Find and/or cleanup old computer accounts in AD

Find and/or cleanup old computer accounts in AD

Dsquery is a command-line tool that is built into Windows Server 2008. 
It is available if you have the Active Directory Domain Services (AD DS) server role installed. 
To use dsquery, you must run the dsquery command from an elevated command prompt. 
To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.

To find inactive computer accounts (number is inactivity in weeks):
dsquery computer -inactive 2

To find computers with stale passwords (number is stale in days)
dsquery computer -stalepwd 45

There is also a combination to disable / delete the accounts:
combined with dsmod/dsrm

dsquery computer -inactive 4 | dsmod computer -disabled yes
dsquery computer -stalepwd 45 | dsrm computer

You can get additional info on both of these tools with dsquery computer /? ,dsmod computer /?, and dsrm computer /?

SCRIPTS: How to use RunDll32.exe

RunDll32.exe is a interesting tool that can be used in scripting..

  • rundll32.exe inetcpl.cpl ResetIEtoDefaults http://source.winehq.org/WineAPI/inetcpl.html
  • RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1DeleteCookies = 2,
    DeleteHistoryFiles = 8,
    DeleteFormData = 16,
    DeletePasswords = 32,
    DeleteHistory = 193,
    DeleteALLHistory = 255,
    DeleteTrackingInfo = 2048,
    PreserveFavourites = 8192,
    DeleteDownloadHistory = 16384,
    DeleteEverything = 22783
    Delete History = 1
    Delete Cookies = 2
    Delete Temporary Internet Files = 18
    Delete Form Data = 16
    Delete Passwords = 32
    Delete All = 255
    Delete All + files & settings stored by Addons = 4351
  • rundll32 shell32,Control_RunDLL Run The Control Panel
    rundll32 shell32,Control_RunDLL X Start applet X of Control Panel
    (“X” = any CPL filename)
    rundll32.exe shell32.dll,Control_RunDLL intl.cpl,,4 Regional setting, Date tabrundll32 shell32,OpenAs_RunDLL \dir\filename.txt Open The ‘Open With…’ Window
    rundll32 shell32,ShellAboutA Info-Box Open ‘About Window Window’
    rundll32 shell32,Control_RunDLL desk.cpl Open Display Properties
    rundll32 user,cascadechildwindows Cascade All Windows
    rundll32 user,tilechildwindows Minimize All Child-Windows
    rundll32 user,repaintscreen Refresh Desktop
    rundll32 keyboard,disable Lock The Keyboard
    rundll32 mouse,disable Disable Mouse
    rundll32 user,swapmousebutton Swap Mouse Buttons
    rundll32 user,setcursorpos Set Cursor Position To (0,0)
    rundll32 user,wnetconnectdialog Show ‘Map Network Drive’ Window
    rundll32 user,wnetdisconnectdialog Show ‘Disconnect Network Disk’ Window
    rundll32 user,disableoemlayer Display The BSOD (blue screen of death)Window
    rundll32 diskcopy,DiskCopyRunDll Show Copy Disk Window
    rundll32 rnaui.dll,RnaWizard Run ‘Internet Connection Wizard’
    rundll32 shell32,SHFormatDrive Run ‘Format Disk (A)’ Window
    rundll32 shell32,SHExitWindowsEx -1 Cold Restart Of Windows Explorer
    rundll32 shell32,SHExitWindowsEx 1 Shut Down Computer
    rundll32 shell32,SHExitWindowsEx 0 Logoff Current User
    rundll32 shell32,SHExitWindowsEx 2 Windows9x Quick Reboot
    rundll32 krnl386.exe,exitkernel Force Windows 9x To Exit (no confirmation)
    rundll32 rnaui.dll,RnaDial “MyConnect” Run ‘Net Connection’ Dialog
    rundll32 msprint2.dll,RUNDLL_PrintTestPage Choose & Print Test Page Of Current Printer
    rundll32 user,setcaretblinktime Set New Cursor Rate Speed
    rundll32 user, setdoubleclicktime Set New DblClick Speed (Rate)
    rundll32 sysdm.cpl,InstallDevice_Rundll Hardware installation wizard
    rundll32 user,MessageBeep Default beep sound
    rundll32 user32.dll,MessageBeep Default beep sound (XP)
    rundll32 shell32.dll,Control_RunDLL appwiz.cpl Add/remove programs
    rundll32 shell32.dll,Control_RunDLL timedate.cpl,,0 Date/time settings
    rundll32 shell32.dll,Control_RunDLL odbccp32.cpl ODBC settings

    rundll32.exe url.dll,FileProtocolHandler http:\\www.rgagnon.com
    rundll32.exe url.dll,FileProtocolHandler c:\mypdf.pdf
    Open the associated application
    rundll32 amovie.ocx,RunDll /play /close c:\mymovie.mpg
    Play multimedia (movie or sound)

    Rundll32.exe powrprof.dll,SetSuspendState Sleep Put the computer in Sleep mode
    Privacy (IE)
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 8 Internet temporary files
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 2 Cookies
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 1 History
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 16 Forms Data
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 32 Passwords
    rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 255 Delete everything
    The Windows Fax viewer is used to view a variety of graphic format like .bmp, .dib, .emf, .gif, .jpeg, .png, .tif or .wmf extensions
    rundll32.exe shimgvw.dll,ImageView_Fullscreen
    “C:\Documents and Settings\username\My Documents\logo.bmp”

Uptime Scanner

Uptime Scanner

[source language="vb"]</pre>
Const ForReading = 1, ForWriting = 2, ForAppending = 3
Const CONVERT_TO_LOCAL_TIME = True

Set FileSystemObject = CreateObject("Scripting.FileSystemObject")
CurrentDirectory = left(WScript.ScriptFullName,(Len(WScript.ScriptFullName))-(len(WScript.ScriptName)))
Set DeviceListFile = FileSystemObject.OpenTextFile(CurrentDirectory & "\serverlistall.txt", ForReading)

Do Until DeviceListFile.AtEndOfStream
Devicename = DeviceListFile.ReadLine
If Trim(Devicename) <> "" Then
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate dateadd("n", -10, now)' CONVERT_TO_LOCAL_TIME

Set winmgmts = GetObject("winmgmts:\\" & Devicename & "\root\cimv2")
Set Win32_OperatingSystem = winmgmts.ExecQuery ("Select * from Win32_OperatingSystem")
For each Instance in Win32_OperatingSystem
Wscript.Echo Devicename & ", " & UtcDateToString(Instance.LastBootUpTime)
Next
End if
Loop
DeviceListFile.Close

Function UtcDateToString(UtcFormattedDate)
UtcDateToString = CDate(Mid(UtcFormattedDate, 5, 2) & "/" & Mid(UtcFormattedDate, 7, 2) & "/" & Left(UtcFormattedDate, 4) & " " & Mid (UtcFormattedDate, 9, 2) & ":" & Mid(UtcFormattedDate, 11, 2) & ":" & Mid(UtcFormattedDate, 13, 2))
End Function

[/source]

Simple Service Check

Simple Service Check

 

[source language=”vb”]

@echo off
<span style="line-height: 1.5em;">:start</span>

for /f %%I in (serverlistall.txt) do call :run %%I
goto :end
:run
echo %1
wmic /node:%1 service where StartMode="Auto" list brief > %1_before.txt
goto :eof

[/source]

 

[source language=”vb”]

fc %1_before.txt %1_after.txt /U /LB | findstr "Stopped" > %1_compare.txt

[/source]