PowerShell AD computers

Get-ADComputer works like Get-ADUser and has the same default-property limitation. OperatingSystem, OperatingSystemVersion and LastLogonDate all need requesting.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

The job this cmdlet is usually doing is finding stale computer accounts. Machines get rebuilt, decommissioned or lost, and their accounts stay in the directory indefinitely. Each one is a credential nobody is watching.

Use LastLogonDate rather than whenChanged for staleness. whenChanged moves for all sorts of reasons that have nothing to do with the machine being alive. Bear in mind the same replication caveat: lastLogonTimestamp lags by up to two weeks, so a 90-day threshold is sound and a 7-day one is not.

Before removing anything, disable and wait. Disable-ADAccount on a computer object is reversible; Remove-ADComputer is not, and a machine that has been off for four months may be a laptop belonging to someone on leave.

OperatingSystem is a useful second filter. Grouping stale accounts by OS often shows a decommissioned platform still holding a few dozen accounts, which is a cleanup with a clear owner.

What happens

The cutoff is calculated once into a variable, which keeps the comparison readable. The date filter is applied with Where-Object rather than in -Filter, because date comparisons in AD filter syntax are awkward; the enabled check still runs on the DC, so this is a reasonable split. Everything after that is presentation.

Worth remembering

OperatingSystem and LastLogonDate need -Properties.
Use LastLogonDate for staleness, not whenChanged.
Disable first and wait; Remove-ADComputer cannot be undone.
Group by OperatingSystem to find whole platforms left behind.

Primary documentation

Where-Object reference · Select-Object reference

Try it

Browser simulation · fictional data; no changes to your computer.

Command

Interactive simulation · fictional data

Finds enabled computer accounts with no logon in 90 days.

Show reference output

Sample output · fictional data, shaped like the real thing

Name      SamAccountName  Department
--------  --------------  ----------
Asha Das  adas            IT        
Nina Roy  nroy            IT

Practise this

Choose a task

Read computer accounts

Import ActiveDirectory first. Return all fictional computer-account records.

Review the lesson

Keep going

Next: PowerShell AD replication