Review stale AD computer accounts
Documentation: Microsoft Learn
Find enabled computer accounts with a recorded logon date older than 120 days and retain enough context for an owner review.
Example reviewed 1 October 2026 · Illustrative output · Not a live system check
The script
$Cutoff = (Get-Date).AddDays(-120)
Get-ADComputer -Filter 'Enabled -eq $true' -Properties LastLogonDate, OperatingSystem -ErrorAction Stop |
Where-Object { $_.LastLogonDate -and $_.LastLogonDate -lt $Cutoff } |
Select-Object Name, OperatingSystem, LastLogonDateScript reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Fictional reference snapshot · 03 October 2026, 09:00 UTC. This is an example result, not a check of your systems.
Name OperatingSystem LastLogonDate ---- --------------- ------------- LAB-OLD1 Windows 11 Pro 01/04/2026 08:00:00
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Cutoff = (Get-Date).AddDays(-120)
Get-ADComputer -Filter 'Enabled -eq $true' -Properties LastLogonDate, OperatingSystem -ErrorAction Stop |
Where-Object { $_.LastLogonDate -and $_.LastLogonDate -lt $Cutoff } |
Select-Object Name, OperatingSystem, LastLogonDate- Stage 1$Cutoff
Positional values or no named parameters - Stage 2Where-Object
Positional values or no named parameters - Stage 3Select-Object
Positional values or no named parameters
Illustrative output
This example shows the expected shape for fictional data. Your values and formatting will differ.
Name OperatingSystem LastLogonDate PC-042 Windows 11 Enterprise 2026-04-21 07:45:00
How it works
The report keeps enabled accounts whose recorded date falls before the cutoff. The fictional row qualifies as of 1 October 2026. OperatingSystem helps distinguish types of devices, but does not prove whether they are still in service.
Before you run it
Use the ActiveDirectory module and suitable read access. Replicated logon data may lag activity. Seasonal, disaster-recovery and offline devices require additional context.
Check the result
Compare with inventory, endpoint management and the owner’s records. Export candidates for review. Do not pipe this discovery report straight into Disable-ADAccount or delete accounts solely because their timestamp is old.
If nothing is returned
No returned enabled computer with a recorded date matched the filter. Missing dates are excluded and should be reviewed separately.