Active Directory Computer Management: Complete Guide

Overview

Computer management in Active Directory involves managing the lifecycle of computer objects from creation through decommissioning. This guide covers everything you need to know about managing computers in your domain.

Key Topics:

• Computer account creation and deletion
• Querying and filtering computers
• Managing computer properties
• Organizational structure for computers
• Computer maintenance and cleanup
• PowerShell automation for management

Prerequisites:

• Active Directory infrastructure
• Administrator or delegated permissions
• Basic understanding of AD structure

---

Table of Contents

1. Computer Account Basics
2. Creating Computer Accounts
3. Querying Computers
4. Managing Properties
5. Computer OU Structure
6. Maintenance & Cleanup
7. Troubleshooting

---

Computer Account Basics

What is a Computer Account?

A computer account represents a physical or virtual computer in your Active Directory domain. It contains:

• Identity

  • Computer name (NetBIOS name)
  • DNS hostname
  • SID (Security Identifier)
  • GUID

• Status Information

  • Enabled/Disabled status
  • Last logon timestamp
  • Account creation date

• Operating System Information

  • Operating system name
  • Operating system version
  • Service pack level

• Organizational Data

  • Location/OU
  • Description
  • Managed by (optional link to user/group)

Computer Naming Conventions

Best Practices:

• Max 15 characters (NetBIOS limitation)
• Prefix by type: WS (workstation), SRV (server), LT (laptop)
• Include location or department when relevant
• Use consistent capitalization

Examples:

WS-NYC-001    (Workstation in New York)
SRV-DB-PROD   (Database server in production)
LT-SALES-001  (Laptop for sales department)

---

Creating Computer Accounts

Method 1: During Computer Join

When a computer joins the domain:

1. Computer creates its own account
2. Administrator approves the join
3. Account is automatically enabled

Process:

1. On computer: Settings → About → Rename/Join Domain
2. Enter domain name and admin credentials
3. Computer creates account and joins domain

Method 2: Prestage Computer Account

Prestaging allows computer setup before physical deployment.

PowerShell:

New-ADComputer -Name "WS-NYC-001" `
    -Path "OU=Workstations,OU=Computers,DC=contoso,DC=com" `
    -Description "Workstation for NYC office"

Benefits:

• Set permissions before deployment
• Control OU placement
• Automate provisioning process

---

Querying Computers

Find All Computers

Get-ADComputer -Filter * | Select-Object Name, DNSHostName

Find by Operating System

# All Windows 11 computers
Get-ADComputer -Filter "operatingSystem -like '*Windows 11*'" `
    -Properties OperatingSystem | Select-Object Name, OperatingSystem

# Count by OS version
Get-ADComputer -Filter * -Properties OperatingSystem |
Group-Object -Property OperatingSystem | Select-Object Name, Count

Find Enabled vs Disabled

# Enabled computers
Get-ADComputer -Filter "enabled -eq $true" | Measure-Object

# Disabled computers
Get-ADComputer -Filter "enabled -eq $false" | Select-Object Name

Find by Last Logon Date

$date = (Get-Date).AddDays(-30)
Get-ADComputer -Filter "lastLogonDate -lt '$date'" -Properties LastLogonDate |
Select-Object Name, LastLogonDate

Export Computer Inventory

Get-ADComputer -Filter * -Properties OperatingSystem, DNSHostName, LastLogonDate |
Export-Csv -Path "C:\computer-inventory.csv" -NoTypeInformation

---

Managing Properties

View Computer Properties

$computer = Get-ADComputer -Identity "workstation01" -Properties *
$computer | Select-Object Name, OperatingSystem, DNSHostName, Description

Modify Computer Properties

Set-ADComputer -Identity "workstation01" `
    -Description "Updated: New employee workstation" `
    -Location "New York Office"

Enable/Disable Computers

# Disable computer
Disable-ADAccount -Identity "workstation01"

# Enable computer
Enable-ADAccount -Identity "workstation01"

# Check status
Get-ADComputer -Identity "workstation01" -Properties Enabled |
Select-Object Name, Enabled

---

Computer OU Structure

Recommended Structure

Computers
├── Workstations
│   ├── NYC
│   ├── LA
│   └── Chicago
├── Servers
│   ├── Production
│   ├── Development
│   └── Infrastructure
├── Laptops
│   ├── Sales
│   ├── Engineering
│   └── Management
└── Disabled
    └── Archive

Benefits of Good OU Structure

• Security - Apply GPOs to specific computer types
• Delegation - Assign management rights by OU
• Organization - Easy to find and manage computers
• Automation - Target updates and policies by location

Move Computers Between OUs

$computer = Get-ADComputer -Identity "workstation01"
Move-ADObject -Identity $computer.ObjectGUID `
    -TargetPath "OU=Sales,OU=Workstations,OU=Computers,DC=contoso,DC=com"

---

Maintenance & Cleanup

Find Inactive Computers

# Computers not logged in for 90 days
$date = (Get-Date).AddDays(-90)
$inactive = Get-ADComputer -Filter "lastLogonDate -lt '$date'" -Properties LastLogonDate |
Select-Object Name, LastLogonDate

# Export inactive list
$inactive | Export-Csv -Path "C:\inactive-computers.csv" -NoTypeInformation

Disable Inactive Computers

# Disable computers inactive for 6 months
$date = (Get-Date).AddDays(-180)
Get-ADComputer -Filter "lastLogonDate -lt '$date'" -Properties LastLogonDate |
Disable-ADAccount

Delete Old Computers

# Move disabled computers to archive OU
$date = (Get-Date).AddDays(-365)
Get-ADComputer -Filter "enabled -eq $false -and lastLogonDate -lt '$date'" |
ForEach-Object {
    Move-ADObject -Identity $_.ObjectGUID `
        -TargetPath "OU=Archive,OU=Disabled,OU=Computers,DC=contoso,DC=com"
}

# After 1 year in archive, delete
Get-ADComputer -Filter "enabled -eq $false" `
    -SearchBase "OU=Archive,OU=Disabled,OU=Computers,DC=contoso,DC=com" |
Remove-ADComputer -Confirm:$false

---

Common Tasks

Reset Computer Account Password

Test-ComputerSecureChannel -Repair -Verbose

Run on the affected computer (requires local admin).

Find Computers in Specific Location

Get-ADComputer -Filter "location -eq 'New York'" -Properties Location

Rename Computer Object

Rename-ADObject -Identity "CN=OldName,CN=Computers,DC=contoso,DC=com" -NewName "NewName"

---

Troubleshooting

Issue: Computer Won’t Join Domain

Check:

1. DNS resolution works
2. Network connectivity to domain controller
3. Computer account exists and is enabled
4. Credentials have permission to create computers

Issue: Computer No Longer Has Domain Permissions

Solution:

1. Reset computer account
2. Rejoin computer to domain
3. Rebuild computer if necessary

Issue: Too Many Disabled Computers

Solution:

1. Run cleanup script to remove old disabled computers
2. Establish policy for computer removal
3. Regular maintenance schedule

---

Best Practices

✅ Naming Consistency - Use predictable naming scheme

✅ OU Organization - Structure by type and location

✅ Regular Cleanup - Remove old and disabled computers

✅ Document Changes - Log computer additions/removals

✅ Security - Restrict who can create computer accounts

✅ Monitoring - Track logon activity and identify inactive computers

---

See Also

• Complete Active Directory Guide - AD overview
• Complete PowerShell Guide - PowerShell basics