--- title: "Find and Disable Every Inactive AD Computer with PowerShell" description: "Find inactive computer accounts in Active Directory with Search-ADAccount, then disable and quarantine them with PowerShell in steps you can undo." canonical: "https://adamtheautomator.com/find-inactive-computers-active-directory/" --- # Find and Disable Every Inactive AD Computer with PowerShell > Find inactive computer accounts in Active Directory with Search-ADAccount, then disable and quarantine them with PowerShell in steps you can undo. Source: https://adamtheautomator.com/find-inactive-computers-active-directory/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Find and Disable Every Inactive AD Computer with PowerShell](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81e69730da4c690758c2/4afeea42b7f854d23285b281664351779f042510f1e3a1d766d02cfa39b711a8.jpg) # Find and Disable Every Inactive AD Computer with PowerShell [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)21 October 20263 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/)[Microsoft Windows Server](/tag/microsoft-windows-server/) Table of Contents * [Prerequisites](#prerequisites) * [Find Inactive Computer Accounts with Search-ADAccount](#find-inactive-computer-accounts-with-search-adaccount) * [Set the Threshold Around the lastLogonTimestamp Lag](#set-the-threshold-around-the-lastlogontimestamp-lag) * [Preview the Change with a WhatIf Dry Run](#preview-the-change-with-a-whatif-dry-run) * [Disable the Accounts, Then Move Them to the Quarantine OU](#disable-the-accounts-then-move-them-to-the-quarantine-ou) * [Disable the Accounts](#disable-the-accounts) * [Move Them to the Quarantine OU](#move-them-to-the-quarantine-ou) * [Roll Back a Mistake and Decide What Comes Next](#roll-back-a-mistake-and-decide-what-comes-next) Suppose you disable every Active Directory (AD) computer that looks abandoned on Friday afternoon, and by Monday a sales laptop that spent the quarter in a drawer can’t sign in to the domain. One command re-enables a disabled account. Without the AD Recycle Bin, a deleted one means rejoining the machine and rebuilding its group memberships by hand. Suppose instead that every account you turned off could be turned back on in one command, from a record of where it lived. ## Prerequisites If you want to follow along, you need: * The [ActiveDirectory PowerShell module](https://learn.microsoft.com/en-us/powershell/module/activedirectory/), installed with the [Remote Server Administration Tools (RSAT)](https://adamtheautomator.com/powershell-import-active-directory/), on the machine you run from. The cmdlets used here are documented for Windows Server 2016 through 2025. * Rights to disable and move computer objects in the OUs you search. * A domain at the Windows Server 2003 functional level or higher, which `-AccountInactive` requires. * An existing quarantine organizational unit (OU). The examples use `OU=Quarantine,OU=Computers,DC=corp,DC=contoso,DC=com`; substitute your own distinguished name. ## Find Inactive Computer Accounts with Search-ADAccount Save the stale list in `$stale`, the variable every later command reads: ```powershell $stale = Search-ADAccount -AccountInactive -ComputersOnly -TimeSpan 90.00:00:00 | Where-Object Enabled $stale | Select-Object Name, LastLogonDate, DistinguishedName | Sort-Object LastLogonDate | Format-Table -AutoSize ``` | Part | What it does | | --- | --- | | `-AccountInactive` | Switches on the inactivity search | | `-ComputersOnly` | Searches computer accounts only | | `-TimeSpan 90.00:00:00` | Sets 90 days in the days.hours:minutes:seconds format | | `Where-Object Enabled` | Keeps only accounts that are still enabled | The output lists the oldest computers first, as you can see below. ![Stale computers list](https://adamtheautomator.com/wp-content/uploads/publisher/8cf499c840050346224478f1577f7d8353318c67855c86cd9a4527a26852140b.jpg) The [Search-ADAccount reference page](https://learn.microsoft.com/en-us/powershell/module/activedirectory/search-adaccount) says AccountInactive and AccountExpiring “use a default time that you can change by specifying the DateTime or TimeSpan parameter.” But its parameter table lists that default as “None”, which is why the command above sets `-TimeSpan` explicitly. ## Set the Threshold Around the lastLogonTimestamp Lag Active Directory tracks computer logons in the `lastLogonTimestamp` attribute, and