There were times where your computer accounts removal procedures failed somewhere along the process and that all these stale accounts floating around in the A.D and affecting your SCCM system discovery. Hopefully this will at least help you to put in some sort of management for these stale accounts.
Assuming that you have the right access to A.D
Discovery - identify how many stale computer accounts.
Most organisations have separate OU for servers and workstation. To find out how many stale workstation, bring up command prompt and run the following
- dsquery computer OU=Workstations,DC=domain_name,DC=net -inactive 12 -limit 1000
(querying workstations OU and look for computers that have been inactive for 12 weeks and limit the search by 1000)
Count - Do a count of stale computer accounts.
- dsquery computer OU=Workstations,DC=domain_name,DC=net -inactive 12 -limit 5000 | find /c "Workstations"
Move - For all those stale accounts you found, move them to a specify OU
- dsquery computer OU=Workstations,DC=domain_name,DC=net -inactive 12 -limit 5000 | dsmove -newparent OU=Stale,OU=Workstations,DC=domain_name,DC=net
Now, time for you to decide what you want to do with these computer accounts in this specific OU. I would recommend leaving these computer accounts in the OU until about a year or so but put some sort of group policy to limit users from logging in and notify them to contact helpdesk for further actions.
Group policies you might want to consider is:
- Display Interactive Logon Message:
Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | Interactive Login message.
- Deny Logon Locally
Computer Configuration | Windows Settings | Security Settings | Local Policies | Local Rights Assignment
Denying logon to the computer buy display a useful message to let user knows exactly what they need to do would be a good idea.
Removing - The following will remove the stale computer accounts which are inactive for 1 year (52 weeks)
- dsquery computer OU=Stale,OU=Workstations,DC=domain_name,DC=net -inactive 52 -limit 1000 | dsrm
