Post

Disabling inactive computer in Active Directory (180 days)

$DaysInactive = 181
$time = (Get-Date).Adddays(-($DaysInactive))
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -ResultPageSize 2000 -resultSetSize $null -Properties Name, OperatingSystem, SamAccountName, DistinguishedNamE | Disable-ADAccount
1. The $DaysInactive variable is set to 181, indicating the number of days of inactivity after which a computer account is considered inactive.

2. The $time variable is calculated by subtracting the number of days specified in $DaysInactive from the current date and time.

3. The Get-ADComputer cmdlet is used to retrieve computer accounts from Active Directory based on the filter {LastLogonTimeStamp -lt $time}. This filter selects computer accounts whose LastLogonTimeStamp is less than the specified $time.

4. The -ResultPageSize parameter limits the number of results returned per page to 2000.

5. The -resultSetSize $null parameter ensures that all results are retrieved.

6. The -Properties parameter specifies the properties to be included in the output, such as Name,
OperatingSystem, SamAccountName, and DistinguishedName.

7. The retrieved computer accounts are piped to the Disable-ADAccount cmdlet, which disables
the accounts in Active Directory.

This post is licensed under CC BY 4.0 by the author.