asked on

Need script to move Workstations in AD

Hi All,

We have many PC's in 'Workstations' container in AD that no longer exist. This is due to poor house cleaning on our part and now we need to move them to the 'Disabled Workstations' OU. Is there a way to automate the process to move a PC based on the last time the object was modified in AD (which is the same as the machine last logon to the domain)? I want to move any workstation that has not logged into the domain 60 days or older. If so, is it possible to set this on a schedule?

Thanks guys!!

ngailfus

This can be done from the command line on the domain controller.

dsquery computer "ou=Workstations,dc=YourDomain,dc=LOCAL" | dsmove -newparent "ou=Disabled Workstations,dc=YourDomain,dc=LOCAL"

If you have nested OUs you will have to list them all from the inside out. For example, ou=Workstations,ou=Systems,ou=BranchOffice,dc=YourDomain,dc=Local

ngailfus

Sorry I didn't read the not logged in for 60 days. That may be a switch on the dsquery computer command. I'll look into it.

ASKER CERTIFIED SOLUTION

Mike Kline

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

ngailfus

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

NBquery

ASKER

thanks mkline71 & ngailfus...

Now to get greedy....sorry I didn't mention it in the OP, but I would like the scan to move the pc's into the disabled OU and then disable them at the same time. Would that be possible?

We have many workstation OUs at our company, one for each site. Can I have it scan a specified list of OU's?

ngailfus

You can use dsmod computer with a -disabled yes switch to disable all the computers in your disabled workstations OU after you move them.

dsmod computer "OU=Disabled Workstations, DC=YourDomain,DC=YourSuffix" -disabled yes

This should disable all the computer objects within that OU.

NBquery

ASKER

ngailfus,

I think I'm going to try the OldCmp tool. Anyidea if 'dsmod computer "OU=Disabled Workstations, DC=YourDomain,DC=YourSuffix -disabled yes' will work with OldCmp utility?'

What about other sites Workstation OU? Do we have to run the utility seperatly for each site Workstation OU>Disabled Workstations OU?

Mike Kline

with oldcmp you can disable in step 1 then move them in step 2, I haven't tried the combo
First disable
oldcmp -age 60 -disable -forreal
then move (will only move disabled acounts)
oldcmp -move -newparent "ou=disabled workstations,dc=yourdomain,dc=yoursuffix" -age 60 -onlydisabled -forreal
You can use the -b switch and then specify the DN of your OU but you can't put multiple OUs there because an LDAP search can have only a single base.

As a side note before disabling anything I'd first just use oldcmp to run a report. Then you will know what will be disabled just in case there are some PCs you don't want disabled.
Thanks
Mike