Published on

How to Get a Computer Report in Active Directory (PowerShell Script)

Active Directory is often the most accurate device inventory an organization has, whether it's being used that way on purpose or not — every domain-joined machine registers a computer account whether or not anyone's tracking it in a separate asset system. Pulling that list straight from AD is usually faster and more current than whatever spreadsheet is supposed to be the source of truth.

The quick answer

Get-ADComputer -Filter * -Properties OperatingSystem, LastLogonDate, IPv4Address |
    Select-Object Name, OperatingSystem, Enabled, LastLogonDate, IPv4Address

A more useful reporting script

#requires -Modules ActiveDirectory
<#
.SYNOPSIS
    Reports every computer account in Active Directory with key attributes.
#>

[CmdletBinding()]
param(
    [string]$OperatingSystemLike,
    [string]$SearchBase,
    [string]$OutputCsv
)

Import-Module ActiveDirectory -ErrorAction Stop

$params = @{
    Filter     = '*'
    Properties = @('OperatingSystem', 'OperatingSystemVersion', 'Enabled', 'LastLogonDate', 'IPv4Address', 'DistinguishedName')
}
if ($SearchBase) { $params['SearchBase'] = $SearchBase }

$computers = Get-ADComputer @params

if ($OperatingSystemLike) {
    $computers = $computers | Where-Object { $_.OperatingSystem -like $OperatingSystemLike }
}

$results = $computers |
    Select-Object Name, OperatingSystem, OperatingSystemVersion, Enabled, LastLogonDate, IPv4Address, DistinguishedName |
    Sort-Object Name

if (-not $results) {
    Write-Host "No computer accounts found matching the given criteria." -ForegroundColor Yellow
    return
}

Write-Host "Found $(@($results).Count) computer account(s)." -ForegroundColor Cyan
$results | Format-Table Name, OperatingSystem, Enabled, LastLogonDate, IPv4Address -AutoSize

if ($OutputCsv) {
    $results | Export-Csv -Path $OutputCsv -NoTypeInformation
    Write-Host "Exported results to $OutputCsv" -ForegroundColor Green
}

-OperatingSystemLike "*Windows 11*" (or "*Server*", or any wildcard pattern) filters the inventory down to a specific OS family in one pass — handy for a migration or end-of-life planning project where you need a count of exactly what's still out there.

Trusting IPv4Address from AD

The IPv4Address field comes from the computer object's DNS host record, updated the last time the machine registered with DNS — it's a good-enough snapshot for an inventory report, but treat it as "last known," not live. A machine that's been off the network for a while will show whatever address it last had, not a blank.

Where the manual approach runs out of road

A one-off script is fine for a single check. It starts to hurt once you actually need to run this regularly:

  • No scheduling. Cron/Task Scheduler can run the script, but now you own the scheduling, the credentials it runs as, and what happens when it silently fails.
  • No history. A CSV export is a snapshot. Was this the same five accounts as last month, or a growing list? A single export can't tell you.
  • No distribution. Getting the report to the right people (security, IT ops, compliance) on a schedule means building that plumbing yourself.
  • Multi-domain/multi-forest pain. Run it once per domain, reconcile the results yourself, and hope naming/OU conventions are consistent across all of them.
  • No alerting. If something changes unexpectedly between runs — an account re-enabled, a privileged group gaining a member — nothing tells you until you happen to run the script again.

None of that is a PowerShell problem. It's what turns a script into a product.

What SysFlint AD does instead

Our SysFlint AD runs the same kind of discovery shown above automatically, on a schedule, entirely inside your own network. No agents on domain controllers, no data leaving your environment. It's free, forever.

If you're currently doing this with a script on a scheduled task, here's the honest comparison between the two, or go straight to the download page.

Get this script, and the rest of them

The script above is part of awesome-it-scripts, SysFlint's free, open-source library of PowerShell scripts for Active Directory and other IT-admin tasks — no signup, no catch, MIT licensed. Grab this one directly from active-directory/Get-ADComputerInventoryReport.ps1, or browse the whole thing.

Find every disabled/locked-out/stale/privileged-account script we've published (plus the FAQ that goes with each one) in the repo's active-directory folder. Star it if it's useful — new scripts land there regularly.