[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 310
  • Last Modified:

Getting rid of Inactive computers from active directory

We do a lot of imaging and my techs many times do not name the computers the exact same name. So I have about 3300 computers listed in Active Directory but I know I only have about 1600. AD has been active for about 2.5 years so I have alot of excess baggage. I can see the active computers in Hyena and could delete from there but I take a chance that I will delete legitimate ones adn then we would have to go out and join the domain again. I know that I could go to DHCP and see who the active leases are but that would entail doing a ton by hand and I would think there has to an easier way. thanks

Gary
BTW they should give points for really good questions and I feel this is a great one.
0
macpiano
Asked:
macpiano
  • 5
  • 3
  • 2
  • +2
1 Solution
 
MSGeekCommented:
Gary, I think no matter how you look at this problem you'll come to find if the work is not done from the "get go" it is much more difficult to do it latter on.  Additionally in an IT industry such as we have today your technicians should take more ownership in their work and follow procedures to avoid creating such a mess.  

One thing you could do is setup you inattend file to import new images into a different OU.  This would prevent the current pool of unknowns from groing any larger and becoming more unmanagible.  

The other thing you could do is enable scavenging in DNS: http://support.microsoft.com/default.aspx?scid=kb;en-us;296116&Product=win2000

Regradless of what you do I believe there is going to be some grunt work involved.

I suppose you could grant all users the ability to add a computer account and then delete all computer accounts, however I will deny that I ever recommended this solution.  :-)

Good luck, MSGeek.
0
 
macpianoAuthor Commented:
Probably using the DHCP addresses would be pretty current so maybe that would be the route. I could export to Excel and sort by alphabet and that should do it.

thanks
Gary
0
 
marc_nivensCommented:
I think I've got an easy resolution for this:

1.  Launch ADU&C
2.  Click on View, Filter Options, Create Custom, Customize, Advanced Tab.

You're going to enter an LDAP filter thats something like this:

(whenChanged<=20031114004054.0Z)

The above example can be broken out to read 2003 11 14 00 40 54, or 11/14/2003 at 00:40:54.  Use the format
above to pick your date and be sure you append the .0Z as well.

3.  Browse to the computers container

You should now only see computers that were last modified before the date you put in.  You can make the choice whether to delete them or not, but this will give you a list of computers that haven't been changed since the date you pick.

0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
MSGeekCommented:
marc_nivens.. that's a great simple straight forward solution.  I have to admit I have not played around with Active Directory's filtering capabilities, but will be experimenting with them.  

I will caution, I do not believe the whenchanged attribute is replicated between DCs.  There fore if you are going to implement Marc_Nivens advice, I would recommend checking all your DCs.  Still a great tip.  MSGeek.
0
 
marc_nivensCommented:
You know, I completely overlooked that... you made me start thinking so I did some more research on the topic.  I found the following from http://www.activxperts.com/activmonitor/windowsmanagement/adsi/ under the Extracting Computer Information section:

<paste>
Network Administrators have always wanted an easy way to get a list of network workstations along with operating system and service pack information. You can now do this by using new attributes on Windows 2000 computer accounts to identify the computer's current status. The computer object is now automatically updated with information (from the netlogon service during secure channel setup) about the client's operating system, operating system version, and service pack level. You can identify unused or possibly inactive computer accounts; accounts that have never been used do not have the operating system and version attributes set. If the whenChanged attribute is more than a month old, the computer probably is not active on a network making periodic password changes. The whenChanged attribute is a non-replicated attribute which means it is calculated on each DC. The lastLogon attribute is not replicated between DCs; to determine the last logon time you have to examine it on all DCs.
</paste>

So it appears that you were absolutely right, but it seems to be ok to use this method.  I'll say caveat emptor as I've never actually used this method to clean up accounts.  MSGeek, thanks for keeping me honest :-)
0
 
MSGeekCommented:
marc_nivens.. we're all after the same answer, the one that works.  Jut call me anal retentive, not really out to keep anyone enything, just solving problems is my gig.
0
 
macpianoAuthor Commented:
So I guess I have asked a very important question. It's important because most utilities such are virus servers and patch servers look at the domain to do their thing. Extra names means wasted efforts. I am in the process of changing our dhcp scope to about 1000 addresses instead of 30,000 that my prdecessor had in. Makes quicker work to find stuff. Well if anyone comes up with a good tool, even one that i have to buy that would be great.

Gary
0
 
macpianoAuthor Commented:
I ended up using the tool Hyena which listed all the computers in the domain by the last password change which I understand is a function of the operating system not the user changing the password. The system changes every 30 days. I just lined up the computers that were 2 months old, deselected those that I knew were laptops that hadn't logged in for a while and poof I reduced 3300 names in AD to about 1900.

For me case closed.
Gary
0
 
MSGeekCommented:
Gary.. thanks for the update.

Moderator.. I am ok with a refund as long as this is PAQ'd.
0
 
mk30363Commented:
Hi everybody, trying to clean up my AD, i've got a few questions:
What about if the Full Name is missing (Computer$) ?
What about Users connecting remotly? (Through 56K Modem, does the computer account change ?)

Thanks

Mike
0
 
MSGeekCommented:
mk30363.. Mike.. I see you are fairly new to EE.  Welcome. If you have a question you need to post it on your own.  It's not right to piggy backsomeone elses question.   PLease post your own question.  Thanks,  MSGeek
0
 
moduloCommented:
PAQed, with points refunded (500)

modulo
Community Support Moderator
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

  • 5
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now