How to move stale computers in Active Directory to DisabledComputers OU

Create your DisabledComputers OU.

Copy and save the following script as DisabledAged.ps1


#Import AD module
Import-Module ActiveDirectory

$ErrorActionPreference = “SilentlyContinue”

$searchbase = “DC=domain,DC=local”
$EntGroups = “OU=Computers,DC=domain,DC=local”
$groups = Get-ADGroup -Properties Name -Filter * -searchbase $EntGroups
$inactiveOU = “OU=DisabledComputers,DC=domain,DC=local”
$Days = (Get-Date).AddDays(-180)
$computers = Get-ADComputer -Properties * -Filter {LastLogonDate -lt $Days} -SearchBase $searchbase
$DisabledComps = Get-ADComputer -Properties Name,Enabled,LastLogonDate -Filter {(Enabled -eq “False” -and LastLogonDate -lt $Days)} -SearchBase $inactiveOU

#Move inactive computer accounts to your inactive OU
foreach ($computer in $computers) {
echo $computer
Set-ADComputer $computer -Location $computer.LastLogonDate | Set-ADComputer $computer -Enabled $false
Move-ADObject -Identity $computer.ObjectGUID -TargetPath $inactiveOU
#Remove group memberships
foreach ($group in $groups) {
Remove-ADGroupMember -Identity $group -Members $computer.ObjectGUID -Confirm:$false
#Optionally remove stale computer objects from AD
#Remove stale computer accounts older than 365 days
#$RemoveStale = Get-ADComputer -Filter * -SearchBase $DisabledComps | Where-Object {$_.Location -gt (Get-Date).AddDays(-365) -and $_.Location -lt (Get-Date).AddDays(-180)}
#$RemoveStale | Remove-ADObject


Run change DC=domain,DC=local to your domain and run the script.