Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a monitoring vbscript for active directory. I need to export to a file all users that were modified. This script will run every 10 minutes and export all modified users (account modified, date modified, who modified). The same thing for group modifications (different output file).

I dont mind using vbscript, csvde or dget, dsquery or a batch to get those information's. Anything that I can set up a schedule task is ok.

share|improve this question

You can do most of this with powershell and LDIF - the snippet below for example will produce a file called ad.txt that has a list of user objects changed or added in the last ten minutes

$DateString = (Get-Date).AddMinutes(-10).ToString("u") -Replace "-|:|\s"
$DateString = $DateString -Replace "Z", ".0Z"
$LdapFilter = """" + "(&(|(whenChanged>=" + $DateString + ")(whenCreated>=" + $DateString + "))(objectClass=user))" + """" 
$lCmd = "ldifde -f ad.txt -r " + $LdapFilter + " -l ""dn,whenCreated,whenChanged"""
Invoke-Expression $lCmd
share|improve this answer
Thanks Phil, unfortunately I can't have access to powershell (dont ask why). Can I use vbscript to do this? – name Dec 5 '11 at 13:17
You probably can but I'm not a VB expert - a quick google reveals it has a DateAdd function that will do a similar thing to the AddMinutes bit above – Phil Dec 5 '11 at 13:36
please help. any vbcode will do. I just googled for what you've told me like 6 hours – name Dec 5 '11 at 13:37
@name We're not here to do your job for you... – MDMarra Dec 5 '11 at 14:29
@MarkM i know but I could not get that to work. and the powershell code is not working also... :( – name Dec 5 '11 at 14:42

Okay, I found this on TechNet:

Monitor Groups in an OU in AD for changes on Group Membership

This script runs on a scheduled task to monitor and alert for changes in Active Directory. Any changes to group membership will cause an alert email to be created with the changes included.

The script saves the current members of the Groups in an XML document and then compares the live directory every X minutes. The script will not detect changes within the time period the scheduled task is run i.e. if a member was added and removed in between the task running no changes will be detected.

I run the script every 15 minutes and find it highly effective.

It detects changes to User, Computer or Groups accounts.

Thanks Ben Wilkinson!

share|improve this answer

This sounds like it would be a simple request, but it quickly becomes boiling the ocean.

While there are commercial products that do this (and the reasons will become apparent), basically you need to run your query (all users where date modified is < 10 minutes ago). Unfortunately, this won't tell you what has changed. I don't think it will tell you who has made the change, either (You may be able to put it together with Event Viewer AD Logs.) (I'm not positive, but this may also pick up password changes.)

What you would also need to do to complete that picture, you basically need to export every user and all of their properties, and keep time-stamped records of them.

At this point, I'd like to point out that you're making multiple separate databases that contain (a subset) of the contents of Active Directory.

After you have your list of users-changed, you then have to do a diff on the object's current and previous state, and present that data to whomever cares.

Then, at some point, you're going to have to clean things up, because keeping multiple copies of your AD objects around is going to start taking up space... Once the report of the changes is out, you only really need to keep the current and immediately previous record.

Depending on the number of users in your environment, the number of people who can make changes (admins, helpdesk, etc), and the frequency of those changes, this could very easily get unmanageable fast.

Honestly, Unless you're trying to quickly discover wrongdoing, 10 minutes is probably overkill; I would do no more than an hour, and probably a daily record.

But, here are some places to get you started:

share|improve this answer
well i do not want to get to databases, paid solutions and etc. all I've got now is: CSVDE -f -%date:~-10,2%_%date:~-7,2%_%date:~-4,4%.csv -d "OU=test,OU=test,OU=test,DC=test,DC=test" -r "(&(objectClass=user)(whenCreated>=%date:~-4,4%%date:~-10,2%%date:~-7,2%000000.0‌​Z)(whenCreated<=%date:~-4,4%%date:~-10,2%%date:~-7,2%235959.0Z))" -l "employeeID, sn, givenName, sAMAccountName" – name Dec 5 '11 at 12:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.