Query enabled but not expired users in AD

Question

How can I query AD to give me all users that are enabled, but not expired? I use the QuestAD tools with PowerShell but it doesn't have a "-NotExpired" option or equivalent with Get-QADUser.

I would prefer a PowerShell solution if possible to make it easier for me to play with the data.

Answer 1

Get-QADUser -Enabled -SizeLimit 0 | where {-not $_.AccountIsExpired}

Answer 2

Never mind - seems the object itself has a boolean "AccountIsExpired" flag I can test for.

Answer 3

Get-QADUser -Enabled -AccountNeverExpires -SizeLimit 0

Answer 4

You should be able to do this with a ADO ADSI query:

(&(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))(|(accountExpires=9223372036854775807)(accountExpires=0)))

will give all the non-disabled accounts that don't expire.

(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(accountExpires<=127818648000000000))

will give you all of the non-disabled user objects that expired before 1/16/2006

Here's an example of how to do an ADO ADSI query:

$strbase = "<LDAP://dc=ms,dc=com>" 
$strFilter = "(&(objectcategory=user)(useraccountcontrol=66048))" 

$strAttributes = "sAMAccountName,displayname" 
$strScope = "subtree" 
$strQuery = "$strBase;$strFilter;$strAttributes;$strScope" 

$objConnection = New-Object -comObject "ADODB.Connection" 
$objCommand = New-Object -comObject "ADODB.Command" 
$objConnection.Open("Provider=ADsDSOObject;") 
$objCommand.ActiveConnection = $objConnection 
$objCommand.CommandText = $strQuery 
$objRecordSet = $objCommand.Execute()

And according to this post... you'll get the answer much quicker this way then you would with a cmdlet. Also here is a great guide to ADO ADSI, it's references VBscript examples, but you can easily translate the concepts back to Powershell.