Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do i find new Active Directory accounts that have been made in the last 90 days?

does anyone know who to do this? I can't figure it out.

Thanks in advance.

share|improve this question

6 Answers 6

up vote 10 down vote accepted

For posterity, dsquery is designed for this kind of search. AD does keep a 'whenCreated' field, which makes it easy to search with your tool of choice.

dsquery * -filter "(whenCreated>=20101022083730.0Z)"

As an example. You can programatically create the timestring based on now - 90days.

share|improve this answer
+1 may want to use "(&(objectClass=user)(whenCreated>=20101022083730.0Z))" to filter out computers and other objects. –  jscott Oct 25 '10 at 21:24

Using PowerShell and the Quest ActiveRoles Tools for AD (found here - http://www.quest.com/powershell/activeroles-server.aspx) ,

Get-QADUser -CreatedAfter (Get-Date).AddDays(-90)

will give you output to the console or wherever you redirect of all users created in the last 90 days.

share|improve this answer

Try the following to pull users created in the last 30 days.

Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge ((Get-Date).AddDays(-30)).Date}
share|improve this answer

You can do this pretty easily with dsquery

Here's an opposite but related problem

Dsquery docs

share|improve this answer

Here's an example from another site of someone retrieving all AD accounts sorted by creation date:


You can get the creation date for each account from Active Directory. Every AD object has a WhenCreated and WhenChanged attribute. You can dump these attributes into a flat file using the LDIFDE utility, or you can dump them into a comma-delimited file using CSVDE (both utilities come with Windows 2000).

Here's the syntax to dump the two attributes for the user objects in an OU called Phoenix in a domain called Company.com to the console for viewing (the entire entry should typed as a single line):

ldifde -d ou=phoenix,dc=company,dc=com -l whencreated, whenchanged -p onelevel -r "(ObjectCategory=user)" -f con

If you wanted to save the dump to a file, change the -f switch from con to a file name.

The last logon timestamp uses this format: YYYYMMDDHHMMSS, with the hour shown in Universal Coordinated Time. A time stamp of 20040115182937.0Z corresponds to Jan 15 2004 18:29:37 UCT.

USRSTAT is slow, and the report you get has to be merged with the LDIFDE dump. So, I put together a script that searches for user objects at each domain controller, then lists the local logon time and the creation time. The user logon timestamp requires conversion from a long integer. I borrowed the conversion code comes from Richard L. Mueller (www.rlmueller.net/Programs). Richard's full script also takes the local time zone from the Registry and converts the time from UCT to local time. Nifty

share|improve this answer

If you like GUI tools please chceck AD Info Free, it have many useful reports.


share|improve this answer
Please elaborate this answer so it's not looked like a spam post. See How to not be a spammer –  masegaloeh Nov 29 '14 at 2:03
I dont know how i can elaborait it more. Please download it and give it a try. Its very simple program with predefined queries for Active Directory. –  infografik Dec 1 '14 at 10:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.