Let me first start by saying that we have a pretty unorginsaeed Active Directory Structure at the moment, but that will change. Today I took the first step to getting some order in our AD Structure, disable all accounts that ahve been inactive for a period of time. To do this I simply used DSQuery and piped the results to DSMod and there we have it all the accounts are disabled.

Here was the command I used:

dsquery user -inactive 40 -limit 0 | dsmod user -disabled yes

I know, I know pretty simple but something that is good to have in the tool kit. I then went on and did it using the computer accounts. Then from Active Directory Users and Computers snap in I could then create a query to lookup all the disabled user and computer account and eother delete them or move them to a temp OU before deleting.

Daniel Anderson
Cleaning up my Active Directory.