How To Get All Computers in Active Directory

You may not always need to list all computers in your domain. In some cases, you might need to manage only the computers within a specific organizational unit to focus on applying GPOs to similar computers within that OU.

View alist of computers in an OU using ADUC

• Open the Active Directory Users and Computers snap-in .
• Click on the Action tab and select Find
• In the Find drop-down , select Computer, then choose the desired OU from the Browse option.
• Hit on Find Now to display all computers in the specified OU along with their machine type.

Get all computers in an OU using PowerShell

The ADUC console is limited only to specific computer properties in Active Directory. To view various properties of computers, you can use PowerShell.

Run the PowerShell cmdlet below to find all computers within a specific organizational unit.

Get-ADComputer -Filter * -SearchBase "<OUDistinguishedName>" -Properties * | 
Select-Object Name, Enabled, WhenCreated, @{Name='OUName';Expression={$_.CanonicalName -replace '^.?/(.?)/[^/]+$','$1'}}| 
Format-Table

If you're unsure about the OU’s distinguished name, use the cmdlet below to retrieve it.

Get-ADOrganizationalUnit -Filter "Name -eq '<OUName>'" | 
Select-Object DistinguishedName

However, the above PowerShell cmdlet gets the list of computers from both the specified OU and its sub-OUs. To get computers only in the parent OU, specify the SearchScope parameter as ‘OneLevel’.

Get-ADComputer -Filter * -SearchBase "<OUDistinguishedName>" -SearchScope OneLevel -Properties * | 
Select-Object Name, Enabled, WhenCreated, @{Name='OUName';Expression={$_.CanonicalName -replace '^.?/(.?)/[^/]+$','$1'}} 
| Format-Table

Inactive computers in AD, if left unnoticed, can create challenges in Active Directory management. Here are some potential issues:

To prevent these issues, it is important to identify and manage stale computers in your organization. You can use the PowerShell script below to get computers that have not logged in for the past 30 days.

Note: Replace 30 with any desired timeframe based on your requirements.

#Specify the inactive days based on your requirements  
$InactiveDays = 30 
 
#Determine the threshold date for comparison  based on the inactive days    
$time = (Get-Date).Adddays(-($InactiveDays)) 
 
#Cmdlet to get inactive computers whose last logon date is beyond the threshold date 
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties *|
Select-Object Name, Enabled, LastLogonDate, OperatingSystem, WhenCreated 
|Format-Table 

• Use the Active Directory inactive computers report to quickly locate computers that have been inactive for a specified number of days.
• This report highlights key information about inactive computers, such as the computer name, status, machine type, last logon date, OS name, etc.

Users can access shared network resources by logging into computers in Active Directory. However, unauthorized access to a computer with sensitive data can lead to data leaks.

Therefore, it is important to find who logged into a computer for managing sessions, enforcing IT policies, and maintaining network security.

You can use the PowerShell script below to list all computers and their currently logged-in users.

$Computers =  Get-ADComputer -Filter * | Select-Object -ExpandProperty Name  
$output = [System.Collections.ArrayList]::new() 
 
ForEach($Computer in $Computers) { 
  $UserName = Get-CimInstance Win32_ComputerSystem -ComputerName $Computer | 
  Select-Object -ExpandProperty UserName 
 
  $Object = New-Object -TypeName PSObject -Property @{ 
        "Computer Name" = $Computer 
        "User Logged In" = $UserName 
    } 
  $output.Add($Object) | Out-Null 
} $output 

Note: This script retrieves only users logged in via a local session. It does not capture users connected via Remote Desktop Protocol.

• The All User Logon Events report helps you to find the computer a user is logged on from and provides information on logon time, status, etc.
• You can use the ‘Logon User Name’ easy filter to find computers where a specific user is logged in.

Pro Tip💡: If you want to detect any unauthorized login attempts from restricted computers, you can refer to the Logon Attempts from Restricted Computers report.

In large organizations, applying GPOs to specific computers is often complex. Moving similar computers to a dedicated OU simplifies GPO management but identifying the right computers among thousands of entries presents a challenge. To simplify this process, you can search for computers based on naming conventions, operating systems, or other attributes to pinpoint the desired ones and ensure precise GPO application.

Below are some use cases that can help you search against a large list of computers.

Get all AD computers starting with a certain name

If your organization's computers follow a naming convention with department or role prefixes, use the below PowerShell cmdlet to list computers that start with a certain name.

Get-ADComputer -Filter {Name -like "WI*"} -Properties *|
Select-Object Name, IPv4Address, OperatingSystem, Enabled, WhenCreated 
|Format-Table

This will list all computers in your domain with names starting with WI.

Find all computers with a specific operating system

When planning an OS upgrade or identifying outdated systems for decommissioning, it is crucial to pinpoint computers running a specific operating system in Active Directory. Use the cmdlet below to find all machines running a particular OS version.

Get-ADComputer -Filter "OperatingSystem -like 'Windows 11*'" -Properties *|
Select-Object Name, IPv4Address, OperatingSystem, Enabled, WhenCreated 
|Format-Table

The above cmdlet retrieves computers running Windows 11 in your Active Directory domain.

List all client computer objects in Active Directory

Imagine a scenario where you need to list only the client workstations in Active Directory. Since the computer list includes all machines (member servers and domain controllers), you can use the cmdlet below to retrieve only the workstations.

Get-ADComputer -Filter "OperatingSystem -notlike '*server*'" -Properties * |
Select-Object Name, IPv4Address, OperatingSystem, Enabled, WhenCreated 
|Format-Table

You can use AdminDroid’s rich filtering functionality to retrieve the computer list based on your requirements.

• Computer Name prefixes to find machines following specific naming conventions.
• Machine Type, such as domain controllers, workstations, or member servers.
• Computer Status, whether enabled or disabled.