We are in the process of removing old computer accounts that are in AD, where the account password is older than 60 days (currently there's over 15,000 accounts that fall into this bucket). To get this list, I've ran this simple dsquery statement to generate a list:
dsquery computer -stalepwd 60 -limit 100000 > C:\Temp\Servers.txt
We currently have GPOs in place that require computers to use BitLocker and to store their recovery keys in AD. The problem is, of the 15,000+ computer accounts that are expired, I can't delete ones that have a BitLocker in AD for archival purposes, so I need to find a way to strip down the list. The end result that I would like is a list of computer accounts that have an expired computer account password, but no BitLocker recovery key stored in AD.
Has anyone done this before or know where to start looking to get something like this accomplished?