Powershell – Find Active XP, 2000, 2003 devices in the Domain

These scripts are an easy way to see if there are any older Windows devices in your domain. You can easily change them to look for other Windows devices. These scripts will export what it find into an excel spreadsheet.

Windows XP:

Import-Module ActiveDirectory

# The basic query for all XP computers in the domain
$XP = Get-ADComputer -Filter {OperatingSystem -like "*XP*"}

# The full-featured query
$XP = Get-ADComputer -Filter {OperatingSystem -like "*XP*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            Expression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            Expression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# Get only active XP computers in the last 90 days
$XP = Get-ADComputer -Filter {OperatingSystem -like "*XP*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Where-Object {$_.whenChanged -gt $((Get-Date).AddDays(-90))} |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            Expression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            Expression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# View graphically
$XP | Out-GridView

# Export to CSV
$XP | Export-CSV .\xp.csv -NoTypeInformation

# Count how many computers
($XP | Measure-Object).Count

# Days to Windows XP end-of-life
(New-TimeSpan -End (Get-Date -Day 8 -Month 4 -Year 2014 `
    -Hour 0 -Minute 0 -Second 0)).Days

Windows 2000:

Import-Module ActiveDirectory

# The basic query for all 2000 computers in the domain
$2000 = Get-ADComputer -Filter {OperatingSystem -like "*2000*"}

# The full-featured query
$2000 = Get-ADComputer -Filter {OperatingSystem -like "*2000*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            E2000ression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            E2000ression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# Get only active 2000 computers in the last 90 days
$2000 = Get-ADComputer -Filter {OperatingSystem -like "*2000*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Where-Object {$_.whenChanged -gt $((Get-Date).AddDays(-90))} |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            E2000ression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            E2000ression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# View graphically
$2000 | Out-GridView

# E2000ort to CSV
$2000 | E2000ort-CSV .\2000.csv -NoTypeInformation

# Count how many computers
($2000 | Measure-Object).Count

# Days to Windows 2000 end-of-life
(New-TimeSpan -End (Get-Date -Day 8 -Month 4 -Year 2014 `
    -Hour 0 -Minute 0 -Second 0)).Days

Windows 2003:

Import-Module ActiveDirectory

# The basic query for all 2003 computers in the domain
$2003 = Get-ADComputer -Filter {OperatingSystem -like "*2003*"}

# The full-featured query
$2003 = Get-ADComputer -Filter {OperatingSystem -like "*2003*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            E2003ression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            E2003ression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# Get only active 2003 computers in the last 90 days
$2003 = Get-ADComputer -Filter {OperatingSystem -like "*2003*"} `
    -Properties Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, LastLogonTimestamp, nTSecurityDescriptor, `
        DistinguishedName |
    Where-Object {$_.whenChanged -gt $((Get-Date).AddDays(-90))} |
    Select-Object Name, DNSHostName, OperatingSystem, `
        OperatingSystemServicePack, OperatingSystemVersion, PasswordLastSet, `
        whenCreated, whenChanged, `
        @{name='LastLogonTimestampDT';`
            E2003ression={[datetime]::FromFileTimeUTC($_.LastLogonTimestamp)}}, `
        @{name='Owner';`
            E2003ression={$_.nTSecurityDescriptor.Owner}}, `
        DistinguishedName

# View graphically
$2003 | Out-GridView

# E2003ort to CSV
$2003 | E2003ort-CSV .\2003.csv -NoTypeInformation

# Count how many computers
($2003 | Measure-Object).Count

# Days to Windows 2003 end-of-life
(New-TimeSpan -End (Get-Date -Day 8 -Month 4 -Year 2014 `
    -Hour 0 -Minute 0 -Second 0)).Days
More Stories
Cisco ASA Threat Detection