1",[221,705,388],{"class":249},[221,707,708],{"class":230}," 3650",[221,710,680],{"class":227},[221,712,714,716,719,722,725,728],{"class":223,"line":713},35,[221,715,695],{"class":227},[221,717,718],{"class":249},"int",[221,720,721],{"class":227},"]$DaysInactive ",[221,723,724],{"class":249},"=",[221,726,727],{"class":230}," 90",[221,729,730],{"class":249},",\n",[221,732,734],{"class":223,"line":733},36,[221,735,737],{"emptyLinePlaceholder":736},true,"\n",[221,739,741,743,746,749],{"class":223,"line":740},37,[221,742,695],{"class":227},[221,744,745],{"class":249},"string",[221,747,748],{"class":227},"]$SearchBase",[221,750,730],{"class":249},[221,752,754],{"class":223,"line":753},38,[221,755,737],{"emptyLinePlaceholder":736},[221,757,759,761,764,767],{"class":223,"line":758},39,[221,760,695],{"class":227},[221,762,763],{"class":249},"switch",[221,765,766],{"class":227},"]$Disable",[221,768,730],{"class":249},[221,770,772],{"class":223,"line":771},40,[221,773,737],{"emptyLinePlaceholder":736},[221,775,777,779,781,784],{"class":223,"line":776},41,[221,778,695],{"class":227},[221,780,745],{"class":249},[221,782,783],{"class":227},"]$TargetOU",[221,785,730],{"class":249},[221,787,789],{"class":223,"line":788},42,[221,790,737],{"emptyLinePlaceholder":736},[221,792,794,796,798],{"class":223,"line":793},43,[221,795,695],{"class":227},[221,797,745],{"class":249},[221,799,800],{"class":227},"]$ReportPath\n",[221,802,804],{"class":223,"line":803},44,[221,805,806],{"class":227},")\n",[221,808,810],{"class":223,"line":809},45,[221,811,737],{"emptyLinePlaceholder":736},[221,813,815,818,821,823],{"class":223,"line":814},46,[221,816,817],{"class":230},"Import-Module",[221,819,820],{"class":227}," ActiveDirectory ",[221,822,295],{"class":249},[221,824,825],{"class":227},"ErrorAction Stop\n",[221,827,829],{"class":223,"line":828},47,[221,830,737],{"emptyLinePlaceholder":736},[221,832,834,837,840,843,846],{"class":223,"line":833},48,[221,835,836],{"class":249},"if",[221,838,839],{"class":227}," ($TargetOU ",[221,841,842],{"class":249},"-and",[221,844,845],{"class":249}," -not",[221,847,848],{"class":227}," $Disable) {\n",[221,850,852,855],{"class":223,"line":851},49,[221,853,854],{"class":230},"    Write-Warning",[221,856,857],{"class":264}," \"-TargetOU was supplied without -Disable; accounts will be reported only, not moved.\"\n",[221,859,861],{"class":223,"line":860},50,[221,862,863],{"class":227},"}\n",[221,865,867],{"class":223,"line":866},51,[221,868,737],{"emptyLinePlaceholder":736},[221,870,872,874,877,880],{"class":223,"line":871},52,[221,873,836],{"class":249},[221,875,876],{"class":227}," (",[221,878,879],{"class":249},"-not",[221,881,882],{"class":227}," $SearchBase) {\n",[221,884,886,889,891,893,896],{"class":223,"line":885},53,[221,887,888],{"class":227},"    $SearchBase ",[221,890,724],{"class":249},[221,892,876],{"class":227},[221,894,895],{"class":230},"Get-ADDomain",[221,897,898],{"class":227},").DistinguishedName\n",[221,900,902],{"class":223,"line":901},54,[221,903,863],{"class":227},[221,905,907],{"class":223,"line":906},55,[221,908,737],{"emptyLinePlaceholder":736},[221,910,912,915,917],{"class":223,"line":911},56,[221,913,914],{"class":227},"$now ",[221,916,724],{"class":249},[221,918,919],{"class":230}," Get-Date\n",[221,921,923,926,928,931,933],{"class":223,"line":922},57,[221,924,925],{"class":227},"$cutoffDate ",[221,927,724],{"class":249},[221,929,930],{"class":227}," $now.AddDays(",[221,932,295],{"class":249},[221,934,935],{"class":227},"$DaysInactive)\n",[221,937,939,942,944],{"class":223,"line":938},58,[221,940,941],{"class":227},"$cutoffFileTime ",[221,943,724],{"class":249},[221,945,946],{"class":227}," $cutoffDate.ToFileTime()\n",[221,948,950],{"class":223,"line":949},59,[221,951,737],{"emptyLinePlaceholder":736},[221,953,955],{"class":223,"line":954},60,[221,956,957],{"class":448},"# Enabled computers whose lastLogonTimestamp is older than the cutoff or was never set.