AD cleanup

[Guest]

Hello,

I would like to know whether it is safe to move all computers from the
default "Computers" container to a newly created OU "Computers"? More than
that, there are lots of orphan/disabled computer accounts in the "Computers"
container, I want to know if there are some tools to filter and delete those
orphan/disabled computer accounts.

Many thanks.

 

[Myweb]

Hello Pakeon,

- Moving computers to a new OU is no problem. But be aware, that if you have
create a new GPO for this OU the workstations will use this configured settings.
Also check, if theire are maybe member servers in.

- Orphaned objects you normally find in the LostandFound container and not
in computers, how are they marked that you see it?

- The questions is who has disabled the computers and why? Find it out BEFORE
deleting them, for e.g. if the workstations are broken or sold, then you
just can delete them.

Best regards

Myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

 

[Joe Richards [MVP]]

Moving computers should pose no issues unless someone has hardcoded a
script or program to point at one of the DNs of the computers.

As for finding old computer accounts, you may want to look at oldcmp at

http://www.joeware.net/win/free/tools/oldcmp.htm




--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

 

[Guest]

Hello,

- Orphaned objects you normally find in the LostandFound container and not
in computers, how are they marked that you see it?

Some computers were installed and joined the domain but later then were
simply unplugged from the network and formatted. Such cases have been
appearing from time to time. There are many computer accounts created in the
AD but actually they are not used. That's why I raise this question on how to
determine how long the computer has not contacted with the AD. If I can find
them out, then I can delete them from the AD.

Any idea?

Thanks in advance.