Active Directory cleanup trims database bloat

Eliminate unlinked GPOs

GPOs can become unwieldy due to their hierarchical arrangement. Over time, GPOs can conflict with one another, or some can be disabled in some places while enabled in others. One typical piece of Active Directory clutter is unlinked GPOs; these are GPOs that have no connection to an organizational unit and are doing nothing but taking up space in the Active Directory database.

Before starting the Active Directory cleanup process, an administrator's computer must be on the domain that they will query, and that machine must have Microsoft's Remote Server Administration Tools package installed.

To find these GPOs, use the Get-GPOReport cmdlet that comes with the PowerShell Active Directory module. Unlike Get-GPO, this cmdlet goes deeper and pulls out most of the settings inside a single -- or all -- GPOs in a domain.

Retrieve all GPOs in the domain in XML format. Using XML enables dot notation to specify certain properties.

$gpoReport = [xml](Get-GPOReport -All -ReportType XML)

Next, filter the report for GPOs with a null LinksTo property. This will show all unlinked GPOs in the domain.

@($gpoReport.GPOs.GPO).where({ -not $_.LinksTo })

To remove the unlinked GPOs, pipe them to Remove-GPO with the WhatIf parameter. If all looks good, remove the WhatIf parameter to delete these objects.

@($gpoReport.GPOs.GPO).where({ -not $_.LinksTo }) | Remove-Gpo -WhatIf

Remove empty groups

Another typical piece of clutter in the Active Directory database is empty groups, which can accumulate for various reasons, such as testing purposes.

First, generate a report of empty groups with the Get-AdGroup cmdlet and using a where filter:

@(Get-ADGroup -Filter * -Properties isCriticalSystemObject,Members).where({ (-not $_.isCriticalSystemObject) -and ($_.Members.Count -eq 0) })

To remove the empty groups, pipe the result to Remove-AdGroup.

@(Get-ADGroup -Filter * -Properties isCriticalSystemObject,Members).where({ (-not $_.isCriticalSystemObject) -and ($_.Members.Count -eq 0) }) | Remove-AdGroup -WhatIf

Delete unused user accounts

This Active Directory cleanup task removes any unused -- expired, disabled or hasn't been used for 120 days -- user accounts. We find these accounts with the Search-ADAccount cmdlet. This cmdlet allows an administrator to find each category of user accounts with a single line.

Search-ADAccount -AccountInactive -TimeSpan 120 -UsersOnly

Search-ADAccount -AccountDisabled –UsersOnly

Search-ADAccount -AccountExpired –UsersOnly

An administrator can consolidate these commands and export the results into a comma-separated values (CSV) file, as shown in the example below.

$inactiveAccounts = Search-ADAccount -AccountInactive -TimeSpan 120 -UsersOnly

$disabledAccounts = Search-ADAccount -AccountDisabled –UsersOnly

$expiredAccounts = Search-ADAccount -AccountExpired –UsersOnly

$unusedAccounts = $inactiveAccounts + $disabledAccounts + $expiredAccounts

$unusedAccounts | Export-Csv –Path C:\UnusedAccounts.csv

Administrators can export the results for other objects, such as unlinked GPOs and empty groups, to a CSV as well.

To remove the unused user accounts, pipe the results to Remove-AdUser by using the WhatIf parameter. If the output appears correct, remove the WhatIf parameter and run again to execute the delete process.

$unusedAccounts | Remove-AdUser -WhatIf