Walking Dead VMs: Beware the Zombie Power Suckers

There are a number of network scanning tools available for free that will give you a starting picture of what's going on. They won't catch everything, but they will help you get the audit ball rolling.

The accounting department might have records of hardware purchases and software licenses that you can use to perform an inventory of what you have on hand.

Wait until most of the organization is shut down -- like during the week between Christmas and New Years -- and just start turning off machines that you suspect aren't doing any work. If no one complains, keep them off.

Remember that just because a machine is virtual rather than physical doesn't mean there shouldn't be procurement procedures in place for it. Even for a machine with an expected half-life of just a few days, IT should have some formal mechanism for it being requisitioned. You don't need to bury your users with forms, but you want to have good enough records that the machine you're starting up will have a full but finite lifespan, and not one day mutate into a mindless zombie chomping at everything in its path.