Vista - Determine computer objects password days

Is there a way to determine the AD computer object password days ? Eg i wish
to extract machines that password was not changed for more than 180 days,
etc

I think if computer is offline for *too long*, and if it is bring up to the
domain again, the machine may need to rejoin domain.

What functions are there in powershell to determine this ?

On Oct 13, 1:48*am, "IT Staff" <jkk...@xxxxxx> wrote:You can do it the same way you do with users. I usually check the
lastLogonTimeStamp property of its object in AD, which will be mostly
accurate (replicates slowly).

There's also an attribute called pwdLastSet for the date that the
password was last set. All computers are users, so the same
attributes apply when it comes to passwords.

On Oct 13, 2:19*am, tojo2000 <tojo2...@xxxxxx> wrote:Here's a script I just wrote for this using pwdLastSet. Needs Quest AD
Management shell cmdlets. This will get computer accounts that haven't
changed their passwords in x days and move them to a pending delete
OU. Also, you can make a goodlist so if some machines should not be
deleted you don't have to skip them every time.

#Where to look
$searchroot = 'yourdomain.com/Computers'

#get the good list into an array
import-csv "move-over90days_goodlist.txt"|%{[array]$good += $_.name}
$pendingdelete = "OU=PendingDelete,DC=yourdomain,DC=com"

$old = (Get-Date).AddDays(-90)
$logfile = "PendingDeleteLog.csv"
$date = Get-Date

# get the list of computers with the date earlier than this date
$computers = Get-QADComputer -SearchRoot $searchroot -
IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le
$old }

$computers |ft name, description, pwdLastSet
write-host Found: $computers.count

$computers| % {
if ($good -notcontains $_.name) {
if ((Read-Host Name: $_.name Description: $_.description LastChange:
$_.pwdLastSet) -eq "y") {
$ou = $_.ou
$lastLogon = $_.pwdlastset
$name = $_.name
$out = "$name, $ou, $lastlogon, $date"
Out-File -FilePath $logfile -Append -NoClobber -InputObject $out

$a = Get-QADComputer $_.name|set-qadobject -ObjectAttributes
@{userAccountControl=514}|Move-QADObject -to $pendingdelete
Write-Host Disabled and moved $_.name
Write-Host " "
}
}
}