Find and disable old computer objects in AD

If you need to find computer objects in the AD which are no longer in use and then disable them, this could be a useful command:-

dsquery computer -stalepwd xx | dsmod computer -disabled yes [-desc "Disabled because its password is stale"]

This query's the domain for computer objects with a stale password over xx days.  Then modifies those objects so they are disabled, and optionally sets a description on the object with some text.

It would be best to run the query part first (to check its output!) before piping the output to dsmod :)

Analogy - One-way functions

One-way functions - they're like cooking.  Its easy for you to make a pie with a list of ingredients.  Not so easy to get the list of ingredients from examining the pie.