How to find active computers

Today I was asked how many active (not just enabled) client computers there are left in our old domain waiting to be migrated to a new one. The builtin tools provide easy way to find out inactive computers but not the active ones. By default computers are required to changed their password every 30 days so we can use that information to determine which are the active ones. There are actually couple of ways to find active computers in the domain. The hard way is that you could find all client computers in the domain and then compare the list to all inactive computers which you can find by using:

dsquery computer [<startnode>] -inactive <number of weeks>

to get computers that have been inactive (stale) for the number of weeks that you specify or

dsquery computer [<startnode>] -stalepwd <number of days>

to find computers whose passwords have not changed for the specified number of days. This comparison requires some manual work and since we are looking for a solution that can be easily reproduced we are not satisfied. So it would be easier to just query for all computers whose  password have not changed since some day:

dsquery * [<startnode>] -filter "&(objectCategory=computer)(pwdLastSet>=date/time in Integer8-format)"

But since in the pwdLastSet attribute value is stored as a large integer that represents the number of 100 nanosecond intervals since January 1, 1601 (UTC) you have to know how to convert the last password reset date to same format before you can use it as a search condition. This conversion can easily be done by using vbscript for example. I'll leave that a homework for you to find out how this is done.

I figured out that the easiest way to find out which computers have changed their passwords within specified period is to use PowerShell:

$d = [DateTime]::Today.AddDays(-60); Get-ADComputer -Filter 'PasswordLastSet -ge $d' -Properties PasswordLastSet

These two commands show you all computers that have changed their passwords within last 60 days. And you can run them on one line instead of having to do any comparisons or date/time conversions.

And if we are only interested in the number of active computer objects we can just count them:

@($d = [DateTime]::Today.AddDays(-60); Get-ADComputer -Filter 'PasswordLastSet -ge $d' -Properties PasswordLastSet).Count

Pretty cool, right?

For Get-ADComputer cmdlet to work you'll need to have first imported Active Directory module by running

Import-Module ActiveDirectory

which contains a lot of useful cmdlets to manage AD.