\n",[221,959,961],{"class":223,"line":960},61,[221,962,963],{"class":448},"# The userAccountControl bit 2 (ACCOUNTDISABLE) test excludes accounts already disabled.\n",[221,965,967,970,972,975,978],{"class":223,"line":966},62,[221,968,969],{"class":227},"$ldapFilter ",[221,971,724],{"class":249},[221,973,974],{"class":264}," \"(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(lastLogonTimestamp\u003C=",[221,976,977],{"class":227},"$cutoffFileTime",[221,979,980],{"class":264},")(!(lastLogonTimestamp=*))))\"\n",[221,982,984],{"class":223,"line":983},63,[221,985,737],{"emptyLinePlaceholder":736},[221,987,989,992,995,998,1000,1003,1005,1008,1011,1013,1016,1019,1022],{"class":223,"line":988},64,[221,990,991],{"class":230},"Write-Host",[221,993,994],{"class":264}," \"Cutoff: ",[221,996,997],{"class":249},"$",[221,999,668],{"class":264},[221,1001,1002],{"class":227},"$cutoffDate.ToString",[221,1004,668],{"class":264},[221,1006,1007],{"class":264},"'yyyy-MM-dd'",[221,1009,1010],{"class":264},"))",[221,1012,876],{"class":264},[221,1014,1015],{"class":227},"$DaysInactive",[221,1017,1018],{"class":264}," days). Searching ",[221,1020,1021],{"class":227},"$SearchBase",[221,1023,1024],{"class":264}," ...\"\n",[221,1026,1028],{"class":223,"line":1027},65,[221,1029,737],{"emptyLinePlaceholder":736},[221,1031,1033,1036,1038,1041,1043,1046,1048,1051,1053,1056,1058,1061,1063,1066,1068,1071,1073],{"class":223,"line":1032},66,[221,1034,1035],{"class":227},"$candidates ",[221,1037,724],{"class":249},[221,1039,1040],{"class":230}," Get-ADComputer",[221,1042,250],{"class":249},[221,1044,1045],{"class":227},"LDAPFilter $ldapFilter ",[221,1047,295],{"class":249},[221,1049,1050],{"class":227},"SearchBase $SearchBase ",[221,1052,295],{"class":249},[221,1054,1055],{"class":227},"Properties LastLogonDate",[221,1057,388],{"class":249},[221,1059,1060],{"class":227}," PasswordLastSet",[221,1062,388],{"class":249},[221,1064,1065],{"class":227}," WhenCreated",[221,1067,388],{"class":249},[221,1069,1070],{"class":227}," OperatingSystem",[221,1072,388],{"class":249},[221,1074,391],{"class":227},[221,1076,1078],{"class":223,"line":1077},67,[221,1079,737],{"emptyLinePlaceholder":736},[221,1081,1083,1086,1088,1091,1094,1097],{"class":223,"line":1082},68,[221,1084,1085],{"class":227},"$staleComputers ",[221,1087,724],{"class":249},[221,1089,1090],{"class":249}," foreach",[221,1092,1093],{"class":227}," ($computer ",[221,1095,1096],{"class":249},"in",[221,1098,1099],{"class":227}," $candidates) {\n",[221,1101,1103],{"class":223,"line":1102},69,[221,1104,1105],{"class":448},"    # Skip accounts created inside the window: a new, never-used account is not stale yet.\n",[221,1107,1109,1112,1115,1118],{"class":223,"line":1108},70,[221,1110,1111],{"class":249},"    if",[221,1113,1114],{"class":227}," ($computer.WhenCreated ",[221,1116,1117],{"class":249},"-gt",[221,1119,1120],{"class":227}," $cutoffDate) {\n",[221,1122,1124],{"class":223,"line":1123},71,[221,1125,1126],{"class":249},"        continue\n",[221,1128,1130],{"class":223,"line":1129},72,[221,1131,1132],{"class":227},"    }\n",[221,1134,1136],{"class":223,"line":1135},73,[221,1137,737],{"emptyLinePlaceholder":736},[221,1139,1141],{"class":223,"line":1140},74,[221,1142,1143],{"class":448},"    # Require the machine password to be old too; a live domain member rotates it every 30 days by default.