Find Old Computers – Using PowerShell with LastLogonTimestamp

Posted on October 6, 2011 by Matt Vogt

[updated with optimization from comment from JR]

Cleaning up Active Directory is a necessary evil. You need to stay under your CAL count and it can be difficult to figure out which computers (or users) have not logged in to the domain recently.

Windows Server 2003 introduced the lastLogonTimestamp attribute which replicates between all DCs in the domain. Now, this isn’t real-time data. In fact it can be up to 14 days behind the current date, depending on your domain settings. If you want that, you’re going to have to get yourself a good syslog server, but for general cleanup and auditing purposes it works great. You can read more about this attribute on Microsoft’s TechNet Blog.

I’ve written a couple very simple PowerShell scripts that will 1) search the entire domain for all computers with a lastLogonTimestamp before a certain date 2) return a computer’s lastLogonTimestamp value in a human readable local format. It’s not so easy to just go out and get the time stamp, because the format that AD stores it UTC (GMT) format, so it needs some converting to human readable, which my scripts do.

get_lastLogonTimestamp_from_host.ps1


# Gets host and lastLogonTimestamp in UTC of specified host

# get Name
$hostname = Read-host "Enter a hostname"

# grab the lastLogonTimestamp attribute
Get-ADComputer $hostname -Properties lastlogontimestamp |

# output hostname and timestamp in human readable format
Select-Object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}

———————————————————–

get_stale_hosts_lastLogonTimestamp.ps1


# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

$time = Read-host "Enter a date in format mm/dd/yyyy"
$time = get-date ($time)
$date = get-date ($time) -UFormat %d.%m.%y

# Get all AD computers with lastLogonTimestamp less than our time
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp |

# Output hostname and lastLogonTimestamp into CSV
select-object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv .all_old_computers_timestamps_older_than-$time.csv -notypeinformation

These are two scripts that I use pretty often when I’m trying to determine if I should disable/delete computer accounts in AD. Hope it helps someone else.

27 thoughts on “Find Old Computers – Using PowerShell with LastLogonTimestamp”

Chase on October 6, 2011 at 2:42 pm said:

I’ve been using ‘dsquery computer -inactive’. Is this method more accurate? I’ve often been puzzled by some of the computers that come up under that query.
Anonymous on October 6, 2011 at 3:16 pm said:

I believe that "-inactive" queries the pwdLastSet attribute which is not replicated across all domain controller and it can be as much as 30 to 60 days off depending on domain settings (when you have computers renewing their "passwords"). But I could be wrong. I just never got great results from that command. Also, PowerShell give so much more flexibility in output formatting :)
Dominic Johnson on April 20, 2012 at 4:21 am said:

mate, thanks so much for this! legendary stuff
Matt Vogt on April 20, 2012 at 4:33 am said:

Thanks, Dominic.
Joe on December 7, 2012 at 4:26 pm said:

When I run the get_stale_hosts_lastLogonTimestamp.ps1 script most of my machines report the following stamp 12/31/1600 7:00:00 PM. What does this stamp mean?
Mike on December 12, 2012 at 3:29 pm said:

I had to tweak this just a little for my specific needs but this helped me out a lot. Thanks.
Matt Vogt on December 12, 2012 at 3:44 pm said:

Joe – That means that a null value is in the fieldMike – Glad it helped :)
Suggestion on February 4, 2013 at 12:59 pm said:

Great script, only thing I would change is the end fo the line to:export-csv .all_old_computers_timestamps_older_than-$time.csv -notypeinformationThe headers then look right in Excel and you can run the report for several different dates without it overwriting the original file.
Matt Vogt on February 8, 2013 at 10:56 pm said:

Great suggestion, thanks! I’ve updated the script.
JR on April 4, 2013 at 12:44 pm said:

Specifying your Filter and Properties up front through Get-ADComputer should be easier on your DCs and your script won’t need to check every computer since you’ll already have the records you want.

$time = Get-Date ($time)
Get-ADComputer -Filter {LastLogonTimeStamp -gt $time} -Properties LastLogonTimeStamp

For example, the above takes me 9.4 seconds to return about 3874 records (we haven’t cleaned up in a while). An unfiltered return of all records takes 13.9 seconds for 6327 records. Getting all computers and then getting the LastLogonTimeStamp through Get-ADObject took nearly 7 minutes.
JR on April 4, 2013 at 3:01 pm said:

Or use the correct operator “-lt”. Duh on my part. Another AD quick AD search option the Internet reminded me of is this: “Search-ADaccount -AccountInactive -Timespan 90:00:00:00 -ComputersOnly” where 90 is the number of days the computer has been inactive. That runs in about the same time as the date filtered query from Get-ADComputer.
- Matt Vogt on May 9, 2013 at 9:55 am said:
  
  Thanks, JR! I don’t pretend to be an Powershell expert, so I appreciate the optimization help. This was one of the first useful scripts I had ever written and I’ve never gone back to refine it :)
Maarten Vekens on June 7, 2013 at 7:00 am said:

Thanks for this great topic!

