I am going to be using some DSQUERY/DSMOVE scripts to clean up my AD Domin. One option is to move inactive objects to a OU that has restrictive GPOs applied to it.

Something like:

DSQUERY computer -inactive 10 | DSMOVE -newparent <distinguished name of target OU>

My question is what value defines an object, both user and computer, as "inactive" for a period of time? Is it the last time a computer was logged on to for computer accounts, and for users is it the last time that the user account logged on to a computer?

But what if, say for example, I had a web server that wasn't rebooted and or logged into for a couple of months but remain powered on and functioning as normal, would it be defined as "inactive" where as technically it's still serving web pages and so on?

Thanks for the help!


Well, if you run dsquery user /? it tells you this

-inactive Finds users that have been inactive (not logged on) for at least number of weeks.

For computers, it just says 'stale', so we can assume it's the same thing - amount of time since the domain has seen that computer account get authenticated.

For your hypothetical, I'm sure a powered-on and well-connected computer would not show up as stale. There's things like GPO refresh and Kerberos timeouts that cause activity in the background, I'm sure those would refresh whatever 'stale' counter exists.

| improve this answer | |
  • and thats what I am trying to figure out – Malnizzle Feb 26 '10 at 17:50
  • I'm sure it's not using the password last change, because dsquery comuter also has a -stalepwd flag. The likely AD values I see on a Computer object are lastLogon, lastLogonTimestamp, pwdLastSet, uSNChanged, and whenChanged. Without finding serious documentation on the dsquery computer command, it could be looking up one (or more) of any of those values to determine inactivity. – mfinni Feb 26 '10 at 18:15

This attribute should be based on lastlogonTimestamp. See post from JOE (MVP)


dsquery uses the lastLogonTimeStamp attribute. This attribute is only used in Windows Server 2003 DFL mode and is not up to the minute, it will be up to 7 days off by default.

As for Exchange resource mailboxes. There is no guaranteed clean generic way of finding which ones are in use or not. In my real job, I am a high level consultant for a Messaging Services organization and all together our teams manage literally millions of mailboxes across many of the largest companies around the world. This is a problem we have looked for some time for a guaranteed solution and there isn't one. You may be able to find something that works locally if you understand how your resource mailboxes are being used... for instance you may be able to look at tracking logs and if no mail is coming in or going out that means they aren't being used. There is a logon attribute for mailboxes, but it gets updated by the local system when it is scanning through mailboxes with AV or other items and it is also updated when others view calendars or delegated folders.


-- Joe Richards Microsoft MVP Windows Server Directory Services Author of O'Reilly Active Directory Third Edition www.joeware.net "

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.