How do I find new Active Directory accounts that have been made in the last 90 days?

Question

How do i find new Active Directory accounts that have been made in the last 90 days?

does anyone know who to do this? I can't figure it out.

Thanks in advance.

Answer 1

For posterity, dsquery is designed for this kind of search. AD does keep a 'whenCreated' field, which makes it easy to search with your tool of choice.

dsquery * -filter "(whenCreated>=20101022083730.0Z)"

As an example. You can programatically create the timestring based on now - 90days.

Answer 2

Using PowerShell and the Quest ActiveRoles Tools for AD (found here - http://www.quest.com/powershell/activeroles-server.aspx) ,

Get-QADUser -CreatedAfter (Get-Date).AddDays(-90)

will give you output to the console or wherever you redirect of all users created in the last 90 days.

Answer 3

You can do this pretty easily with dsquery

Here's an opposite but related problem

Dsquery docs

Answer 4

Here's an example from another site of someone retrieving all AD accounts sorted by creation date:

http://www.experts-exchange.com/Security/Operating_Systems_Security/Windows/Q_21117191.html

You can get the creation date for each account from Active Directory. Every AD object has a WhenCreated and WhenChanged attribute. You can dump these attributes into a flat file using the LDIFDE utility, or you can dump them into a comma-delimited file using CSVDE (both utilities come with Windows 2000).

Here's the syntax to dump the two attributes for the user objects in an OU called Phoenix in a domain called Company.com to the console for viewing (the entire entry should typed as a single line):

ldifde -d ou=phoenix,dc=company,dc=com -l whencreated, whenchanged -p onelevel -r "(ObjectCategory=user)" -f con

If you wanted to save the dump to a file, change the -f switch from con to a file name.

The last logon timestamp uses this format: YYYYMMDDHHMMSS, with the hour shown in Universal Coordinated Time. A time stamp of 20040115182937.0Z corresponds to Jan 15 2004 18:29:37 UCT.

USRSTAT is slow, and the report you get has to be merged with the LDIFDE dump. So, I put together a script that searches for user objects at each domain controller, then lists the local logon time and the creation time. The user logon timestamp requires conversion from a long integer. I borrowed the conversion code comes from Richard L. Mueller (www.rlmueller.net/Programs). Richard's full script also takes the local time zone from the Registry and converts the time from UCT to local time. Nifty