?
Solved

Getting rid of Inactive computers from active directory

Posted on 2003-11-14
14
Medium Priority
?
305 Views
Last Modified: 2012-05-04
We do a lot of imaging and my techs many times do not name the computers the exact same name. So I have about 3300 computers listed in Active Directory but I know I only have about 1600. AD has been active for about 2.5 years so I have alot of excess baggage. I can see the active computers in Hyena and could delete from there but I take a chance that I will delete legitimate ones adn then we would have to go out and join the domain again. I know that I could go to DHCP and see who the active leases are but that would entail doing a ton by hand and I would think there has to an easier way. thanks

Gary
BTW they should give points for really good questions and I feel this is a great one.
0
Comment
Question by:macpiano
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
  • +2
14 Comments
 
LVL 9

Expert Comment

by:MSGeek
ID: 9755253
Gary, I think no matter how you look at this problem you'll come to find if the work is not done from the "get go" it is much more difficult to do it latter on.  Additionally in an IT industry such as we have today your technicians should take more ownership in their work and follow procedures to avoid creating such a mess.  

One thing you could do is setup you inattend file to import new images into a different OU.  This would prevent the current pool of unknowns from groing any larger and becoming more unmanagible.  

The other thing you could do is enable scavenging in DNS: http://support.microsoft.com/default.aspx?scid=kb;en-us;296116&Product=win2000

Regradless of what you do I believe there is going to be some grunt work involved.

I suppose you could grant all users the ability to add a computer account and then delete all computer accounts, however I will deny that I ever recommended this solution.  :-)

Good luck, MSGeek.
0
 

Author Comment

by:macpiano
ID: 9757441
Probably using the DHCP addresses would be pretty current so maybe that would be the route. I could export to Excel and sort by alphabet and that should do it.

thanks
Gary
0
 
LVL 21

Expert Comment

by:marc_nivens
ID: 9757931
I think I've got an easy resolution for this:

1.  Launch ADU&C
2.  Click on View, Filter Options, Create Custom, Customize, Advanced Tab.

You're going to enter an LDAP filter thats something like this:

(whenChanged<=20031114004054.0Z)

The above example can be broken out to read 2003 11 14 00 40 54, or 11/14/2003 at 00:40:54.  Use the format
above to pick your date and be sure you append the .0Z as well.

3.  Browse to the computers container

You should now only see computers that were last modified before the date you put in.  You can make the choice whether to delete them or not, but this will give you a list of computers that haven't been changed since the date you pick.

0
Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

 
LVL 9

Expert Comment

by:MSGeek
ID: 9758868
marc_nivens.. that's a great simple straight forward solution.  I have to admit I have not played around with Active Directory's filtering capabilities, but will be experimenting with them.  

I will caution, I do not believe the whenchanged attribute is replicated between DCs.  There fore if you are going to implement Marc_Nivens advice, I would recommend checking all your DCs.  Still a great tip.  MSGeek.
0
 
LVL 21

Expert Comment

by:marc_nivens
ID: 9758923
You know, I completely overlooked that... you made me start thinking so I did some more research on the topic.  I found the following from http://www.activxperts.com/activmonitor/windowsmanagement/adsi/ under the Extracting Computer Information section:

<paste>
Network Administrators have always wanted an easy way to get a list of network workstations along with operating system and service pack information. You can now do this by using new attributes on Windows 2000 computer accounts to identify the computer's current status. The computer object is now automatically updated with information (from the netlogon service during secure channel setup) about the client's operating system, operating system version, and service pack level. You can identify unused or possibly inactive computer accounts; accounts that have never been used do not have the operating system and version attributes set. If the whenChanged attribute is more than a month old, the computer probably is not active on a network making periodic password changes. The whenChanged attribute is a non-replicated attribute which means it is calculated on each DC. The lastLogon attribute is not replicated between DCs; to determine the last logon time you have to examine it on all DCs.
</paste>

So it appears that you were absolutely right, but it seems to be ok to use this method.  I'll say caveat emptor as I've never actually used this method to clean up accounts.  MSGeek, thanks for keeping me honest :-)
0
 
LVL 9

Expert Comment

by:MSGeek
ID: 9758964
marc_nivens.. we're all after the same answer, the one that works.  Jut call me anal retentive, not really out to keep anyone enything, just solving problems is my gig.
0
 

Author Comment

by:macpiano
ID: 9760581
So I guess I have asked a very important question. It's important because most utilities such are virus servers and patch servers look at the domain to do their thing. Extra names means wasted efforts. I am in the process of changing our dhcp scope to about 1000 addresses instead of 30,000 that my prdecessor had in. Makes quicker work to find stuff. Well if anyone comes up with a good tool, even one that i have to buy that would be great.

Gary
0
 

Author Comment

by:macpiano
ID: 10042425
I ended up using the tool Hyena which listed all the computers in the domain by the last password change which I understand is a function of the operating system not the user changing the password. The system changes every 30 days. I just lined up the computers that were 2 months old, deselected those that I knew were laptops that hadn't logged in for a while and poof I reduced 3300 names in AD to about 1900.

For me case closed.
Gary
0
 
LVL 9

Expert Comment

by:MSGeek
ID: 10045581
Gary.. thanks for the update.

Moderator.. I am ok with a refund as long as this is PAQ'd.
0
 

Expert Comment

by:mk30363
ID: 10648716
Hi everybody, trying to clean up my AD, i've got a few questions:
What about if the Full Name is missing (Computer$) ?
What about Users connecting remotly? (Through 56K Modem, does the computer account change ?)

Thanks

Mike
0
 
LVL 9

Expert Comment

by:MSGeek
ID: 10653882
mk30363.. Mike.. I see you are fairly new to EE.  Welcome. If you have a question you need to post it on your own.  It's not right to piggy backsomeone elses question.   PLease post your own question.  Thanks,  MSGeek
0
 

Accepted Solution

by:
modulo earned 0 total points
ID: 11188464
PAQed, with points refunded (500)

modulo
Community Support Moderator
0

Featured Post

New benefit for Premium Members - Upgrade now!

Ready to get started with anonymous questions today? It's easy! Learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question