Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do i find new Active Directory accounts that have been made in the last 90 days?

does anyone know who to do this? I can't figure it out.

Thanks in advance.

share|improve this question

5 Answers 5

up vote 11 down vote accepted

For posterity, dsquery is designed for this kind of search. AD does keep a 'whenCreated' field, which makes it easy to search with your tool of choice.

dsquery * -filter "(whenCreated>=20101022083730.0Z)"

As an example. You can programatically create the timestring based on now - 90days.

share|improve this answer
+1 may want to use "(&(objectClass=user)(whenCreated>=20101022083730.0Z))" to filter out computers and other objects. – jscott Oct 25 '10 at 21:24

Try the following to pull users created in the last 30 days.

Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge ((Get-Date).AddDays(-30)).Date}
share|improve this answer
While this answer technically works, it's not very efficient particularly in large AD environments with thousands of users. You're essentially querying AD for all users and then in memory on your local machine filtering out the ones that meet the "where" criteria. Instead, you should actually use the Filter argument (or LDAPFilter) to filter the results before they make it back to your machine and avoid the Where pipe altogether. – Ryan Bolger Aug 28 at 21:14

Using PowerShell and the Quest ActiveRoles Tools for AD (found here - ,

Get-QADUser -CreatedAfter (Get-Date).AddDays(-90)

will give you output to the console or wherever you redirect of all users created in the last 90 days.

share|improve this answer

You can do this pretty easily with dsquery

Here's an opposite but related problem

Dsquery docs

share|improve this answer

Here's an example from another site of someone retrieving all AD accounts sorted by creation date:

You can get the creation date for each account from Active Directory. Every AD object has a WhenCreated and WhenChanged attribute. You can dump these attributes into a flat file using the LDIFDE utility, or you can dump them into a comma-delimited file using CSVDE (both utilities come with Windows 2000).

Here's the syntax to dump the two attributes for the user objects in an OU called Phoenix in a domain called to the console for viewing (the entire entry should typed as a single line):

ldifde -d ou=phoenix,dc=company,dc=com -l whencreated, whenchanged -p onelevel -r "(ObjectCategory=user)" -f con

If you wanted to save the dump to a file, change the -f switch from con to a file name.

The last logon timestamp uses this format: YYYYMMDDHHMMSS, with the hour shown in Universal Coordinated Time. A time stamp of 20040115182937.0Z corresponds to Jan 15 2004 18:29:37 UCT.

USRSTAT is slow, and the report you get has to be merged with the LDIFDE dump. So, I put together a script that searches for user objects at each domain controller, then lists the local logon time and the creation time. The user logon timestamp requires conversion from a long integer. I borrowed the conversion code comes from Richard L. Mueller ( Richard's full script also takes the local time zone from the Registry and converts the time from UCT to local time. Nifty

share|improve this answer

protected by Michael Hampton Aug 28 at 19:52

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.