In 2K you would have to query every domain controller in the domain for every
computer. In K3 you can look at the lastlogontimestamp attribute but note that
it will be about 10 days out of date as it isn't constantly updated.
I wrote a tool that does computer account cleanups based on password ages on the
machine accounts which is the easiest way to do it across 2K and K3. It is
called oldcmp. You can find it on the free win32 c++ tools page of
www.joeware.net. I personally think it is the best out there but don't take my
word for it, google search for oldcmp and joeware and read what people say about it.
The program is written with my paranoid mind set which means you can't just
delete things. You have to first disable them and then after you disable them
you can delete them. My recommendation is to disable, wait a few weeks, then delete.
You can also use it to clean up user accounts as well if you use the -f option
and put in "&(objectcategory=person)(objectclass=user)".
joe
