0

I am migrating around 850 existing machines from 2003 Active Directory Server from Forest A to Forest B on Server 2012 R2. Basically changing the domain name on each machine and joining to a new domain.

How can I find out if any machines are still left on the old Domain or which machines have not moved out?

1

I'm not sure what limitations there are on Powershell in Server 2003, but the following commands can be used to list all PCs in a given domain.

ps> Import-Module ActiveDirectory
ps> Get-ADComputer -Filter "Enabled -eq '$true'" | Select Name

This command will give you a quick count of active PCs:
ps> (Get-ADComputer -Filter "Enabled -eq '$true'").Count

This command will give you a quick count of inactive PCs(PCs that have been moved):
ps> (Get-ADComputer -Filter "Enabled -eq '$false'").Count

http://blogs.technet.com/b/askds/archive/2010/02/04/inventorying-computers-with-ad-powershell.aspx

http://newdelhipowershellusergroup.blogspot.com/2012/06/powershell-and-active-directory-find.html

If that fails, simply using the Active Directory snap-in and viewing the Computers node should be sufficient to see how many enabled PCs are in each domain. As you change the domain, the PCs will automatically be disabled in the old domain.

  • 1
    Unjoining an AD member computer will not delete the computer object, it will only mark it as disabled. If you disjoin a computer from a domain, the computer remains as a disabled account in Active Directory. – jscott Oct 26 '15 at 19:38
  • I've revised the code to show enabled PCs only. That should provide sufficient information to determine which PCs have not moved from the domain. Learn something new everyday! – Lee Harrison Oct 26 '15 at 19:43
  • One limitation is that 2003 servers don't have PowerShell at all by default, and can only have PS v2 at all. A more important limitation is that managing ActiveDirectory from Microsoft PowerShell commandlets requires Server 2008 R2 - technet.microsoft.com/en-us/library/dd378937(WS.10).aspx and blogs.msdn.com/b/adpowershell/archive/2009/02/25/… – TessellatingHeckler Oct 26 '15 at 20:06
  • Thanks everyone for your quick response, the problem I'm facing in Server 2003 AD is none of the computer objects are marked as "Disabled" after unjoining as a AD member, is this is due to AD replication issues? And I don't have PowerShell on it. Any suggestions? – AnPat Oct 26 '15 at 20:31
  • 1
    That's a bummer. I'd wager it isn't worth investigating either since your moving to a new domain anyway. The low-tech pen and paper solution may be the quickest way to just get this over with and forget about it. Print the list, divide and conquer with your guys based on location. Just make sure to tag PCs with something after they've been switched, then mark them off the list. At least you can see which PCs have been migrated on the new DC. – Lee Harrison Oct 26 '15 at 20:41
1

You might be able to answer it with @jscott's comment about unjoined computers having disabled computer accounts, and this dsquery command:

List all enabled computer accounts in an OU:

dsquery computer OU=Test,DC=example,DC=com -limit 5000|dsget computer -dn -disabled | find /i " no"
  • beat me to it! If running on the same domain you can omit the LDAP path from the first part of the query. – Lee Harrison Oct 26 '15 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.