Recently we've been given the task of identifying inactive VM's so that we can save on resources + licensing. Usually, for domain joined VM's, it would be easier for me to find out if any domain user hasn't logged into them for a length of time using a script. The issue however we've come to find is that there are a ton of VM's that are not joined to the domain for whatever reason -- the people here before me apparently didn't standardize many things.

Being that these aren't domain joined and likely have different local admin accounts, is there a way to find VM's that haven't been used in a while? For the most part, our users remote desktop into these VM's with only a few having access to use them directly via console e.g. in the vsphere client.

Appreciate any help and/or advice in advance!

  • Your question is a bit vaugue on a few things. Are these VDI VMs? Are they Win7, Win10, etc? – Cory Knutson Oct 12 '17 at 15:20
  • Yes, most of the VM's are running Windows 7 - only a few are running Windows 10. All are running on VmWare ESX hosts – n00badmin Oct 12 '17 at 15:24

You've got your work cut out for you depending on the number of VMs you need to identify. You basically have zero data to work with outside of the VM's performance history which is a terrible indicator of "inactivity" because critical systems may be largely idle most of the time.

Realistically, you need access to the OS on those VMs so you can query event logs and such. So find those admin passwords or get authorization to reset them by other means.

Other than that, there's always the "scream test". Start powering off suspected inactive VMs and see who screams. In many cases, you kill two birds with one stone. When someone screams, you now know the point of contact for the VM and can get the credentials you need to login. If no one screams, you've identified a prime candidate for removal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.