Active Directory Administrator should regularly clean up stale computers from Active Directory. This is a fact. If you haven’t automated the stale computer cleanup process, take 10 minutes to read this background article and to set it up. Doing so will make your life easier. After all, cleaning up your stale computers will help you by:
- Reducing complexity (and troubleshooting time) as you don’t have computer sharing near identical names
- Provide an accurate count if you are using an Active Directory based inventory.
- Allow you to assign specific users to a single primary machine for remote management.
When a computer is marked as stale, it can occasionally come back to life! I like to call these zombie computers. It makes my day sound more exciting…
How do these stale computers come back to life? Here is an example: a user might have a laptop off the domain for a year. This laptop would be marked as stale and disabled. When the user returns, a help desk technician might re-enable the laptop without moving it from your Stale Computers container.
Just this week, we had 9 computers that had this issue. That meant 9 computers were not being managed by Group Policy! That meant 9 computers that did not have AppLocker, UAC, or other security settings applied to them! That mean 9 computers with a craving for human brains! Fortunately for us, PowerShell can fix two out of these three problems automatically! A shotgun will fix the last one…