I used this:

Get-ADComputer -SearchBase “ou=Desktop,ou=Workstations,ou=Computers,ou=XXX,ou=XXX,dc=XXX,dc=XXX,dc=XXX,dc=XXX” -filter * -Properties LastLogonTimeStamp | Select-Object Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}
Tilo on August 27, 2013 at 12:29 pm said:

i mod you powershell to this:

# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

import-module activedirectory
$domain = “mydom.dom.com”
$DaysInactive = 90
$time = (Get-Date).Adddays(-($DaysInactive))

# Get all AD computers with lastLogonTimestamp less than our time
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp |

# Output hostname and lastLogonTimestamp into CSV
select-object Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv OLD_Computer.csv -notypeinformation
Tilo on August 27, 2013 at 1:00 pm said:

and for old USER

import-module activedirectory
$domain = “mydom.dom.com”
$DaysInactive = 90
$time = (Get-Date).Adddays(-($DaysInactive))

# Get all AD computers with lastLogonTimestamp less than our time
Get-ADUser -Filter {LastLogonTimeStamp -lt $time -and enabled -eq $true} -Properties LastLogonTimeStamp |

# Output hostname and lastLogonTimestamp into CSV
select-object Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv OLD_User.csv -notypeinformation
shankar on November 2, 2013 at 10:07 am said:

can you provide the script for the last login with non-domain machines
chas on December 4, 2013 at 7:16 am said:

Hi Matt,

I’ve just started looking at powershell and not too confident with scripting yet but, I need to find old machines across multiple domains and wondered if your scirpts could be modified to allow this? Thanks for explaining the original scripts so well!
Rich Weber on December 11, 2013 at 4:06 pm said:

Get-ADComputer -Filter {enabled -eq $true} -properties *|select Name, LastLogonDate, Enabled, Description| Where {[DateTime]::Now.AddDays(-90) -ge $_.LastLogonDate}
Bob Hope on February 10, 2014 at 3:12 pm said:

Excellent post, problem is that this will only get the last logon stamp from whatever DC you happen to be running it against. Here’s a challenge, modify this so that it looks at EVERY DC, then returns the most recent time stamp for xyz computer object. Make sense? I would LOVE to get that.
Anjani Kumar on March 9, 2014 at 6:07 pm said:

I am searching the same thing but with some modification. cant we run it against specific serverlist on my domain. i dont want to run it against all AD object . only want to extract from some of them. if this is possible, please help me. Thanks in Advance
- Matt Vogt on March 9, 2014 at 9:27 pm said:
  
  Anjani,
  
  you could pass a text file with the hostnames of the computers from the cmdlet “get-content” through to “get-adcomputer” using the name property as a filter to compare against the names in the file.
  get-content c:\computers.txt | % {Get-ADComputer -Filter {Name -like $_ -and LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp}
  So the whole code would look like:
  $time = Read-host “Enter a date in format mm/dd/yyyy”
  $time = get-date ($time)
  $date = get-date ($time) -UFormat %d.%m.%y
  
  get-content c:\computers.txt | % {
  
  # Get AD computers from file c:\computers and with lastLogonTimestamp less than our time
  Get-ADComputer -Filter {Name -like $_ -and LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp} |
  
  # Output hostname and lastLogonTimestamp into CSV
  select-object Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv .all_old_computers_timestamps_older_than-$time.csv -notypeinformation
Brion on March 6, 2015 at 1:41 pm said:

For some reason, NONE of this works. Run powershell as admin, then paste the script? I get a >> prompt and nothing. I run the text file saved as ps1, on my 2008 DC, nothing.
Please help
- Matt Vogt on March 16, 2015 at 10:32 am said:
  
  That usually means you’re missing a closing bracket “}” somewhere in your copy/paste. Try opening it with either Notepad++ or the PowerCLI ISE.
Royston on March 18, 2015 at 6:35 am said:

Genius work guys. I have successfully inventoried the entire farm of clients (3500 +), i have that as a CSV format, with filters to see which OS’ and SP they run, now i have also a CSV with the last logon, showing 1200+ devices that havent logged in since 2014 and going back. That is all well and good, but how am i then supposed to filter out which device types they are? I cant just go deleting all those machines, what if there are switches etc in there? If i want an accurate record of what OS’s we have, what version of IE they run etc then i need to clean up AD first otherwise i reporting on old data if the AD records of old machines are there
gonna need some more scripting work to be done here i think to ascertain exactly what is deletable! CLeaning up AD isnt easy as you can break things if you dont get it right! lol
LT.Son on August 20, 2015 at 10:59 am said:

I’ve been using you script for quite a while now (THANKS!!)

I want to move to the next level and add the ability to disable the inactive accounts.

I’ve searched and found many such scripts, but they either don’t disable any computers, or they disable CLEARLY active computers.

I’d like to restrict it to specific OS versions too. (don’t touch servers, disable XP machines)

Any pointers in that direction appreciated.
Michael Miller on April 26, 2016 at 2:26 pm said:

“.older_than-$time.csv” at the end of the second script should read “.older_than-$date.csv” since that $time variable is trying to output “:” in the file name, which isn’t allowed in Windows. $date has had -UFormat applied to it on line 5, so it works.

If you’re getting “The given path’s format is not supported” errors, this is why.
Cruz on January 10, 2017 at 2:37 pm said:

Nice.
I changed modified it to export OperatingSystem and DistinguishedName, so I can filter by OU and OS if needed,

# Get all AD computers with lastLogonTimestamp less than our time
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time -or OperatingSystem -Like ‘*’} -Properties LastLogonTimeStamp, OperatingSystem |

# Output hostname and lastLogonTimestamp into CSV
select-object Enabled, OperatingSystem, Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}, DistinguishedName| Export-Csv

Comments are closed.