\n",[221,1145,1147,1149,1152,1154,1157,1159],{"class":223,"line":1146},75,[221,1148,1111],{"class":249},[221,1150,1151],{"class":227}," ($computer.PasswordLastSet ",[221,1153,842],{"class":249},[221,1155,1156],{"class":227}," $computer.PasswordLastSet ",[221,1158,1117],{"class":249},[221,1160,1120],{"class":227},[221,1162,1164],{"class":223,"line":1163},76,[221,1165,1126],{"class":249},[221,1167,1169],{"class":223,"line":1168},77,[221,1170,1132],{"class":227},[221,1172,1174],{"class":223,"line":1173},78,[221,1175,737],{"emptyLinePlaceholder":736},[221,1177,1179,1182,1184,1187,1190,1192,1195,1197,1200],{"class":223,"line":1178},79,[221,1180,1181],{"class":227},"    $newestSignal ",[221,1183,724],{"class":249},[221,1185,1186],{"class":249}," @",[221,1188,1189],{"class":227},"($computer.LastLogonDate",[221,1191,388],{"class":249},[221,1193,1194],{"class":227}," $computer.PasswordLastSet",[221,1196,388],{"class":249},[221,1198,1199],{"class":227}," $computer.WhenCreated) ",[221,1201,1202],{"class":249},"|\n",[221,1204,1206,1209,1212,1215,1218],{"class":223,"line":1205},80,[221,1207,1208],{"class":230},"        Where-Object",[221,1210,1211],{"class":227}," { ",[221,1213,1214],{"class":230},"$_",[221,1216,1217],{"class":227}," } ",[221,1219,1202],{"class":249},[221,1221,1223,1226,1228,1231],{"class":223,"line":1222},81,[221,1224,1225],{"class":230},"        Sort-Object",[221,1227,250],{"class":249},[221,1229,1230],{"class":227},"Descending ",[221,1232,1202],{"class":249},[221,1234,1236,1239,1241,1244],{"class":223,"line":1235},82,[221,1237,1238],{"class":230},"        Select-Object",[221,1240,250],{"class":249},[221,1242,1243],{"class":227},"First ",[221,1245,1246],{"class":230},"1\n",[221,1248,1250],{"class":223,"line":1249},83,[221,1251,737],{"emptyLinePlaceholder":736},[221,1253,1255,1257,1260,1263,1266],{"class":223,"line":1254},84,[221,1256,695],{"class":227},[221,1258,1259],{"class":249},"PSCustomObject",[221,1261,1262],{"class":227},"]",[221,1264,1265],{"class":249},"@",[221,1267,1268],{"class":227},"{\n",[221,1270,1272,1275,1277],{"class":223,"line":1271},85,[221,1273,1274],{"class":227},"        Name              ",[221,1276,724],{"class":249},[221,1278,1279],{"class":227}," $computer.Name\n",[221,1281,1283,1286,1288],{"class":223,"line":1282},86,[221,1284,1285],{"class":227},"        LastLogonDate     ",[221,1287,724],{"class":249},[221,1289,1290],{"class":227}," $computer.LastLogonDate\n",[221,1292,1294,1297,1299],{"class":223,"line":1293},87,[221,1295,1296],{"class":227},"        PasswordLastSet   ",[221,1298,724],{"class":249},[221,1300,1301],{"class":227}," $computer.PasswordLastSet\n",[221,1303,1305,1308,1310,1313,1316,1319,1321],{"class":223,"line":1304},88,[221,1306,1307],{"class":227},"        DaysInactive      ",[221,1309,724],{"class":249},[221,1311,1312],{"class":227}," [",[221,1314,1315],{"class":249},"math",[221,1317,1318],{"class":227},"]::Floor(($now ",[221,1320,295],{"class":249},[221,1322,1323],{"class":227}," $newestSignal).TotalDays)\n",[221,1325,1327,1330,1332],{"class":223,"line":1326},89,[221,1328,1329],{"class":227},"        OperatingSystem   ",[221,1331,724],{"class":249},[221,1333,1334],{"class":227}," $computer.OperatingSystem\n",[221,1336,1338,1341,1343,1346,1349,1352,1354,1357,1360,1362],{"class":223,"line":1337},90,[221,1339,1340],{"class":227},"        OU                ",[221,1342,724],{"class":249},[221,1344,1345],{"class":227}," ($computer.DistinguishedName ",[221,1347,1348],{"class":249},"-split",[221,1350,1351],{"class":264}," '(?\u003C!\\\\),'",[221,1353,388],{"class":249},[221,1355,1356],{"class":230}," 2",[221,1358,1359],{"class":227},")[",[221,1361,703],{"class":230},[221,1363,1364],{"class":227},"]\n",[221,1366,1368,1371,1373],{"class":223,"line":1367},91,[221,1369,1370],{"class":227},"        Description       ",[221,1372,724],{"class":249},[221,1374,1375],{"class":227}," $computer.Description\n",[221,1377,1379,1382,1384],{"class":223,"line":1378},92,[221,1380,1381],{"class":227},"        DistinguishedName ",[221,1383,724],{"class":249},[221,1385,1386],{"class":227}," $computer.DistinguishedName\n",[221,1388,1390],{"class":223,"line":1389},93,[221,1391,1132],{"class":227},[221,1393,1395],{"class":223,"line":1394},94,[221,1396,863],{"class":227},[221,1398,1400],{"class":223,"line":1399},95,[221,1401,737],{"emptyLinePlaceholder":736},[221,1403,1405,1407,1409,1411,1414,1416,1419,1421,1424,1426],{"class":223,"line":1404},96,[221,1406,1085],{"class":227},[221,1408,724],{"class":249},[221,1410,1186],{"class":249},[221,1412,1413],{"class":227},"($staleComputers ",[221,1415,377],{"class":249},[221,1417,1418],{"class":230}," Sort-Object",[221,1420,250],{"class":249},[221,1422,1423],{"class":227},"Property DaysInactive ",[221,1425,295],{"class":249},[221,1427,1428],{"class":227},"Descending)\n",[221,1430,1432],{"class":223,"line":1431},97,[221,1433,737],{"emptyLinePlaceholder":736},[221,1435,1437,1439,1442,1445,1448],{"class":223,"line":1436},98,[221,1438,836],{"class":249},[221,1440,1441],{"class":227}," ($staleComputers.Count ",[221,1443,1444],{"class":249},"-eq",[221,1446,1447],{"class":230}," 0",[221,1449,1450],{"class":227},") {\n",[221,1452,1454,1457],{"class":223,"line":1453},99,[221,1455,1456],{"class":230},"    Write-Host",[221,1458,1459],{"class":264}," \"No stale computer accounts found.\"\n",[221,1461,1463],{"class":223,"line":1462},100,[221,1464,1465],{"class":249},"    return\n",[221,1467,1469],{"class":223,"line":1468},101,[221,1470,863],{"class":227},[221,1472,1474],{"class":223,"line":1473},102,[221,1475,737],{"emptyLinePlaceholder":736},[221,1477,1479,1481,1484,1486,1488,1491,1494],{"class":223,"line":1478},103,[221,1480,991],{"class":230},[221,1482,1483],{"class":264}," \"",[221,1485,997],{"class":249},[221,1487,668],{"class":264},[221,1489,1490],{"class":227},"$staleComputers.Count",[221,1492,1493],{"class":264},")",[221,1495,1496],{"class":264}," stale computer account(s) found.\"\n",[221,1498,1500,1502,1504,1507,1509,1511,1513,1516,1518,1520,1522,1525,1527,1529,1531,1534,1536],{"class":223,"line":1499},104,[221,1501,1085],{"class":227},[221,1503,377],{"class":249},[221,1505,1506],{"class":230}," Format-Table",[221,1508,250],{"class":249},[221,1510,385],{"class":227},[221,1512,388],{"class":249},[221,1514,1515],{"class":227}," LastLogonDate",[221,1517,388],{"class":249},[221,1519,1060],{"class":227},[221,1521,388],{"class":249},[221,1523,1524],{"class":227}," DaysInactive",[221,1526,388],{"class":249},[221,1528,1070],{"class":227},[221,1530,388],{"class":249},[221,1532,1533],{"class":227}," OU ",[221,1535,295],{"class":249},[221,1537,1538],{"class":227},"AutoSize\n",[221,1540,1542],{"class":223,"line":1541},105,[221,1543,737],{"emptyLinePlaceholder":736},[221,1545,1547,1549],{"class":223,"line":1546},106,[221,1548,836],{"class":249},[221,1550,1551],{"class":227}," ($ReportPath) {\n",[221,1553,1555,1558,1560,1563,1565,1568,1570,1573,1575],{"class":223,"line":1554},107,[221,1556,1557],{"class":227},"    $staleComputers ",[221,1559,377],{"class":249},[221,1561,1562],{"class":230}," Export-Csv",[221,1564,250],{"class":249},[221,1566,1567],{"class":227},"Path $ReportPath ",[221,1569,295],{"class":249},[221,1571,1572],{"class":227},"NoTypeInformation ",[221,1574,295],{"class":249},[221,1576,1577],{"class":227},"Encoding UTF8\n",[221,1579,1581,1583,1586,1589],{"class":223,"line":1580},108,[221,1582,1456],{"class":230},[221,1584,1585],{"class":264}," \"Report written to ",[221,1587,1588],{"class":227},"$ReportPath",[221,1590,1591],{"class":264},"\"\n",[221,1593,1595],{"class":223,"line":1594},109,[221,1596,863],{"class":227},[221,1598,1600],{"class":223,"line":1599},110,[221,1601,737],{"emptyLinePlaceholder":736},[221,1603,1605,1607],{"class":223,"line":1604},111,[221,1606,836],{"class":249},[221,1608,1609],{"class":227}," ($Disable) {\n",[221,1611,1613,1616,1618,1621,1623],{"class":223,"line":1612},112,[221,1614,1615],{"class":227},"    $stamp ",[221,1617,724],{"class":249},[221,1619,1620],{"class":227}," $now.ToString(",[221,1622,1007],{"class":264},[221,1624,806],{"class":227},[221,1626,1628],{"class":223,"line":1627},113,[221,1629,737],{"emptyLinePlaceholder":736},[221,1631,1633,1636,1638,1640],{"class":223,"line":1632},114,[221,1634,1635],{"class":249},"    foreach",[221,1637,1093],{"class":227},[221,1639,1096],{"class":249},[221,1641,1642],{"class":227}," $staleComputers) {\n",[221,1644,1646,1649,1651,1654,1657,1659,1662,1664,1666,1669,1671,1674],{"class":223,"line":1645},115,[221,1647,1648],{"class":249},"        if",[221,1650,876],{"class":227},[221,1652,1653],{"class":230},"$PSCmdlet",[221,1655,1656],{"class":227},".ShouldProcess($computer.Name",[221,1658,388],{"class":249},[221,1660,1661],{"class":264}," \"Disable computer account (inactive ",[221,1663,997],{"class":249},[221,1665,668],{"class":264},[221,1667,1668],{"class":227},"$computer.DaysInactive",[221,1670,1493],{"class":264},[221,1672,1673],{"class":264}," days)\"",[221,1675,1676],{"class":227},")) {\n",[221,1678,1680,1683],{"class":223,"line":1679},116,[221,1681,1682],{"class":249},"            try",[221,1684,1685],{"class":227}," {\n",[221,1687,1689],{"class":223,"line":1688},117,[221,1690,1691],{"class":448},"                # Keep the existing description (owner, asset tag) after the sweep note; AD caps description at 1024 characters.\n",[221,1693,1695,1698,1700,1703,1706,1709,1711,1713,1716,1718],{"class":223,"line":1694},118,[221,1696,1697],{"class":227},"                $description ",[221,1699,724],{"class":249},[221,1701,1702],{"class":264}," \"Stale sweep ",[221,1704,1705],{"class":227},"$stamp",[221,1707,1708],{"class":264},"; was in ",[221,1710,997],{"class":249},[221,1712,668],{"class":264},[221,1714,1715],{"class":227},"$computer.OU",[221,1717,1493],{"class":264},[221,1719,1591],{"class":264},[221,1721,1723,1726],{"class":223,"line":1722},119,[221,1724,1725],{"class":249},"                if",[221,1727,1728],{"class":227}," ($computer.Description) {\n",[221,1730,1732,1735,1737,1739,1742,1745,1747,1749,1752,1754],{"class":223,"line":1731},120,[221,1733,1734],{"class":227},"                    $description ",[221,1736,724],{"class":249},[221,1738,1483],{"class":264},[221,1740,1741],{"class":227},"$description",[221,1743,1744],{"class":264}," | ",[221,1746,997],{"class":249},[221,1748,668],{"class":264},[221,1750,1751],{"class":227},"$computer.Description",[221,1753,1493],{"class":264},[221,1755,1591],{"class":264},[221,1757,1759],{"class":223,"line":1758},121,[221,1760,1761],{"class":227},"                }\n",[221,1763,1765,1767,1770,1772,1775],{"class":223,"line":1764},122,[221,1766,1725],{"class":249},[221,1768,1769],{"class":227}," ($description.Length ",[221,1771,1117],{"class":249},[221,1773,1774],{"class":230}," 1024",[221,1776,1450],{"class":227},[221,1778,1780,1783,1786,1788,1790,1793,1795,1798,1800,1802,1804,1806],{"class":223,"line":1779},123,[221,1781,1782],{"class":230},"                    Write-Warning",[221,1784,1785],{"class":264}," \"Description of ",[221,1787,997],{"class":249},[221,1789,668],{"class":264},[221,1791,1792],{"class":227},"$computer.Name",[221,1794,1493],{"class":264},[221,1796,1797],{"class":264}," truncated to 1024 characters. Original: ",[221,1799,997],{"class":249},[221,1801,668],{"class":264},[221,1803,1751],{"class":227},[221,1805,1493],{"class":264},[221,1807,1591],{"class":264},[221,1809,1811,1813,1815,1818,1821,1823,1825],{"class":223,"line":1810},124,[221,1812,1734],{"class":227},[221,1814,724],{"class":249},[221,1816,1817],{"class":227}," $description.Substring(",[221,1819,1820],{"class":230},"0",[221,1822,388],{"class":249},[221,1824,1774],{"class":230},[221,1826,806],{"class":227},[221,1828,1830],{"class":223,"line":1829},125,[221,1831,1761],{"class":227},[221,1833,1835],{"class":223,"line":1834},126,[221,1836,737],{"emptyLinePlaceholder":736},[221,1838,1840,1843,1845,1848,1850],{"class":223,"line":1839},127,[221,1841,1842],{"class":230},"                Disable-ADAccount",[221,1844,250],{"class":249},[221,1846,1847],{"class":227},"Identity $computer.DistinguishedName ",[221,1849,295],{"class":249},[221,1851,825],{"class":227},[221,1853,1855,1858,1860,1862,1864,1867,1869],{"class":223,"line":1854},128,[221,1856,1857],{"class":230},"                