My favourite tool for this in the past was oldcmp<\/a>. The page doesn\u2019t list Windows 2008 or 2008 R2. I last used it with Windows Server 2008 in a lab and it worked fine. It allowed you to work with user and computer accounts:<\/p>\n The last time I was an admin of a large environment I was very fussy about inactive accounts. We used to run oldcmp as a scheduled task on a monthly basis.<\/p>\n If you want something that is supported then try this. Identify & disable computer accounts that were inactive for the last 4 weeks:<\/p>\n dsquery computer -inactive 4 | dsmod computer -disabled yes <\/em><\/p>\n Then you can identify and delete computer account that have been inactive for the last 8 weeks:<\/p>\n dsquery computer -inactive 8 | dsrm computer<\/em><\/p>\n Put that in a script and run it every month and you\u2019ll automate the cleanup nicely. Inactive machines for the last 4 weeks will be disabled and you can re-enable them if a user complains. After 8 weeks, they get completely removed. If you have people away for longer periods then you can extend this, e.g. disable after 26 weeks and delete after 52 weeks. Or you might bundle that caution about deleting with a secure mindset, e.g. disable after 4 weeks and delete after 52 weeks.<\/p>\n Note: dsquery, dsmod, and dsrm can be easily used for lots more, e.g. user accounts. Check the help (at command prompt) and test-test-test before putting it into use. You probably can do all of this with PowerShell and the useful \u2013whatif flag.<\/em><\/p>\n DNS Records<\/u><\/strong><\/p>\n I hate<\/em> stale DNS records because they can lead to all sorts of false positives when there is IP address re-use, especially when trying to remotely manage\/connect to PCs in a DHCP environment. You can configure DNS scavenging of stale records on a DHCP server (for all zones) or on a per zone basis.<\/p>\n Be careful with this one. I\u2019ve been especially careful with the intervals since the 2003 days when I had a Premier support call open. Scavenging didn\u2019t like me using smaller intervals, even if they were correctly configured.<\/p>\n Once you have the environment cleaned up, you can start deploying agents. Now when you see a \u201cfailed\u201d message, you know you can take it seriously and schedule a human visit.<\/p>\n Note: I don\u2019t think I\u2019ve ever used ConfigMgr to build collections of users. Users roam and I don\u2019t want to install software needlessly. But ConfigMgr 2012 will have a more reliable user-centric approach that detects a user\u2019s primary PC. Therefore, you\u2019ll want to do a user clean up before deploying it \u2026 and that should be standard security practice anyway.<\/em><\/p>\n First, I hope you\u2019ve done some planning\/architecture\/proof of concept. Next, clean up the environment. Products that deploy agents, such as System Center Essentials (SCE), Configuration Manager (SCCM\/ConfigMgr), and Operations Manager (SCOM\/OpsMgr), will allow you to track the success of agent deployment. And if your network is like most others I\u2019ve encountered over the years, nobody … Continue reading “Before You Install System Center \u2026 Clean Up Those Computer Accounts”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[2],"tags":[169,60,83,193,194],"class_list":["post-11462","post","type-post","status-publish","format-standard","hentry","category-active-directory","tag-active-directory","tag-configuration-manager","tag-operations-manager","tag-system-center","tag-system-center-essentials"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2011\/08\/image_thumb.png\" "\\"image\\"")
<\/a><\/p>\n