Finding expired computers in AD

As domains grow and change, one of the largest polluters of AD is expired machine accounts. Whenever a computer is joined to the domain, a machine account is created. However, when a machine is retired, the machine account is often left. There are no built-in tools to remove these machine accounts from the domain, and unlike user accounts, they are rarely audited. This becomes a problem as the environment grows, and auditing of the computer accounts becomes difficult.

This recipe will show how to search AD for expired, or nearly expired, machine accounts.

How to do it...

Carry out the following steps to find expired computers in AD:

1. To find recently aged accounts execute the following code:

   $30Days = (Get-Date).AddDays(-30)
   Get-ADComputer -Properties lastLogonDate -Filter 'lastLogonDate -lt $30Days' | Format-Table Name, LastLogonDate 

2. To find older accounts execute the following code:

   $60Days = (Get-Date).AddDays(-60)
   Get-ADComputer -Properties lastLogonDate -Filter...