Active Directory Cleanup — Find and Remove Stale Computer Accounts (2026)

Stale computer accounts accumulate in every Active Directory environment over time — decommissioned PCs, laptops that have left the business and VMs that no longer exist. Cleaning them up improves security, reduces noise in reports and keeps your AD organised. This guide covers how to find and remove stale computer accounts using PowerShell in 2026.

Why Stale Accounts Are a Security Risk

• Stale accounts can be exploited by attackers to gain a foothold in your environment
• They appear in SCCM collections and reports creating inaccurate data
• They make it harder to audit your actual device estate
• They clutter Group Policy application and slow down AD queries

Find Stale Computer Accounts (90+ Days)

$days = 90
$cutoff = (Get-Date).AddDays(-$days)

Get-ADComputer -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} `
    -Properties LastLogonDate, OperatingSystem, Description |
    Select-Object Name, LastLogonDate, OperatingSystem, Description |
    Sort-Object LastLogonDate |
    Format-Table -AutoSize

Export Stale Computers to CSV

$days = 90
$cutoff = (Get-Date).AddDays(-$days)
$outputPath = "C:ReportsStaleComputers_$(Get-Date -Format 'yyyyMMdd').csv"

Get-ADComputer -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} `
    -Properties LastLogonDate, OperatingSystem, Description, DistinguishedName |
    Select-Object Name, LastLogonDate, OperatingSystem, Description, DistinguishedName |
    Sort-Object LastLogonDate |
    Export-Csv -Path $outputPath -NoTypeInformation

Write-Host "Exported to $outputPath"

Disable Stale Accounts (Do This First)

Always disable before deleting — wait 30 days after disabling before removing permanently. This gives a safety net if a machine was incorrectly identified as stale.

$days = 90
$cutoff = (Get-Date).AddDays(-$days)
$disabledOU = "OU=Disabled Computers,DC=domain,DC=com"

$staleComputers = Get-ADComputer -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} -Properties LastLogonDate

foreach($computer in $staleComputers) {
    Disable-ADAccount -Identity $computer
    Move-ADObject -Identity $computer.DistinguishedName -TargetPath $disabledOU
    Write-Host "Disabled and moved: $($computer.Name)"
}

Delete Stale Accounts After Grace Period

# Delete disabled computers from Disabled OU after 30 day grace period
$disabledOU = "OU=Disabled Computers,DC=domain,DC=com"

Get-ADComputer -Filter {Enabled -eq $false} -SearchBase $disabledOU |
    Remove-ADComputer -Confirm:$false

Find Stale User Accounts Too

$cutoff = (Get-Date).AddDays(-90)

Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} `
    -Properties LastLogonDate, Department |
    Select-Object Name, SamAccountName, LastLogonDate, Department |
    Export-Csv -Path "C:\Reports\StaleUsers.csv" -NoTypeInformation

Frequently Asked Questions

About The Author

Andrew Armstrong

Andrew Armstrong is a UK-based IT professional with 26+ years of hands-on experience in Windows, Windows Server, SCCM/ConfigMgr, Active Directory, PowerShell, and enterprise infrastructure. He founded TechyGeeksHome in 2010 and has published over 1,500 practical guides covering real-world IT problems and solutions. When not solving IT problems, Andrew develops free Windows utilities including Ultimate Settings Panel, which has been downloaded over 850,000 times.

See author's posts