There are no built-in processes monitoring these stale objects and removing them when they are no longer being used. So the question you may be asking is how I effectively remove these inactive objects. First, we need to understand what categorizes an “inactive computer” object. Well, it turns out that these Windows computers will automatically reset their “computer password” at least once every thirty days. While this number can be modified, it is generally not recommended. Since we know that the computer’s password age attribute is automatically modified at least once every thirty days, all we have to do is query Active Directory and apply some logic in code. There are various ways to extract and handle the data from AD, but I think using VBScript for this solution works quite nicely. Here is an example of code that will query your domain, at any level (OU) of the structure, and allows you to choose the maximum age, and whether or not to run in DELETE or LIST mode. Choosing 60 or 90 days for a maximum age is pretty safe as it accounts for staff that may be on vacation or traveling for an extended period of time.
