Getting rid of Inactive computers from active directory

Probably using the DHCP addresses would be pretty current so maybe that would be the route. I could export to Excel and sort by alphabet and that should do it.

thanks
Gary

I think I've got an easy resolution for this:

1.  Launch ADU&C
2.  Click on View, Filter Options, Create Custom, Customize, Advanced Tab.

You're going to enter an LDAP filter thats something like this:

(whenChanged<=20031114004054.0Z)

The above example can be broken out to read 2003 11 14 00 40 54, or 11/14/2003 at 00:40:54.  Use the format
above to pick your date and be sure you append the .0Z as well.

3.  Browse to the computers container

You should now only see computers that were last modified before the date you put in.  You can make the choice whether to delete them or not, but this will give you a list of computers that haven't been changed since the date you pick.

marc_nivens.. that's a great simple straight forward solution.  I have to admit I have not played around with Active Directory's filtering capabilities, but will be experimenting with them.  

I will caution, I do not believe the whenchanged attribute is replicated between DCs.  There fore if you are going to implement Marc_Nivens advice, I would recommend checking all your DCs.  Still a great tip.  MSGeek.

You know, I completely overlooked that... you made me start thinking so I did some more research on the topic.  I found the following from http://www.activxperts.com/activmonitor/windowsmanagement/adsi/ under the Extracting Computer Information section:

<paste>
Network Administrators have always wanted an easy way to get a list of network workstations along with operating system and service pack information. You can now do this by using new attributes on Windows 2000 computer accounts to identify the computer's current status. The computer object is now automatically updated with information (from the netlogon service during secure channel setup) about the client's operating system, operating system version, and service pack level. You can identify unused or possibly inactive computer accounts; accounts that have never been used do not have the operating system and version attributes set. If the whenChanged attribute is more than a month old, the computer probably is not active on a network making periodic password changes. The whenChanged attribute is a non-replicated attribute which means it is calculated on each DC. The lastLogon attribute is not replicated between DCs; to determine the last logon time you have to examine it on all DCs.
</paste>

So it appears that you were absolutely right, but it seems to be ok to use this method.  I'll say caveat emptor as I've never actually used this method to clean up accounts.  MSGeek, thanks for keeping me honest :-)

marc_nivens.. we're all after the same answer, the one that works.  Jut call me anal retentive, not really out to keep anyone enything, just solving problems is my gig.

So I guess I have asked a very important question. It's important because most utilities such are virus servers and patch servers look at the domain to do their thing. Extra names means wasted efforts. I am in the process of changing our dhcp scope to about 1000 addresses instead of 30,000 that my prdecessor had in. Makes quicker work to find stuff. Well if anyone comes up with a good tool, even one that i have to buy that would be great.

Gary

I ended up using the tool Hyena which listed all the computers in the domain by the last password change which I understand is a function of the operating system not the user changing the password. The system changes every 30 days. I just lined up the computers that were 2 months old, deselected those that I knew were laptops that hadn't logged in for a while and poof I reduced 3300 names in AD to about 1900.

For me case closed.
Gary

Gary.. thanks for the update.

Moderator.. I am ok with a refund as long as this is PAQ'd.

Hi everybody, trying to clean up my AD, i've got a few questions:
What about if the Full Name is missing (Computer$) ?
What about Users connecting remotly? (Through 56K Modem, does the computer account change ?)

Thanks

Mike

mk30363.. Mike.. I see you are fairly new to EE.  Welcome. If you have a question you need to post it on your own.  It's not right to piggy backsomeone elses question.   PLease post your own question.  Thanks,  MSGeek