How do most admins keep track of active computers in active directory

There has been a number of computers that are inactive. We never had any sort of master list to keep track of active or inactive computers. Now we must do some housecleaning in our active directory and remove computers that no longer exists. What do most admins do or what is there approach for house cleaning the AD environment? how would I know what machines are inactive so I can remove them from active directory

joukiejoukAsked: 2016-03-04

Who is Participating?

Experts Exchange Solution brought to you by

Enjoy your complimentary solution view.

Get this solution by purchasing an Individual license! Start your 7-day free trial.

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 28

asavenerCommented: 2016-03-04

It varies from environment to environment. Smaller environments can do with a spreadsheet. Larger environments likely have some kind of CMDB (configuration management database).

You need to decide on what should be the authoritative list, and then set up a process to periodically true-up active directory to the authoritative list.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 2

Matt DeVernaCIOCommented: 2016-03-04

At my old company we wrote a Powershell script to pull which AD Computers were inactive or have not been logged into for more than 90 days.

If a machine was inactive for more than 90 days we put it into a "disabled computer" OU, disabled the machines then if no one reached out to say they could not login within a week we deleted the computers.

LVL 99

Lee W, MVPTechnology and Business Process AdvisorCommented: 2016-03-04

You could just run (from a DC) DSQUERY Computer -inactive 13 to get a list of all computers that have been inactive for the last 13 weeks and delete them. (Once deleted, if there was a mistake, you can just add them back). Though you might take intermediate measures like putting them in an OU with a group policy attached that pops up a notice to the end user that the machine will be removed unless the end user reports to IT that it's still active.

LVL 17

E ATech LeadCommented: 2016-03-07

You may get help from this blog to keep track of inactive computers and ways to regularly clean up inactive users & computers in your Active Directory.

joukiejoukAuthor Commented: 2016-03-21

I will look into these options.

joukiejoukAuthor Commented: 2016-06-06

Hello Lee W,

I am using your method and have ran DSQUERY Computer -inactive 13 to identify inactive computers. I see the results. Is there a way to export the results to Excel?

LVL 28

asavenerCommented: 2016-06-07

FYI, that will also display disabled computer accounts.

IMO, a better way is to use powershell: https://gallery.technet.microsoft.com/scriptcenter/Get-Inactive-Computer-in-54feafde

joukiejoukAuthor Commented: 2016-06-07

Never use Powershell before, and need some help. I've placed the powershell script in the following directory of an AD server in which i plan to execute it on.