Stale computer script (PS)

Greetings Experts.  I have a script (thanks to EE Experts) that will audit, disable and move stale user accounts from one of my OU's.  I need to do the same thing for stale computer accounts.  I appreciate your help and contributions in advance.

Import-Module ActiveDirectory

$logPath = "C:\Tools\Logs\"  #directory to log output
$date = Get-Date
$todaysLog = $logPath + $date.Year + "_" + $date.DayOfYear + ".log"

function WriteLog($message)
{
    $message = (Get-Date).ToShortTimeString() + " - " + $message
    Add-Content -Path $todaysLog -Value $message
}

$disabledOU = "OU=Users,OU=Inactive,DC=state,DC=com"

$users = Get-ADUser -SearchBase "OU=Depts,DC=state,DC=com" -Filter * -Properties SAMAccountName, lastLogonTimeStamp | ?{[DateTime]::FromFileTime($_.lastLogonTimeStamp) -lt (Get-Date).AddDays(-49)}
foreach ($user in $users)
{
    try {
        Disable-ADAccount -Identity $user.SAMAccountName
        WriteLog("Disabled $($user.SAMAccountName)")
    } catch {
        WriteLog("Failed to disable $($user.SAMAccountName)")
    }
    
    try {
        Move-ADObject -Identity $user.SAMAccountName -TargetPath $disabledOU
        WriteLog("Moved $($user.SAMAccountName) to $disabledOU")
    } catch {
        WriteLog("Failed to move $($user.SAMAccountName) to $disabledOU")
    }
}

Open in new window

LVL 9
samiam41Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dariusz TykaICT Infrastructure Specialist Senior Commented:
Hi samiam41,

such script is already present in Microsoft galery. You can grab it from here:
https://gallery.technet.microsoft.com/scriptcenter/Move-and-disable-inactive-b1cf86c3
0
footechCommented:
You should be able to just substitute Get-ADComputer for Get-ADUser.  You may want to change some variable names accordingly.
0
Check Out How Miercom Evaluates Wi-Fi Security!

It's not just about Wi-Fi connectivity anymore. A wireless security breach can cost your business large amounts of time, trouble, and expense. Plus, hear first-hand from Miercom on how WatchGuard's Wi-Fi security stacks up against the competition plus a LIVE demo!

samiam41Author Commented:
@Ajit, thanks for the links but they didn't help.

@footech, yes, I would need to substitute the get-aduser for get-adcomputer while switching some variables.  Completely agree.  The variables are the reason for the question as I'm not sure what those variables are.

@Dariusz Tyka, checking into those now.  *Update* the script requires using quest powershell tools.  I shouldn't need to download additional tools to accomplish this task.  

Thanks experts.
0
samiam41Author Commented:
$then = (Get-Date).AddDays(-60) # The 60 is the number of days from today since the last logon.

Get-ADComputer -SearchBase "OU=Depts,DC=local" -Property Name,lastLogonDate -Filter {lastLogonDate -lt $then} | FT Name,lastLogonDate

Open in new window


working on the logging portion now
0
PberSolutions ArchitectCommented:
Try this:

Import-Module ActiveDirectory

$logPath = "C:\Tools\Logs\"  #directory to log output
$date = Get-Date
$todaysLog = $logPath + $date.Year + "_" + $date.DayOfYear + ".log"

function WriteLog($message)
{
    $message = (Get-Date).ToShortTimeString() + " - " + $message
    Add-Content -Path $todaysLog -Value $message
}

$disabledOU = "OU=Computers,OU=Inactive,DC=state,DC=com"

$computers = Get-ADComputer -SearchBase "OU=Depts,DC=state,DC=com" -Filter * -Properties DistinguishedName, SAMAccountName, lastLogonTimeStamp | ?{[DateTime]::FromFileTime($_.lastLogonTimeStamp) -lt (Get-Date).AddDays(-49)}
foreach ($computer in $computers)
{
    try {
        Disable-ADAccount -Identity $computer.DistinguishedName -WhatIf
        WriteLog("Disabled $($computer.SAMAccountName)")
    } catch {
        WriteLog("Failed to disable $($computer.SAMAccountName)")
    }
    
    try {
        Move-ADObject -Identity $computer.DistinguishedName -TargetPath $disabledOU -WhatIf
        WriteLog("Moved $($computer.SAMAccountName) to $disabledOU")
    } catch {
        WriteLog("Failed to move $($computer.SAMAccountName) to $disabledOU")
    }
}

Open in new window

2

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
samiam41Author Commented:
Knockout!

Thank you for the solid solution.  Exactly what I needed.
0
samiam41Author Commented:
If any experts have some time to show me what I'm missing on this script in the new question, I would appreciate it.  Thank you.  https://www.experts-exchange.com/questions/29072772/Modify-date-format-of-file-name-powershell.html
0
footechCommented:
Just to be clear, the variables name don't have to be changed  (i.e. it won't affect functionality).  It's just a matter of readability of the code.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.