From 2f463d02d70445f45a20f04787578ac937a6a4de Mon Sep 17 00:00:00 2001
From: mjfernez <mjf@mjfer.net>
Date: Sat, 19 Feb 2022 15:35:26 -0500
Subject: Add AD scripts and bitwarden to pass script

---
 AD-powershell-tools/inactive-ad-device-report.ps1 | 57 +++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 AD-powershell-tools/inactive-ad-device-report.ps1

(limited to 'AD-powershell-tools/inactive-ad-device-report.ps1')

diff --git a/AD-powershell-tools/inactive-ad-device-report.ps1 b/AD-powershell-tools/inactive-ad-device-report.ps1
new file mode 100644
index 0000000..560a534
--- /dev/null
+++ b/AD-powershell-tools/inactive-ad-device-report.ps1
@@ -0,0 +1,57 @@
+# PLEASE READ SCRIPT BEFORE RUNNING
+
+# Based largely on https://activedirectorypro.com/find-remove-old-computer-accounts-active-directory/
+# but changed his brack/object syntax to a string query
+
+# Usage
+# \inactive-ad-device-report.ps1 "OU=Workstations,DC=example,DC=com" "dd/MM/yyyy" [-report] [-disable]
+
+# Report and disable are optional switches to print the results to a CSV 
+# and disable the computer accounts, respectively
+
+# A cutoff date and a search base, must be provided.
+
+# All computers with Login times before
+# the cutoff date are included in the results of the report
+
+# The search base is an LDAP filter that must (at a minimum) specify
+# your domain controller. And probably an OU you want to search, like:
+#
+# "OU=Workstations,DC=example,DC=com"
+
+# See here for an example: https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps#example-4--get-computer-accounts-in-a-specific-location-using-an-ldapfilter
+param (
+    [Parameter(Mandatory)][string]$searchbase,
+    [Parameter(Mandatory)][string]$cutoff,
+    [switch]$report,
+    [switch]$disable
+)
+Import-Module ActiveDirectory
+$today=(get-date -Format "yyyy-MM-dd")
+try {
+    $filter = "(LastLogonDate -lt `"$cutoff`") -and (Enabled -eq `"$true`")"
+    $devices = Get-ADcomputer -filter $filter -properties LastLogonDate,Enabled,DistinguishedName `
+    -SearchBase $searchbase `
+    | select name, LastLogonDate, DistinguishedName
+    | sort LastLogonDate
+}
+catch {
+    write-error "Bad input. Usage: '.\inactive-ad-device-report.ps1 `"ldap-filter`" `"dd/MM/yyyy`" [-report] [-disable]'"
+}
+
+if ($disable) {
+    ForEach ($device in $devices) {
+        Set-ADComputer -Identity $device.Name -Enabled $false -Verbose -WhatIf
+    }
+    
+    [Console]::Error.WriteLine("All devices disabled")
+}
+
+if($report) {
+    $fn = "old-computers-$today.csv"
+    $devices | export-csv .\$fn
+    [Console]::Error.WriteLine("Saved result list to $fn")
+} else {
+    [Console]::Error.WriteLine("Writing device list to stdout")
+    write-output $devices
+}
-- 
cgit v1.2.3