Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Windows Domain I manage has hundreds of computer names which I don't recognise and I'd like to remove old ones which aren't in use before trying to track down the misnamed ones.

Is there someway to see when the last time a machine logged onto the network? Either via dhcpd or a user login event or something else.

share|improve this question
up vote 15 down vote accepted

You can use dsquery (technet link) to locate inactive computers:

dsquery computer -inactive 10 -limit 0

Shows computers that have been inactive for 10 weeks or more.

From dsquery computer /? (technet link)

-inactive <NumWeeks>        Finds computers that have been inactive (stale)
                            for at least <NumWeeks> number of weeks.

You can pipe the output into dsrm (technet link) if you want to remove the listing from the domain. Please note this will not bother prompting you so apply the appropriate amount of caution.

dsquery computer -inactive 10 -limit 0 | dsrm -noprompt

share|improve this answer

You can return computer accounts via DSQUERY. The example below will return computer accounts that have not logged in withing the past 4 weeks.

dsquery computer -inactive 4 -limit 0 

You can then pipe the output to a file, or simply remove them by piping to the DSRM command.

dsquery computer -inactive 4 -limit 0 | dsrm -noprompt

Similar functionality can be achieved via powershell I'm sure.

share|improve this answer
+1, very nice! I learn something new every day :) – pauska Mar 3 '10 at 14:15

The VB Script >here< will identify computer objects in your AD which have not had a computer password reset in a specified number of days, and then move them to an OU you can specify, as well as disable their computer accounts for you (which seems to me to be preferable to just deleting them - safer!)

I've used it before and it works just fine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.