RSA Admin

Looking for devices that have not collected data in 365 days

Discussion created by RSA Admin Employee on Oct 13, 2009
Latest reply on Jun 26, 2013 by RSA Admin

We use the logging system to collect log data for domain controllers.  When a DC is no longer in server I change the status to Active/Disabled so the data is still in the system but it is no longer collecting data.  What I would like to do is use lsmaint or some other tool to create a script to email me when it has been 365 days since a device last collected data.  That way I can remove the device from the system.  Ultimately I would like to automate the the whole process so that I have a script which queries AD for DCs and then compares that to wintool output to bulk add new DCs and then use the above requested process to somehow remove the DCs from the system after 365 days of no data.

 

Any suggestions would be greatly appreciated.

Outcomes