Active Directory · Windows PowerShell 5.1
Enabled AD computer accounts with no recent logon
Which enabled computer accounts in Active Directory have not logged on in the last 90 days (or the number of days you pass)?
Script
#Requires -Modules ActiveDirectory
# Enabled computer accounts whose LastLogonDate is older than -Days (or empty). Read-only.
param(
[int]$Days = 90
)
$cutoff = (Get-Date).AddDays(-$Days)
Get-ADComputer -Filter * -Properties LastLogonDate, OperatingSystem, PasswordLastSet |
Where-Object { $_.Enabled -and ($null -eq $_.LastLogonDate -or $_.LastLogonDate -lt $cutoff) } |
Sort-Object LastLogonDate |
Select-Object Name, OperatingSystem, LastLogonDate, PasswordLastSet, DistinguishedName
Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.
Where to run it
A domain-joined machine with the Active Directory module (RSAT) installed.
Reading the output
- LastLogonDate is derived from the lastLogonTimestamp attribute, which is replicated between domain controllers but is not updated on every logon, so treat it as approximate.
- Accounts that have never logged on (no LastLogonDate) are included.
Sources
The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.