Solved

Getting rid of Inactive computers from active directory

Posted on 2003-11-14
14
290 Views
Last Modified: 2012-05-04
We do a lot of imaging and my techs many times do not name the computers the exact same name. So I have about 3300 computers listed in Active Directory but I know I only have about 1600. AD has been active for about 2.5 years so I have alot of excess baggage. I can see the active computers in Hyena and could delete from there but I take a chance that I will delete legitimate ones adn then we would have to go out and join the domain again. I know that I could go to DHCP and see who the active leases are but that would entail doing a ton by hand and I would think there has to an easier way. thanks

Gary
BTW they should give points for really good questions and I feel this is a great one.
0
Comment
Question by:macpiano
  • 5
  • 3
  • 2
  • +2
14 Comments
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
Gary, I think no matter how you look at this problem you'll come to find if the work is not done from the "get go" it is much more difficult to do it latter on.  Additionally in an IT industry such as we have today your technicians should take more ownership in their work and follow procedures to avoid creating such a mess.  

One thing you could do is setup you inattend file to import new images into a different OU.  This would prevent the current pool of unknowns from groing any larger and becoming more unmanagible.  

The other thing you could do is enable scavenging in DNS: http://support.microsoft.com/default.aspx?scid=kb;en-us;296116&Product=win2000

Regradless of what you do I believe there is going to be some grunt work involved.

I suppose you could grant all users the ability to add a computer account and then delete all computer accounts, however I will deny that I ever recommended this solution.  :-)

Good luck, MSGeek.
0
 

Author Comment

by:macpiano
Comment Utility
Probably using the DHCP addresses would be pretty current so maybe that would be the route. I could export to Excel and sort by alphabet and that should do it.

thanks
Gary
0
 
LVL 21

Expert Comment

by:marc_nivens
Comment Utility
I think I've got an easy resolution for this:

1.  Launch ADU&C
2.  Click on View, Filter Options, Create Custom, Customize, Advanced Tab.

You're going to enter an LDAP filter thats something like this:

(whenChanged<=20031114004054.0Z)

The above example can be broken out to read 2003 11 14 00 40 54, or 11/14/2003 at 00:40:54.  Use the format
above to pick your date and be sure you append the .0Z as well.

3.  Browse to the computers container

You should now only see computers that were last modified before the date you put in.  You can make the choice whether to delete them or not, but this will give you a list of computers that haven't been changed since the date you pick.

0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
marc_nivens.. that's a great simple straight forward solution.  I have to admit I have not played around with Active Directory's filtering capabilities, but will be experimenting with them.  

I will caution, I do not believe the whenchanged attribute is replicated between DCs.  There fore if you are going to implement Marc_Nivens advice, I would recommend checking all your DCs.  Still a great tip.  MSGeek.
0
 
LVL 21

Expert Comment

by:marc_nivens
Comment Utility
You know, I completely overlooked that... you made me start thinking so I did some more research on the topic.  I found the following from http://www.activxperts.com/activmonitor/windowsmanagement/adsi/ under the Extracting Computer Information section:

<paste>
Network Administrators have always wanted an easy way to get a list of network workstations along with operating system and service pack information. You can now do this by using new attributes on Windows 2000 computer accounts to identify the computer's current status. The computer object is now automatically updated with information (from the netlogon service during secure channel setup) about the client's operating system, operating system version, and service pack level. You can identify unused or possibly inactive computer accounts; accounts that have never been used do not have the operating system and version attributes set. If the whenChanged attribute is more than a month old, the computer probably is not active on a network making periodic password changes. The whenChanged attribute is a non-replicated attribute which means it is calculated on each DC. The lastLogon attribute is not replicated between DCs; to determine the last logon time you have to examine it on all DCs.
</paste>

So it appears that you were absolutely right, but it seems to be ok to use this method.  I'll say caveat emptor as I've never actually used this method to clean up accounts.  MSGeek, thanks for keeping me honest :-)
0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
marc_nivens.. we're all after the same answer, the one that works.  Jut call me anal retentive, not really out to keep anyone enything, just solving problems is my gig.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:macpiano
Comment Utility
So I guess I have asked a very important question. It's important because most utilities such are virus servers and patch servers look at the domain to do their thing. Extra names means wasted efforts. I am in the process of changing our dhcp scope to about 1000 addresses instead of 30,000 that my prdecessor had in. Makes quicker work to find stuff. Well if anyone comes up with a good tool, even one that i have to buy that would be great.

Gary
0
 

Author Comment

by:macpiano
Comment Utility
I ended up using the tool Hyena which listed all the computers in the domain by the last password change which I understand is a function of the operating system not the user changing the password. The system changes every 30 days. I just lined up the computers that were 2 months old, deselected those that I knew were laptops that hadn't logged in for a while and poof I reduced 3300 names in AD to about 1900.

For me case closed.
Gary
0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
Gary.. thanks for the update.

Moderator.. I am ok with a refund as long as this is PAQ'd.
0
 

Expert Comment

by:mk30363
Comment Utility
Hi everybody, trying to clean up my AD, i've got a few questions:
What about if the Full Name is missing (Computer$) ?
What about Users connecting remotly? (Through 56K Modem, does the computer account change ?)

Thanks

Mike
0
 
LVL 9

Expert Comment

by:MSGeek
Comment Utility
mk30363.. Mike.. I see you are fairly new to EE.  Welcome. If you have a question you need to post it on your own.  It's not right to piggy backsomeone elses question.   PLease post your own question.  Thanks,  MSGeek
0
 

Accepted Solution

by:
modulo earned 0 total points
Comment Utility
PAQed, with points refunded (500)

modulo
Community Support Moderator
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
HOW TO: Install and Configure VMware vSphere Hypervisor 6.5 (ESXi 6.5), Step by Step Tutorial with screenshots. From Download, Checking Media, to Completed Installation.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now