Managing stale computer accounts in Active Directory is a common pain point for Windows administrators. When you inherit a domain with hundreds of computer objects, distinguishing active systems from legacy ones becomes critical before performing any cleanup operations.

Here's a robust PowerShell script that retrieves last logon timestamps from all domain computers:

# Import Active Directory module
Import-Module ActiveDirectory

# Get all computer objects with lastLogonTimestamp
$computers = Get-ADComputer -Filter * -Properties LastLogonTimestamp,OperatingSystem,Enabled 

# Convert timestamp to readable format
$currentDate = Get-Date
$inactiveThreshold = $currentDate.AddDays(-90) # 90-day threshold

$inactiveComputers = $computers | Where-Object {
    if($_.LastLogonTimestamp) {
        $lastLogon = [datetime]::FromFileTime($_.LastLogonTimestamp)
        $lastLogon -lt $inactiveThreshold
    } else {
        $true # Treat computers without timestamp as inactive
    }
} | Select-Object Name,Enabled,
    @{Name="LastLogon";Expression={[datetime]::FromFileTime($_.LastLogonTimestamp)}},
    OperatingSystem

# Export to CSV for review
$inactiveComputers | Export-Csv -Path "InactiveComputers.csv" -NoTypeInformation

For environments without PowerShell access, consider these methods:

• Event Log Analysis: Search Security logs for Event ID 4624 (successful logon) with Logon Type 3 (network)
• DHCP Lease Tracking: Correlate computer names with recent DHCP leases
• AD LastLogon vs LastLogonTimestamp: Understand the replication differences between these attributes

Before deleting any objects:

1. Move inactive computers to a dedicated OU first
2. Disable accounts for 30 days before deletion
3. Use the Search-ADAccount -AccountInactive cmdlet for additional verification

For ongoing management, create a scheduled task that runs this script monthly and notifies you of stale computers:

# Scheduled task version with email notification
$report = Get-InactiveComputers -ThresholdDays 60
if($report) {
    Send-MailMessage -To "admin@domain.com" -Subject "Stale Computer Report" -Body ($report | Out-String)
}

Managing an Active Directory domain with hundreds of computer objects becomes challenging when you can't identify which are still active. Before attempting to rename or reorganize misnamed systems, it's crucial to first remove obsolete computer accounts that haven't connected to the domain in months or years.

The most direct approach is using PowerShell to extract last logon information from Active Directory:

# Get all computers and their last logon timestamp
$computers = Get-ADComputer -Filter * -Properties LastLogonDate,OperatingSystem,Enabled | 
             Where-Object {$_.Enabled -eq $true} |
             Select-Object Name,LastLogonDate,OperatingSystem

# Filter computers inactive for more than 90 days
$staleThreshold = (Get-Date).AddDays(-90)
$inactiveComputers = $computers | Where-Object {$_.LastLogonDate -lt $staleThreshold}

# Export results to CSV
$inactiveComputers | Export-Csv -Path "C:\Temp\InactiveComputers.csv" -NoTypeInformation

For Windows DHCP servers, you can cross-reference computer accounts with recent DHCP leases:

# Get all DHCP leases from the server
$leases = Get-DhcpServerv4Lease -ComputerName DHCP-SERVER-NAME -ScopeId SCOPE-ID

# Compare with AD computer accounts
$activeComputers = $leases | Where-Object { $_.HostName -ne $null } | Select-Object -ExpandProperty HostName
$adComputers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name

# Find computers in AD but not in recent DHCP leases
$staleComputers = Compare-Object -ReferenceObject $adComputers -DifferenceObject $activeComputers | 
                 Where-Object { $_.SideIndicator -eq "<=" } | 
                 Select-Object -ExpandProperty InputObject

For more granular tracking, examine domain controller security logs for authentication events:

# Query security logs on all DCs for computer authentication events
$dcs = Get-ADDomainController -Filter *
$logonEvents = foreach ($dc in $dcs) {
    Get-WinEvent -ComputerName $dc.HostName -LogName Security -FilterXPath 
    "*[System[EventID=4624] and EventData[Data[@Name='LogonType']='3']]" -MaxEvents 1000 | 
    Where-Object { $_.Properties[5].Value -like "*$" } # Filter for computer accounts
}

# Extract computer names and last logon times
$computerLogons = $logonEvents | ForEach-Object {
    [PSCustomObject]@{
        ComputerName = $_.Properties[5].Value.TrimEnd('$')
        LastLogon = $_.TimeCreated
        SourceDC = $dc.HostName
    }
}

# Group by computer and get most recent logon
$lastLogons = $computerLogons | Group-Object ComputerName | ForEach-Object {
    $_.Group | Sort-Object LastLogon -Descending | Select-Object -First 1
}

Once you've identified stale computers, you can automate their removal with a script like this:

# Disable (not delete) inactive computers first
$inactiveComputers | ForEach-Object {
    Disable-ADAccount -Identity $_.DistinguishedName
    Write-Host "Disabled computer: $($_.Name)"
}

# After verification, proceed with deletion
$inactiveComputers | ForEach-Object {
    Remove-ADComputer -Identity $_.DistinguishedName -Confirm:$false
    Write-Host "Deleted computer: $($_.Name)"
}

• Implement a scheduled task to run these checks monthly
• Always disable accounts before deletion as a safety measure
• Maintain documentation of your cleanup process
• Consider implementing a computer lifecycle policy
• Use Organizational Units to separate different computer types