SERVER-022 · Script
Find Inactive Workstations
Finds computer accounts that have not contacted the domain for a set number of days, and can disable and move them.
What it does
A computer is inactive when its last contact (lastLogonTimestamp) is older than -InactiveDays, or it never contacted the domain and was created more than -NeverUsedDays ago. Domain controllers update this value roughly every 9 to 14 days, so allow for that in your threshold.
Workstations only by default; use -IncludeServers to also check server operating systems. Always skipped: computers already disabled, domain controllers, and cluster or other virtual names with a servicePrincipalName for MSClusterVirtualServer. Also skipped: members of any -ExcludeGroup and names matching any -ExcludeName pattern (wildcards allowed).
Report mode (default) lists what would be done. Apply runs -Action:
- Disable: turns the computer account off and notes the date in its description
- DisableAndMove: also moves it to -DisabledOU
A rollback CSV records each changed computer's original OU and description.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to disable, edit and move computers for Apply.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Report (default) or Apply. | Report, Apply | Report |
| Action | Disable (default) or DisableAndMove. | Disable, DisableAndMove | Disable |
| SearchBase | OU (distinguished name) to check. If empty, the whole domain. | ||
| InactiveDays | Days since last contact. Default: 90. | 90 | |
| NeverUsedDays | Days since creation for computers that never contacted the domain. Default: 30. | 30 | |
| IncludeServers | Also check computers running a server operating system. | False | |
| ExcludeGroup | Groups whose member computers are never touched. | (none) | |
| ExcludeName | Computer name patterns to skip, for example KIOSK-* or LAB-SPARE*. | (none) | |
| DisabledOU | Destination OU for DisableAndMove. | ||
| Server | Optional domain controller to use for every call. |
Exit codes
- 0 = No inactive computers, or all actions done
- 1 = Inactive computers found in Report mode, or some actions failed
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Report on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report mode changes nothing. Apply saves a rollback CSV with each computer's original OU and description. To undo, enable the computer account, move it back and restore the description from that file.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |