Get-ADComputer: Getting Active Directory Computers Info via Powershell

We go on studying useful PowerShell cmdlets to interact with Active Directory. In our last article, we told about Get-AD User cmdlet that allowed to get any information about AD user accounts. Today we’ll discuss Get-ADComputer cmdlet and its use to get information about computer accounts in Active Directory.

Let’s set a practical task: using Powershell, you have to get a list of computer accounts not registered in the domain network for more than 120 days (inactive computers) and disable them.

Before using Get-ADComputer cmdlet, you have to import Active Directory Module for Windows PowerShell.

Import-Module activedirectory

Get-Help Get-ADComputer

To get information about a certain computer, specify its name with -Identity parameter:

Get-ADComputer -Identity SRV-DB01

We need to know the date of its last registration in AD, but this information is not displayed with this command. Let’s view all properties of this computer in Active Directory:

Get-ADComputer -Identity SRV-DB01 -Properties *

As we can see, the last logon date (LastLogonDate) is 21.09.2015 0:20:17

Remove all unnecessary information leaving only values of Name and LastLogonDate fields.

Get-ADComputer -identity SRV-DB01 -Properties * | FT Name, LastLogonDate -Autosize

Then you have to modify the command so that it displayed the necessary information about all computers in the domain. To do it, replace –Identity to -Filter:

Get-ADComputer -Filter * -Properties * | FT Name, LastLogonDate -Autosize

To display the information about the computers in a certain OU, use SearchBase parameter:

Get-ADComputer -SearchBase ‘OU=Paris,DC=woshub,DC=loc’ -Filter * -Properties * | FT Name, LastLogonDate -Autosize

Sort the request results by the date of the last logon using Sort command.

Get-ADComputer -Filter * -Properties * | Sort LastLogonDate | FT Name, LastLogonDate -Autosize

So, we have got the list of computers and the date of their last log to Active Directory domain. Now we need to disable the computer accounts not used for 120 days or more.

Using Get-Date we get the value of the current date in the variable and reduce it by 120 days:

$date_with_offset= (Get-Date).AddDays(-120)

The variable containing the date can be used as a filter of Get-ADComputer query in LastLogonDate field

Get-ADComputer -Properties LastLogonDate -Filter {LastLogonDate -lt $date_with_offset } | Sort LastLogonDate | FT Name, LastLogonDate -Autosize

So we have got the list of computers not registered in the network for more than 120 days. Using Disable-ADAccount, disable them.

Get-ADComputer -Properties LastLogonDate -Filter {LastLogonData -lt $datecutoff} | Set-ADComputer -Enabled $false

Here are some useful tricks for Get-ADComputer

To get the number of all computer accounts in Active Directory:

Get-ADComputer -Filter {SamAccountName -like "*"} | Measure-Object

To select all computers running Windows XP:

Get-ADComputer -Filter {OperatingSystem -like '*XP*'}

To select only server systems:

Get-ADComputer -Filter { OperatingSystem -Like '*Windows Server*' } -Properties OperatingSystem | Select Name, OperatingSystem | Format-Table -AutoSize

The results of the command can be exported to a plain text file:

Get-ADComputer -Filter { OperatingSystem -Like '*Windows Server*' } -Properties OperatingSystem | Select Name, OperatingSystem | Format-Table -AutoSize C:\Script\server_systems.txt

Or a CSV file:

Get-ADComputer -Filter * -Property * | Select-Object Name,OperatingSystem,OperatingSystemServicePack | Export-CSV All-Windows.csv -NoTypeInformation -Encoding UTF8