通过利用 lastLogonTimestamp 属性移动不活动的 AD 计算机

Question

I am working on a Powershell script to automate AD maintenance, and move inactive AD computers by leveraging the lastLogonTimestamp attribute from one specific OU to another in windows 2008 R2.

However, while running the script, i keep getting the following error. I am stumped, and would appreciate any input on why this script is complaining about this.

Move-ADObject : Cannot validate argument on parameter 'Identity'. The argument is null. Supply a non-null argument and try the command again.

Below is the part of the script that throwing the above error:

### Find and all inactive computer objects

import-module activedirectory 
$domain = "XXXXX.XXXXX.XXXXX" 
$DaysInactive = 120
$time = (Get-Date).Adddays(-($DaysInactive))
$pwdset = (Get-Date).AddDays(-($DaysInactive))

### Get all AD computers with lastLogonTimestamp less than our time    
$OldComputers = Get-ADComputer -Filter {LastLogonTimeStamp -le $time} -Properties lastlogontimestamp |
Where-Object {
$_.DistinguishedName -like "OU=Source OU,DC=XXXX,DC=XXXX,DC=XXXX"
}

## Output computer accounts to be disabled to HTML table
$OldComputersLog = $OldComputers | ConvertTo-HTML lastlogontimestamp `
-title "Computer Accounts that will be deleted" `
    -head $head `
    -body "<H2><center>Moved and disabled computers for more than 120 days</center></H2>"| `
out-file C:\AD\move\OldComputers.html

### Move inactive computers to disabled OU
$OldComputers | Disable-ADAccount |Move-ADObject -TargetPath "OU=Destination OU,DC=XXXX,DC=XXXX,DC=XXXX"

Answer 1

Looks like Disable-ADAccount doesn't output an ADobject. Try adding -PassThru

$OldComputers |
Disable-ADAccount -PassThru |
Move-ADObject -TargetPath "OU=Destination OU,DC=XXXX,DC=XXXX,DC=XXXX"

Answer 2

Here's an earlier thread to get Inactive computers in a specific domain's OU based on Last Logon Time Stamp.

Import AD Module

Import-Module ActiveDirectory

define the time window --- we specify 90 days plus the official windows lag of 14 days

$time = (Get-Date).Adddays(-104)

Check for existence of OU and create if not present

[string] $Path = 'OU=OUName,DC=domain,DC=com'
try
{
    if (!([adsi]::Exists("LDAP://$Path")))
    {
        #Create OU since it does not yet exist
        NEW-ADOrganizationalUnit “StaleComputers” –path “OU=SomeOU, DC=domain, DC=com”
    }
    else { Write-Debug "OU Already Exists:  $Path" }
}
catch [Exception]    {
    return $_.Exception.Message
}

now we proceed to check for computers

Get-ADComputer -Filter { LastLogonTimeStamp -lt $time } | Move-ADObject -TargetPath $Path -WhatIf

Now we check for inactive computers that are inactive

Search-ADAccount -accountinactive -ComputersOnly | ? { $_.lastlogondate -lt $time } | Move-ADObject -TargetPath $Path -WhatIf

There are some attributes that help you decide if an AD user account or computer account is active or inactive. These attributes are LastLogon and LastLogonTimeStamp.

On the other-hand, In order to suspect potential accounts that are inactive, you can perform the following steps -:

-Check for those user accounts where the computer account password has not been reset for over a considerable period of time, say for 30 days, 60 days or 90 days. -Obtain a list of all machines in a table that have not had a password reset in over 90 days including the Name, Distinguished Name and Password Last Set Date and Time. -You can also use the following 'dsquery' commands to detect inactive user and computers accounts in your AD.

To find out users who haven't logged in into their accounts from past few weeks, you can run the following dsquery command.

dsquery user –inactive

To get in detailed refer to this link: https://www.linkedin.com/pulse/cleaning-up-obsolete-user-computer-accounts-from-active-ajit-singh

Hope this helps!

Answer 3

Import-Module ActiveDirectory

$SourceOU= "OU=Destination OU,DC=XXXX,DC=XXXX,DC=XXXX"

$DestinationOU= "OU=Destination OU,DC=XXXX,DC=XXXX,DC=XXXX"

$lldate = [DateTime]::Today.AddDays(-90);

$computers=Get-ADComputer -Filter 'PasswordLastSet -le $lldate' -Searchbase $SourceOU

foreach ($computer in $computers){ $desc="Contact Support, disabled on $(Get-Date) - $($computer.Description)" Set-ADComputer $Computer -Description $desc -Enabled $false
Move-ADObject $computer -TargetPath $destinationOU Add-Content C:\\PShell\\computers.txt -Value "Found $computer, Moved and disabled" }