Retrieve the List of Old Domain Computer Accounts : Hacking Tricks

Finding inactive computer accounts in Active Directory is a chore—unless, of course, you script it.

If you need to quickly retrieve a list of old (inactive) computer accounts in the domain, VBScript is your utility of choice. The script in this hack first asks for the domain name (Figure 2-1), then prompts for the number of days for active computer accounts (Figure 2-2), and then, finally, displays the old computer accounts that are found in the domain.

Step 1 Specifying the name of your domain

Step2 Specifying number of days for cutoff

The computer accounts shown have not been active during the days you specified. For example, when we run the script we can see that the computer account for the machine named SRV111 has a password whose age is beyond the cutoff, so the script recommends that you delete this account to be safe (Figure 2-3).

Step 3 Recommending an account that should be deleted

This is a great, quick way to find those computers that could be having trouble authenticating, or those that have been brought down but remain in the domain's list.

The Code

Type the following code into Notepad (make sure Word Wrap is turned off), and save it with a .vbs extension as DeleteOldComputers.vbs:

On Error Resume Next



DomainString=Inputbox("Enter the domain name","Check Active Computers","DomainName")



if DomainString="" then

wscript.echo "No domain specified or script cancelled."

wscript.quit

end if



numDays=InputBox("What is the number of days to use as a cutoff for" & _

"Active Computer Accounts?","Check Active Computers","XX")



if numDays="" then

wscript.echo "No cutoff date specified or script cancelled."

wscript.quit

end if



Set DomainObj = GetObject("WinNT://"&DomainString)



if err.number<>0 then

wscript.echo "Error connecting to " & DomainString

wscript.quit

end if



DomainObj.Filter = Array("computer")

Wscript.echo "Computer Accounts in " & DomainString & " older than " & _ numDays & " days."

For each Computer in DomainObj

Set Account = GetObject("WinNT://" & DomainString & "/" & Computer.Name & _  "$")

RefreshTime = FormatNumber((Account.get("PasswordAge"))/86400,0)

If CInt(RefreshTime) >= CInt(numDays) Then

wscript.echo "**DELETE** " & Computer.Name & " Password Age is " & _ RefreshTime & " days."

End If

Next



set DomainObj=Nothing

set Shell=Nothing

Wscript.quit

Running the Hack

To run this script, use Cscript.exe, the command-line script engine for the Windows Script Host (WSH). Here's some sample output when the script is run to delete computer accounts older than 90 days in the MTIT domain:

C:\>cscript.exe DeleteOldComputers.vbs

Microsoft (R) Windows Script Host Version 5.6

Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.



Computer Accounts in mtit older than 90 days.

**DELETE** NEWTEST1 Password Age is 151 days.

**DELETE** QWER Password Age is 151 days.

**DELETE** SRV211 Password Age is 97 days.

**DELETE** SRV212 Password Age is 154 days.

—Rod Trent