Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I query AD to give me all users that are enabled, but not expired? I use the QuestAD tools with PowerShell but it doesn't have a "-NotExpired" option or equivalent with Get-QADUser.

I would prefer a PowerShell solution if possible to make it easier for me to play with the data.

share|improve this question

4 Answers 4

up vote 1 down vote accepted
Get-QADUser -Enabled -SizeLimit 0 | where {-not $_.AccountIsExpired}
share|improve this answer
    
Bah, old question that has been answered. –  Doug Luxem Sep 3 '09 at 14:04

You should be able to do this with a ADO ADSI query:

(&(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))(|(accountExpires=9223372036854775807)(accountExpires=0)))

will give all the non-disabled accounts that don't expire.

(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(accountExpires<=127818648000000000))

will give you all of the non-disabled user objects that expired before 1/16/2006

Here's an example of how to do an ADO ADSI query:

$strbase = "<LDAP://dc=ms,dc=com>" 
$strFilter = "(&(objectcategory=user)(useraccountcontrol=66048))" 

$strAttributes = "sAMAccountName,displayname" 
$strScope = "subtree" 
$strQuery = "$strBase;$strFilter;$strAttributes;$strScope" 

$objConnection = New-Object -comObject "ADODB.Connection" 
$objCommand = New-Object -comObject "ADODB.Command" 
$objConnection.Open("Provider=ADsDSOObject;") 
$objCommand.ActiveConnection = $objConnection 
$objCommand.CommandText = $strQuery 
$objRecordSet = $objCommand.Execute()

And according to this post... you'll get the answer much quicker this way then you would with a cmdlet. Also here is a great guide to ADO ADSI, it's references VBscript examples, but you can easily translate the concepts back to Powershell.

share|improve this answer

Get-QADUser -Enabled -AccountNeverExpires -SizeLimit 0

share|improve this answer
    
Doesn't cover accounts that are enabled and have an expiry date set in the future - which I want to see. –  Neobyte Aug 20 '09 at 5:06
    
Check this parameters as well: -AccountExpiresAfter <DateTime> -AccountExpiresBefore <DateTime> You can also reverse AccountNeverExpires: -AccountNeverExpires:$false –  Shay Levy Aug 20 '09 at 16:39

Never mind - seems the object itself has a boolean "AccountIsExpired" flag I can test for.

share|improve this answer
    
Glad you've resolve this issue. Please be sure to mark your answer as "accepted" when you are able. –  jscott Jul 25 '12 at 1:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.