Set-ADComputer",[221,1859,250],{"class":249},[221,1861,1847],{"class":227},[221,1863,295],{"class":249},[221,1865,1866],{"class":227},"Description $description ",[221,1868,295],{"class":249},[221,1870,825],{"class":227},[221,1872,1874],{"class":223,"line":1873},129,[221,1875,737],{"emptyLinePlaceholder":736},[221,1877,1879,1881],{"class":223,"line":1878},130,[221,1880,1725],{"class":249},[221,1882,1883],{"class":227}," ($TargetOU) {\n",[221,1885,1887,1890,1892,1894,1896,1899,1901],{"class":223,"line":1886},131,[221,1888,1889],{"class":230},"                    Move-ADObject",[221,1891,250],{"class":249},[221,1893,1847],{"class":227},[221,1895,295],{"class":249},[221,1897,1898],{"class":227},"TargetPath $TargetOU ",[221,1900,295],{"class":249},[221,1902,825],{"class":227},[221,1904,1906],{"class":223,"line":1905},132,[221,1907,1761],{"class":227},[221,1909,1911],{"class":223,"line":1910},133,[221,1912,737],{"emptyLinePlaceholder":736},[221,1914,1916,1919,1922,1924,1926,1928,1930],{"class":223,"line":1915},134,[221,1917,1918],{"class":230},"                Write-Host",[221,1920,1921],{"class":264}," \"Disabled ",[221,1923,997],{"class":249},[221,1925,668],{"class":264},[221,1927,1792],{"class":227},[221,1929,1493],{"class":264},[221,1931,1591],{"class":264},[221,1933,1935,1938,1941],{"class":223,"line":1934},135,[221,1936,1937],{"class":227},"            } ",[221,1939,1940],{"class":249},"catch",[221,1942,1685],{"class":227},[221,1944,1946,1949,1952,1954,1956,1958,1960,1963,1965,1967,1969,1972,1974],{"class":223,"line":1945},136,[221,1947,1948],{"class":230},"                Write-Warning",[221,1950,1951],{"class":264}," \"Failed on ",[221,1953,997],{"class":249},[221,1955,668],{"class":264},[221,1957,1792],{"class":227},[221,1959,1493],{"class":264},[221,1961,1962],{"class":264},": ",[221,1964,997],{"class":249},[221,1966,668],{"class":264},[221,1968,1214],{"class":230},[221,1970,1971],{"class":227},".Exception.Message",[221,1973,1493],{"class":264},[221,1975,1591],{"class":264},[221,1977,1979],{"class":223,"line":1978},137,[221,1980,1981],{"class":227},"            }\n",[221,1983,1985],{"class":223,"line":1984},138,[221,1986,1987],{"class":227},"        }\n",[221,1989,1991],{"class":223,"line":1990},139,[221,1992,1132],{"class":227},[221,1994,1996],{"class":223,"line":1995},140,[221,1997,863],{"class":227},[38,1999,2001],{"id":2000},"notes","Notes",[43,2003,2004,2017,2045,2060,2069,2075,2081,2084],{},[46,2005,2006,2008,2009,2012,2013,2016],{},[15,2007,17],{}," is built for exactly this job and is deliberately imprecise. Microsoft's Directory Services team describes its intended purpose as identifying inactive accounts, and with default settings it lags 9 to 14 days behind reality: a logon only rewrites it when the stored value is older than ",[15,2010,2011],{},"msDS-LogonTimeSyncInterval"," (default 14 days, \"Not Set\" in ADSI Edit means 14) minus a random 0 to 5 days. Any threshold under about 30 days will produce false positives. For to-the-day accuracy you would need the non-replicated ",[15,2014,2015],{},"lastLogon"," from every DC, or DC security logs.",[46,2018,2019,2020,2023,2024,2026,2027,2030,2031,2034,2035,2037,2038,2041,2042,56],{},"The ",[15,2021,2022],{},"LastLogonDate"," property the module returns is ",[15,2025,17],{}," converted to a local ",[15,2028,2029],{},"DateTime",", and ",[15,2032,2033],{},"PasswordLastSet"," is ",[15,2036,21],{}," converted the same way, so the script never has to call ",[15,2039,2040],{},"[DateTime]::FromFileTime()"," itself. The LDAP filter, by contrast, compares the raw FILETIME integer, which is why the cutoff is converted with ",[15,2043,2044],{},"ToFileTime()",[46,2046,2047,2048,2051,2052,2055,2056,2059],{},"The filter uses the ",[15,2049,2050],{},"LDAP_MATCHING_RULE_BIT_AND"," rule (",[15,2053,2054],{},"1.2.840.113556.1.4.803",") against ",[15,2057,2058],{},"userAccountControl"," bit 2 to skip disabled accounts on the server side, so the query only returns candidates instead of every computer in the domain.",[46,2061,2062,2065,2066,2068],{},[15,2063,2064],{},"Search-ADAccount -AccountInactive -ComputersOnly -TimeSpan 90.00:00:00"," is the one-line alternative, and it's fine for a quick look. I prefer the explicit filter because it also checks ",[15,2067,21],{},", skips freshly created accounts, and leaves disabled accounts out.",[46,2070,2071,2072,2074],{},"The password change is submitted by the domain member itself, so a machine that is powered off or off the network doesn't rotate it. That's what makes an old ",[15,2073,21],{}," a useful second signal. It's also why disabling beats deleting: a disabled account can simply be re-enabled, while deleting it throws away the object and its SID, and the machine has to be rejoined to the domain.",[46,2076,2077,2078,2080],{},"Run without ",[15,2079,68],{}," first and review the CSV. Some \"stale\" accounts are seasonal machines, lab equipment, or systems that are powered off for long stretches rather than actually retired.",[46,2082,2083],{},"I keep disabled accounts in the quarantine OU for 30 to 60 days before deleting them. That window has saved me more than once when a \"retired\" laptop turned out to still be someone's daily driver, and the description stamp makes the move back a single command.",[46,2085,2086,2087,2090,2091,2093,2094,2096],{},"If the domain has several sites, run it against one DC with ",[15,2088,2089],{},"-Server"," added to the ",[15,2092,361],{}," call if you want repeatable results between runs; ",[15,2095,17],{}," replicates normally (not urgently), so a DC can briefly hold an older value.",[38,2098,2100],{"id":2099},"source","Source",[43,2102,2103,2112,2118,2125,2132,2139,2146],{},[46,2104,2105],{},[2106,2107,2111],"a",{"href":2108,"rel":2109},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Farchive\u002Fblogs\u002Faskds\u002Fthe-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works",[2110],"nofollow","The LastLogonTimeStamp attribute: what it was designed for and how it works (Microsoft AskDS)",[46,2113,2114],{},[2106,2115,29],{"href":2116,"rel":2117},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprevious-versions\u002Fwindows\u002Fit-pro\u002Fwindows-10\u002Fsecurity\u002Fthreat-protection\u002Fsecurity-policy-settings\u002Fdomain-member-maximum-machine-account-password-age",[2110],[46,2119,2120],{},[2106,2121,2124],{"href":2122,"rel":2123},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fadschema\u002Fa-msds-logontimesyncinterval",[2110],"ms-DS-Logon-Time-Sync-Interval attribute",[46,2126,2127],{},[2106,2128,2131],{"href":2129,"rel":2130},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Farchive\u002Ftechnet-wiki\u002F22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate",[2110],"Understanding LastLogon, LastLogonTimeStamp and LastLogonDate (TechNet Wiki)",[46,2133,2134],{},[2106,2135,2138],{"href":2136,"rel":2137},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Factivedirectory\u002Fsearch-adaccount",[2110],"Search-ADAccount",[46,2140,2141],{},[2106,2142,2145],{"href":2143,"rel":2144},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fadministration\u002Finstall-remote-server-administration-tools",[2110],"Install Remote Server Administration Tools",[46,2147,2148],{},[2106,2149,2152],{"href":2150,"rel":2151},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fadsi\u002Fsearch-filter-syntax",[2110],"Search filter syntax (LDAP matching rules)",[2154,2155,2156],"style",{},"html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}",{"title":217,"searchDepth":394,"depth":394,"links":2158},[2159,2160,2161,2162,2163,2164],{"id":40,"depth":394,"text":41},{"id":83,"depth":394,"text":84},{"id":206,"depth":394,"text":207},{"id":437,"depth":394,"text":438},{"id":2000,"depth":394,"text":2001},{"id":2099,"depth":394,"text":2100},"techcolumnist",[2167,2168],"ps","scripts","2025-06-30T14:00:00Z","Find