it doesn’t update that attribute on every logon. The Directory Services team’s post on [how lastLogonTimestamp works](https://learn.microsoft.com/en-us/archive/blogs/askds/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works) states: “With default settings in place the lastLogontimeStamp will be 9-14 days behind the current date.” Search-ADAccount [reads LastLogonDate](https://netwrix.com/en/resources/blog/active-directory-logon-attributes/), the replicated `lastLogonTimestamp` value converted to a readable date. So yesterday’s sign-in can still look like two weeks of idle time in your table. | `-TimeSpan` | What it finds | | --- | --- | | `7.00:00:00` | Noise. It sits inside the 9 to 14 day lag, so active computers appear. | | `30.00:00:00` | Past the lag. The same post’s author says most customers they have talked to start counting accounts as potentially inactive at 30 days or more. | | `90.00:00:00` | The value used here. It tolerates laptops that spend a quarter away from the network. | * * * _**Key Insight: The 9 to 14 day lag assumes the default _**[_**ms-DS-Logon-Time-Sync-Interval attribute**_](https://learn.microsoft.com/en-us/windows/win32/adschema/a-msds-logontimesyncinterval)**_, which controls how often the timestamp updates. Check its value on your domain before you pick a threshold.**_ * * * ## Preview the Change with a WhatIf Dry Run Disable-ADAccount and Move-ADObject both support [`-WhatIf`](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters), which prints what each command would do and changes nothing. Run the preview and export the list, because a move overwrites the computer’s distinguished name and the CSV becomes your record of the original OU: ```powershell $quarantine = 'OU=Quarantine,OU=Computers,DC=corp,DC=contoso,DC=com' $stale | Select-Object Name, DistinguishedName | Export-Csv .\stale-computers.csv -NoTypeInformation $stale | Disable-ADAccount -WhatIf $stale | ForEach-Object { Move-ADObject -Identity $_.DistinguishedName -TargetPath $quarantine -WhatIf } ``` Read the output and remove any computer you know is still in use, like a kiosk that only wakes quarterly, from `$stale` before you continue: ```powershell $stale = $stale | Where-Object Name -NE 'KIOSK-01' ``` * * * _**Warning: Disable-ADAccount and Move-ADObject change production objects the moment you remove -WhatIf. Rehearse against a test OU first.**_ * * * ## Disable the Accounts, Then Move Them to the Quarantine OU With a reviewed list, run Disable-ADAccount and Move-ADObject again without `-WhatIf`. The move parks every disabled computer in the quarantine OU, where the rollback below and the 90-day review both start. ### Disable the Accounts ```powershell $stale | Disable-ADAccount ``` The [Disable-ADAccount reference](https://learn.microsoft.com/en-us/powershell/module/activedirectory/disable-adaccount) confirms the pipeline works here: “Similarly, you can use Get-ADComputer and Search-ADAccount to retrieve account objects.” The cmdlet produces no output unless you add `-PassThru`; a silent return means success. ### Move Them to the Quarantine OU ```powershell $stale | ForEach-Object { Move-ADObject -Identity $_.DistinguishedName -TargetPath $quarantine } ``` Pass the distinguished name instead of piping the objects. The [Move-ADObject reference](https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-adobject) says `-Identity` accepts “A distinguished name.” Passing `$_.DistinguishedName` keeps the move tied to the same value the CSV recorded. Confirm the result with a read-only [Get-ADComputer](https://adamtheautomator.com/get-adcomputer/) query, as the screenshot below shows: ```powershell Get-ADComputer -Filter * -SearchBase $quarantine | Select-Object Name, Enabled ``` ![Disabled quarantine OU](https://adamtheautomator.com/wp-content/uploads/publisher/949473e5bd3c67c71af330a400f4ef73e36434900bbe1727e0589d29b36dd575.jpg) ## Roll Back a Mistake and Decide What Comes Next If a user reports a dead laptop, restore it from the CSV record. [Enable-ADAccount](https://learn.microsoft.com/en-us/powershell/module/activedirectory/enable-adaccount) reverses the disable, and a second Move-ADObject returns the computer to the OU saved in `stale-computers.csv`: ```powershell # Run from the folder that holds the CSV $row = Import-Csv .\stale-computers.csv | Where-Object Name -EQ 'LT-SALES12' $originalOU = ($row.DistinguishedName -split '(?