LDAP health

Question

I recently had to rebuild my local AV platform. In doing so the software had to re-evaluate our network to build its listings of who was and wasn't covered by its agent. The software used LDAP to scan the network and the results were surprising. LDAP turned up 3x the number of rogue devices identified apart from those legitimately found. Some of these are Mac, Some are printers, but quite a few are servers/PC's that are long gone.

I've gone through AD and DNS and even adjusted scavenging, but this rogue number hasn't decreased.

Looking online I haven't found too much to cleanup stale LDAP records. I'm hoping there are some tools to ensure LDAP is healthy and not bloated.

Any assistance is appreciated.

Windows 2019 server, up to date and otherwise running fine.

Answer 1

Hello Allan,

Thank you for your question and for reaching out with your question today.

Cleaning up stale LDAP records can be a challenging task, but there are some steps and tools you can use to ensure LDAP is healthy and remove the bloated or rogue devices from Active Directory. Here are some methods you can try:

1. Active Directory Cleanup:

Use the built-in Active Directory cleanup tools to remove stale or inactive objects. You can perform this cleanup manually or use the Active Directory Recycle Bin, if enabled. To access the cleanup tools:

• Open "Active Directory Users and Computers" (ADUC).
• Right-click on the domain and select "Find."
• In the Find dialog, select the "Computers" category and choose "Inactive for" or "Stale" conditions to search for outdated devices.
• Delete the found objects as needed.

2. PowerShell Scripts:

You can create custom PowerShell scripts to find and remove stale or inactive computer objects from Active Directory. These scripts can be more flexible and tailored to your specific needs. Here's an example PowerShell script to find inactive computers and disable them:

   $staleDays = 365  # Number of days to consider as stale

   $staleDate = (Get-Date).AddDays(-$staleDays)

   Get-ADComputer -Filter {LastLogonTimeStamp -lt $staleDate} | Disable-ADAccount

3. Use LDAP Queries:

Utilize LDAP queries to identify and remove outdated devices. LDAP queries allow you to search for specific attributes or conditions, such as inactive devices based on last logon timestamps.

4. Automated Cleanup Tools:

There are third-party tools available that can automate the process of identifying and removing stale LDAP records. These tools can be more efficient for large or complex environments.

5. Verify DNS Scavenging:

Since you mentioned adjusting scavenging in DNS, double-check that DNS scavenging is correctly configured to remove stale DNS records. Proper DNS scavenging helps keep DNS clean and reduces potential conflicts with Active Directory.

6. Manual Cleanup:

Manually review the objects found by the AV software and verify if they are indeed stale or belong to long-gone servers/PCs. Once you have confirmed their status, you can manually remove them from Active Directory.

Remember to exercise caution when removing objects from Active Directory, as deleting objects that are still in use can lead to issues. Always ensure you have proper backups and verify the objects' status before deletion.

Before implementing any changes, it's a good idea to perform a full backup of Active Directory to ensure you have a recovery point in case anything unexpected happens during the cleanup process.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Answer 2

Hello, thank you for the reply.

I attempts using the AD tools but did not see what was indicated in the instructions. On my name server I went to ADU&C. right clicked on the domain, selected find, but that is where the similarities ended. I didn't see the find conditions for inactive or stale.

 Active Directory Cleanup:

Use the built-in Active Directory cleanup tools to remove stale or inactive objects. You can perform this cleanup manually or use the Active Directory Recycle Bin, if enabled. To access the cleanup tools:

    Open "Active Directory Users and Computers" (ADUC).
    Right-click on the domain and select "Find."
    In the Find dialog, select the "Computers" category and choose "Inactive for" or "Stale" conditions to search for outdated devices.
    Delete the found objects as needed.