0

Deleted versus Disabled:

I recently did a scan and found over 300 computer accounts which had not checked in to the domain for the past year or more.

dsquery computer -inactive 52 -limit 0

I then disabled all of these machines with no issue.

My question is this: Are there environmental issues with removing these stale computer accounts?

For instance, I don't think it's relevant for spinning up an old VM from backup. I can't think of any 'loss' apart from the ability to know which systems names had been used, what OS they were, etc.

The second part of the question is if there should be any special method for removing them? Is just using AD U&C and deleting the accounts sufficient or should I also check DNS, etc. as some of them were (very) old servers. I want to prevent there from being orphaned data which I need to cleanup with ADSI Edit or something like that down the line.

Thanks!

4
  • What is the use of keeping information about old computers when they're no longer in service? If you need to deploy something that is a replacement for one of these old computers, won't you just deploy it with the config it needs now? You're unlikely going to be deploying it with the config it used to have, or you would already have done so I assume? So with this info, I'd say delete them. The only reason to keep them alive, is if the actual machines are still in store ready to be used again.
    – LPChip
    Nov 6, 2015 at 22:08
  • @LPChip That's my thinking. I just want to make sure that by deleting the accounts from AD users and computers I don't leave a ton of orphaned info throughout the domain. As far as I know it should remove any linked info cleanly?
    – Abraxas
    Nov 6, 2015 at 22:10
  • Computers, yes. User acocunts no. User accounts have profiles which are files which needs manually cleanup.
    – LPChip
    Nov 6, 2015 at 22:11
  • @LPChip Thanks! That's all I needed to know. Feel free to turn that in to an answer and you'll get the resolution :)
    – Abraxas
    Nov 6, 2015 at 22:12

1 Answer 1

1

What is the use of keeping information about old computers when they're no longer in service? If you need to deploy something that is a replacement for one of these old computers, won't you just deploy it with the config it needs now? You're unlikely going to be deploying it with the config it used to have, or you would already have done so I assume? So with this info, I'd say delete them. The only reason to keep them alive, is if the actual machines are still in store ready to be used again.

When deleting from the Active Directory, its good to know that users leave other info behind, such as profiles, where computers do not. At least not on the server side. A computer that used to be in the domain will of course no longer be able to log in and give a message to the user that their relationship with the domain was not properly retrieved. Note that removing a computer from a domain will remove it from the active directory as well. For some reason, this is something people always forget to do when a computer was written off and replaced, while the computer was still perfectly working.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .