Question

Retired computer accounts in Active Directory

Hardware, OS, Servers, SQL Server, Security, Desktops, Management, Microsoft Windows, Active Directory, Lotus Domino, General Directories, Programming Languages, ASP, ASP.NET, JavaScript, Perl, VB.NET, VBScript, Visual Basic, XML, DataCenter, Desktop management applications, Altiris, Intel, LANDesk, Microsoft Systems Management Server, Tech support

I need a dependable script!!!

After several domain migrations and adding a few new sites over the past two years I have found that there are hundreds of computer accounts in Active Directory. We are a global company so tracking computer names is impossible.

Because we use several management applications (WSUS, SMS, etc.) that rely on the information that is in AD it is imperative that I find all computer accounts that have not been active for a set amount of time.

I have been struggling to confidently retrieve information from Active Directory using Vb, VBScript, Perl and ADSI. I have also used SMS Reporting but I would find that information returned from all methods to be incorrect.

I need a script that will hit AD and return a list of stale machines that have not been connected to AD or our LAN/WAN for a specified amount of time.

ALSO!!! Does anyone know how to query the network for all Windows based machines that are waiting for a reboot due to Windows Updates???

Any help would be greatly appreciated.
Thanks in advance!

We solve the problem of "what computers dont exist" by looking at SMS, AD, and McAfee EPO.

We look at the time of last machine account password set in AD, time of last SMS heartbeat, and time the machine last did a EPO Agent update. It's a SMS Report that queries AD and EPO tables replicated to SMS so posting it wont do you much good.

As far as the WindowsUpdate reboot - I think the only way to do that would be do have SMS HW Invetory collect the PendingFileRename key in the registry - most reboots would be setting that. If your updates came from SMS, you could also script a query to look at v_ClientAdvertisemntStatus.LastStateName for all advertisements of interest and see if they are waiting for reboot. I dont know if SUS would also have something similar. For all I know, maybe it has something built in to simply show you what systems want reboots.