Inactive AD computers, also called stale computer accounts, are domain-joined devices that have not authenticated to the domain within a defined period. Their presence adds noise to security reporting and expands the attack surface, since an attacker who compromises a stale machine can still exploit its existing domain trust relationship. Identifying them regularly is a core part of any Active Directory cleanup workflow.
PowerShell locates inactive computers by filtering on the lastLogonTimeStamp attribute using Get-ADComputer. Unlike lastLogon, which updates on each authenticating domain controller (DC) but does not replicate across DCs, lastLogonTimeStamp replicates to all DCs. By default, lastLogonTimestamp is updated periodically rather than at every authentication. Its default update interval is approximately nine to 14 days, after which the updated value is replicated across the domain. In environments with multiple domain controllers, querying lastLogon on a single DC would miss authentication activity recorded by other DCs, making lastLogonTimeStamp the correct attribute to use for domain-wide inactive computer detection.
This article covers how to get inactive AD computers using PowerShell, Active Directory Users and Computers (ADUC), and ADManager Plus.
Import-Module ActiveDirectory
$DaysInactive = 30
$time = (Get-Date).AddDays(-($DaysInactive))
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} `
-Properties OperatingSystem, LastLogonDate |
Select-Object Name, SamAccountName, OperatingSystem, DistinguishedName, LastLogonDate |
Export-CSV "C:\Reports\InactiveComputers.csv" -NoTypeInformation
LastLogonDate in the -Properties list returns the replicated timestamp as a human-readable DateTime value in the CSV output. Name, SamAccountName, and DistinguishedName are returned by default and do not need to be included in -Properties.
To limit results to a specific organizational unit (OU), add the -SearchBase parameter with the OU's distinguished name:
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} `
-SearchBase "OU=Workstations,DC=domain,DC=com" `
-Properties OperatingSystem, LastLogonDate |
Select-Object Name, SamAccountName, OperatingSystem, DistinguishedName, LastLogonDate |
Export-CSV "C:\Reports\InactiveWorkstations.csv" -NoTypeInformation
Alternative: For basic inactive computer detection without attribute customization, Search-ADAccount -AccountInactive -ComputersOnly is a built-in alternative. It accepts a -TimeSpan parameter to define the inactivity period and a -SearchBase parameter for OU-scoped queries, though it returns fewer properties by default compared to Get-ADComputer.
| Parameter | Description |
|---|---|
| -Filter | Specifies the query criteria. Used here to match LastLogonTimeStamp against the calculated cutoff date to find computers inactive beyond the threshold. |
| -Properties | Retrieves attributes not returned in the default property set. OperatingSystem and LastLogonDate must be explicitly listed. |
| -SearchBase | Limits the query to a specific OU. Accepts the OU's distinguished name (DN) as a string. |
| -Server | Targets a specific domain controller or AD LDS instance. Useful in multi-domain environments where you want to query a particular DC directly. |
| -ResultPageSize | Controls the number of objects returned per page in a paged search. The default is 256. |
| -ResultSetSize | Sets the maximum total number of results to return. Set to $null to return all matching objects. |
| -Credential | Runs the cmdlet under an alternate account. Accepts a PSCredential object. |
Note: ADUC has no built-in report or filter for inactive computers; the steps below check the last logon timestamp of individual computer accounts only and cannot produce a domain-wide list.
ADUC does not include a built-in report or filter for inactive computers. To check the last logon timestamp of an individual computer account:
ADManager Plus includes a prebuilt Inactive Computers report in its Computer Reports section. When the report is generated, ADManager Plus scans all configured DCs and determines inactivity based on the last logon time attribute, so results reflect the most accurate logon data available across the domain without any additional configuration.
ADManager Plus also lets you automate the Inactive Computers report to run at defined intervals and deliver results to stakeholders, removing the need for manual report generation.
The Active Directory PowerShell module is not loaded. Run Import-Module ActiveDirectory before the script. If the import fails because the module itself is missing, the RSAT Active Directory DS and LDS Tools feature is not installed on the machine. Install it through Windows Optional Features or using Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0.
The account running the script does not have Read access to the target domain or OU. Run PowerShell as a user with appropriate AD read permissions, or pass alternate credentials using the -Credential parameter.
The directory specified in the -Path value of Export-CSV does not exist. Create the directory before running the script using New-Item -ItemType Directory -Path "C:\Reports", or update the path to an existing location.
There are two likely causes: All computers in the domain authenticated within the inactivity window, or lastLogonTimeStamp has not been populated for any accounts. To verify the calculated cutoff value, add Write-Output $time before the Get-ADComputer line and confirm it reflects the expected date. If lastLogonTimeStamp is null for accounts that have never logged on, those computers will not be returned by this filter; use a separate query with -Filter "LastLogonTimeStamp -notlike '*'" to find accounts that have no logon history at all.
Get-ADComputer queries the current domain by default. To target a specific domain, use the -Server parameter with the domain name or a DC FQDN. For environments with multiple domains, run the script once per domain, adjusting -Server each time, and consolidate the output files.
lastLogon updates on every DC that authenticates a computer but is not replicated across DCs. To find the true last logon time using lastLogon, you would need to query every DC in the domain and take the most recent value. lastLogonTimeStamp replicates to all DCs every nine to 14 days and can be queried from any single DC, making it the practical choice for domain-wide inactive computer detection with Get-ADComputer. The lastLogonDate property in PowerShell is a DateTime conversion of lastLogonTimeStamp and is equivalent for filtering purposes.
Add the -SearchBase parameter to your Get-ADComputer command with the OU's distinguished name. For example:
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} `
-SearchBase "OU=Workstations,DC=domain,DC=com" `
-Properties OperatingSystem, LastLogonDate |
Select-Object Name, SamAccountName, OperatingSystem, DistinguishedName, LastLogonDate |
Export-CSV "C:\Reports\InactiveWorkstations.csv" -NoTypeInformation
To cover multiple OUs, run the script once per OU and combine the CSV output files.
Yes. ADManager Plus' AD automation feature lets you define automation rules that target the Inactive Computers report and apply actions such as disable, delete, or move on a defined schedule, removing the need for manual review.
lastLogonTimeStamp replicates on a nine to 14 day cycle by default. A computer that authenticated to the domain within your inactivity threshold but before the last replication cycle may appear in the results because its replicated timestamp has not yet been updated. Building a replication buffer into your inactivity threshold—for example, targeting computers inactive for 45 days rather than 30—reduces this effect, though it cannot fully eliminate it given the replication window.
Stale computer accounts (also called inactive or orphaned computer accounts) are computer objects in AD belonging to devices that no longer actively communicate with the domain. Common causes include decommissioned hardware never removed from AD, machines reformatted and re-joined under a different account, and virtual machines retired without cleanup. The Inactive Computers report in ADManager Plus provides a way to identify and manage these accounts at scale across multiple domains and OUs.