Basically i'm trying to return a list of inactive computer accounts.

I can do that with dsquery but I also want it to show me how many days the machine has been inactive.  How can I do that?

Hi,

Take a look at these example scripts:

http://gallery.technet.microsoft.com/scriptcenter/site/search?query=inactive%20computer%20accounts&f[0].Value=inactive%20computer%20accounts&f[0].Type=SearchText&ac=2

The only way to do it is via script?  I was trying to find an attribute that would return either the number of days its been since the machine checked in with the domain or the last actual date that it did.

Well, you're asking this question in a scripting forum so...

The -Inactive parameter of dsquery computer can retrieve computers that have been inactive for a specified number of weeks. It uses the lastLogonTimeStamp attribute to determine how long computers have been inactive. However, lastLogonTimeStamp is a large (64-bit) integer representing dates as the number of 100-nanosecond intervals since 12:00 am, January 1, 1601 in UTC. The dsquery utility uses code to convert this large number into a datetime in the local time zone and calculate the number of weeks in the past. There is no provision for dsget/dsquery to output the number of weeks. The best you could do would be to use dsquery computer -Inactive to retrieve the DN of stale computers, then pipe this to dsquery * and use the -Attr parameter to output the value of lastLogonTimeStamp. But this would output the large integer, not the corresponding date/time, much less the number of weeks in the past. You would need to use a VBScript or PowerShell script to output the number of weeks.

That is exactly what I've started trying to do.

Thanks.

This is what I came up with - dsquery computer "OU=computers,DC=Me,DC=Com" -o samid -inactive 16 - limit 10000 |dsquery computer -attr SAMAccountName lastLogonTimeStamp | export-csv C:\users\me\desktop\inactive.csv.

When I try this, I get dsqyery failed attr is an unknown parameter.

But also i thought I needed to pipe the results to show the last logon, but am I supposed to call dsquery twice?

I didn't mean it in that way, I just wanted to really know if I could take a simpler one-liner maybe to reach the same results as some of the scripts goy.

You use the -Attr parameter with dsquery * rather than dsquery computer. Just replace "computer" with "*".

The following command will return a list of computer objects inactive for the previous 12 weeks. 

dsquery computer -inactive 12 -limit 2000 >c:\inactive12.txt

Hope this helps,

Mike

Search-ADAccount is probably the preferred method moving forward.