AD computer accounts that stopped authenticating using lastLogonTimestamp and pwdLastSet, report them, then disable and quarantine them with a note for rollback.","md",false,null,{},"\u002Fblog\u002F2025\u002F06\u002F30\u002Fpowershell-active-directory-find-and-disable-stale-computer-accounts",{"title":6,"description":2170},[2165],"blog\u002F2025\u002F06\u002F30\u002Fpowershell-active-directory-find-and-disable-stale-computer-accounts",[216,2180,2181],"active-directory","windows","\u002F2025\u002F06\u002F30\u002Fpowershell-active-directory-find-and-disable-stale-computer-accounts\u002F","zKuO6e8VngGtIcgSIMS45k2QfXZu_1B6UgKAEiMkDms",{"title":2185,"description":2186,"date":2187,"url":2188,"categories":2189,"tags":2191,"image":2192,"readingTime":502,"canonical":2193,"sites":2194,"series":2195,"seriesOrder":496},"Service Knowledge & Configuration: Building a system of record that helps","Building a service knowledge and configuration system of record that actually helps, after eight weeks on the pillars of modern ITSM.","2025-07-02T16:19:15Z","\u002F2025\u002F07\u002F02\u002Fservice-knowledge-configuration-building-a-system-of-record-that-helps\u002F",[2190],"business",[],"\u002Fuploads\u002F2025\u002F07\u002FChatGPT-Image-Jul-2-2025-12_18_41-PM.png","lasswell",[2193,2165],"itsm-in-practice",{"title":2197,"description":2198,"date":2199,"url":2200,"categories":2201,"tags":2202,"image":2203,"readingTime":502,"canonical":2193,"sites":2204,"series":2195,"seriesOrder":490},"Change Enablement in a DevOps World: Replacing fear of change with velocity and trust","We’ve spent the past seven weeks reframing how modern ITSM works, from infrastructure and service desks to principles, value streams, and product thinking.","2025-06-23T23:14:31Z","\u002F2025\u002F06\u002F23\u002Fchange-enablement-in-a-devops-world-replacing-fear-of-change-with-velocity-and-trust\u002F",[2190],[],"\u002Fuploads\u002F2025\u002F06\u002FChatGPT-Image-Jun-23-2025-07_04_53-PM.png",[2193,2165],[2206,2215,2223],{"title":2207,"description":2208,"date":2209,"url":2210,"categories":2211,"tags":2212,"image":2173,"readingTime":470,"canonical":2165,"sites":2214,"series":2173,"seriesOrder":2173},"PowerShell: Windows – Discover Local Admins Across Every Workstation","A script that reads the local Administrators group on every workstation by SID, survives orphaned-SID errors, and flags members outside an approved allowlist.","2025-10-08T14:00:00Z","\u002F2025\u002F10\u002F08\u002Fpowershell-windows-discover-local-admins-across-every-workstation\u002F",[2167,2168],[216,2181,2213,2180],"discovery",[2165],{"title":2216,"description":2217,"date":2218,"url":2219,"categories":2220,"tags":2221,"image":2173,"readingTime":407,"canonical":2165,"sites":2222,"series":2173,"seriesOrder":2173},"PowerShell: Windows – Inventory Installed Software Across a Domain","A script that reads the Uninstall registry keys on many Windows computers in parallel over PowerShell remoting and writes one CSV, without touching Win32_Product.","2025-08-27T14:00:00Z","\u002F2025\u002F08\u002F27\u002Fpowershell-windows-inventory-installed-software-across-a-domain\u002F",[2167,2168],[216,2181,2213,2180],[2165],{"title":2224,"description":2225,"date":2226,"url":2227,"categories":2228,"tags":2229,"image":2173,"readingTime":470,"canonical":2165,"sites":2231,"series":2173,"seriesOrder":2173},"PowerShell: Active Directory – Report Group Membership Sprawl","Rank AD security groups by nesting depth, transitive member count, ownership and staleness for an access review, plus a per-user Kerberos token size estimate.","2025-12-03T14:00:00Z","\u002F2025\u002F12\u002F03\u002Fpowershell-active-directory-report-group-membership-sprawl\u002F",[2167,2168],[216,2180,2230],"reporting",[2165],{"doc":2173,"posts":2233},[],1790052512799]