How can I use Active Directory queries to see if a computer has not been logged into for 30/60 days

Posted on 2006-04-19
Last Modified: 2013-12-23
I have ran queries in my OU to check which users have not logged in for 30/60/90 days. Does anyone know how to check to query computer objects that have not logged in for 30/60/90 days etc Windows Server 2003 and active directory tools?
Question by:jbell72
    LVL 82

    Expert Comment

    You can do that with dsquery.exe:
    dsquery computer domainroot -limit 0 -inactive <number of weeks>
    will give a list of computers that haven't logged on in <number of weeks> weeks.
    LVL 32

    Expert Comment

    Hi jbell72,

     Or alternatively you can use a VBScript to do it from any machine with admin priv.

    On Error Resume Next

    DomainString=Inputbox("Enter the domain name","Check Active Computers","DomainName")

    if DomainString="" then
    wscript.echo "No domain specified or script cancelled."
    end if

    numDays=InputBox("What is the number of days to use as a cutoff for" & _
    "Active Computer Accounts?","Check Active Computers","XX")

    if numDays="" then
    wscript.echo "No cutoff date specified or script cancelled."
    end if

    Set DomainObj = GetObject("WinNT://"&DomainString)

    if err.number<>0 then
    wscript.echo "Error connecting to " & DomainString
    end if

    DomainObj.Filter = Array("computer")
    Wscript.echo "Computer Accounts in " & DomainString & " older than " & _ numDays & " days."
    For each Computer in DomainObj
    Set Account = GetObject("WinNT://" & DomainString & "/" & Computer.Name & _  "$")
    RefreshTime = FormatNumber((Account.get("PasswordAge"))/86400,0)
    If CInt(RefreshTime) >= CInt(numDays) Then
    wscript.echo "**DELETE** " & Computer.Name & " Password Age is " & _ RefreshTime & " days."
    End If

    set DomainObj=Nothing
    set Shell=Nothing


    Author Comment

    I was looking for a rather simple approach using the AD tools. With users I can check who hant logged in in 60 days run the query and simply select all and then disable or delete. Can it not be dun in AD tools like this. Thaks for all ur answers as well.
    LVL 37

    Expert Comment

    by:Bing CISM / CISSP
    you may consider to write a batch file or a piece of script to jointly use DSQUERY and NET USER.
    LVL 82

    Accepted Solution

    You can pipe the dsquery result directly to dsrm:
    dsquery computer domainroot -limit 0 -inactive 8 | dsrm
    This should ask for each account inactive for more than 8 weeks if you want to delete it. For an automatic removal, add -noprompt.
    If you want to be on the safe side, export the dsquery result to a text file ("remove.txt" in this example):
    dsquery computer domainroot -limit 0 -inactive 8 >remove.txt
    Then edit the file and make sure only accounts you want to remove are in the list.
    Then run
    type remove.txt | dsrm -noprompt

    Author Comment

    This is great thanks, does anyonw knowhow to search just 1 OU not the entire domain?

    Author Comment

    never mind got. How do I close a question?

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Greetings, Experts! First let me state that this website is top notch. I thoroughly enjoy the community that is shared here; those seeking help and those willing to sacrifice their time to help. It is fantastic. I am writing this article at th…
    The Need In an Active Directory enviroment, the PDC emulator provide time synchronization for the domain. This is important since Active Directory uses Kerberos for authentication.  By default, if the time difference between systems is off by more …
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now