Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of removing old computer accounts that are in AD, where the account password is older than 60 days (currently there's over 15,000 accounts that fall into this bucket). To get this list, I've ran this simple dsquery statement to generate a list:

dsquery computer -stalepwd 60 -limit 100000 > C:\Temp\Servers.txt

We currently have GPOs in place that require computers to use BitLocker and to store their recovery keys in AD. The problem is, of the 15,000+ computer accounts that are expired, I can't delete ones that have a BitLocker in AD for archival purposes, so I need to find a way to strip down the list. The end result that I would like is a list of computer accounts that have an expired computer account password, but no BitLocker recovery key stored in AD.

Has anyone done this before or know where to start looking to get something like this accomplished?

share|improve this question
up vote 2 down vote accepted

Go grab "AdFind" from Joe Richards' site at and give this script a shot (obviously, spot-test the results until you're confident it's doing what you want reliably).

@echo off
for /f "usebackq delims=" %%i in (`dsquery computer -stalepwd 60 -limit 100000`) do (
    call :do_find %%i
goto end

rem Search for computer at specified DN without a Bitlocker recovery key.
adfind -b %1 -f "(msFVE-RecoveryPassword=*)" 2>NUL | find "0 Objects returned" >NUL 2>NUL 
if errorlevel 1 goto end

rem Echo DNs of computers w/o bitlocker recovery keys
echo %1


That should loop thru the computers w/ "stale" passwords checking for the presence of an object with a non-null attribute of "msFVE-RecoveryPassword" at the DN where each "stale" computer was found. If no objects were returned then no recovery password was present in the directory.

Joe Richards really deserves a pat on the back for his tools. They make life administering AD so much easier.

share|improve this answer
If you use oldcmp from joeware you can just tack on (msFVE-RecoveryPassword=*) as an additional filter and you won't need the dsquery step. If you look at the binenc section of his usage/help document, you can use adfind to do dynamic queries based on a time value (e.g. 60 days). – Brian Desmond Oct 24 '09 at 19:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.