← ALL SCRIPTS PowerShell · v1.0 · Safe-by-default

Invoke-ADStaleObjectsCleanup

Three-stage lifecycle for stale Active Directory user and computer accounts — Disable → Move → Delete. Audit-only by default; every stage is opt-in and gated by an explicit -Apply switch. Built-in protection for krbtgt, adminCount=1, DC accounts and the standard privileged groups.

Caller-supplied protection layers on top of the built-ins: -ExcludeGroup (recursive members), -ExcludeOU, -ExcludeName (wildcards). The Disable stage tags the object’s Description with DISABLED-STALE-yyyy-MM-dd so the Delete stage can verify the configurable grace period before removing anything. Every run produces a timestamped HTML report plus per-object Findings and per-action Actions CSVs — nothing is ever deleted from the report folder, so historical runs accumulate. _Latest overwrite copies make a single bookmarked path always reflect the most recent run.

What it does
  • Sweeps stale users + computers
  • Audit mode by default (no changes)
  • Stage 1: Disable + tag Description
  • Stage 2: Move to holding OU
  • Stage 3: Delete after grace period
  • -Apply master safety gate
  • Dry-run for every stage
  • Built-in protection: krbtgt
  • Built-in: Domain/Enterprise Admins
  • Built-in: adminCount=1 accounts
  • Built-in: DC computer accounts
  • Built-in: Domain Controllers OU
  • Built-in: Description PROTECTED
  • -ExcludeGroup / OU / Name filters
  • -MinDisabledDays grace period
  • Per-object Findings CSV
  • Per-action Actions CSV
  • HTML report + email delivery
  • _Latest overwrite copies
PowerShell 5.1+ RSAT-AD Audit -> Dry-run -> Apply 3-stage lifecycle HTML + 2 CSVs SMTP email SupportsShouldProcess
Get Script on GitHub

Opens github.com/rt109048/Invoke-ADStaleObjectsCleanup in a new tab

Get in touch

Let’s talk identity.

Open to advisory, contract and permanent opportunities involving Active Directory, Entra ID, identity governance, or zero-trust programmes. The best way to reach me is by email.

Location
United States — Remote