13

How do i find new Active Directory accounts that have been made in the last 90 days?

does anyone know who to do this? I can't figure it out.

Thanks in advance.

17

For posterity, dsquery is designed for this kind of search. AD does keep a 'whenCreated' field, which makes it easy to search with your tool of choice.

dsquery * -filter "(whenCreated>=20101022083730.0Z)"

As an example. You can programatically create the timestring based on now - 90days.

|improve this answer|||||
  • 8
    +1 may want to use "(&(objectClass=user)(whenCreated>=20101022083730.0Z))" to filter out computers and other objects. – jscott Oct 25 '10 at 21:24
  • This is extremely slow for an active directory with huge amount of accounts. It seems to do a linear pass through the data. – Nicholas DiPiazza Feb 19 '19 at 18:09
8

Try the following to pull users created in the last 30 days.

Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge ((Get-Date).AddDays(-30)).Date}
|improve this answer|||||
  • 4
    While this answer technically works, it's not very efficient particularly in large AD environments with thousands of users. You're essentially querying AD for all users and then in memory on your local machine filtering out the ones that meet the "where" criteria. Instead, you should actually use the Filter argument (or LDAPFilter) to filter the results before they make it back to your machine and avoid the Where pipe altogether. – Ryan Bolger Aug 28 '15 at 21:14
5

An alternative to the Powershell version shown above, that is much more efficient because it does not load all users in memory before filtering them (you should do the filter on the Get-ADUser cmdlet directly and not use a Where-Object):

$now = ((Get-Date).AddDays(-90)).Date
Get-ADUser -Filter {whenCreated -ge $now}
|improve this answer|||||
3

Using PowerShell and the Quest ActiveRoles Tools for AD (found here - http://www.quest.com/powershell/activeroles-server.aspx) ,

Get-QADUser -CreatedAfter (Get-Date).AddDays(-90)

will give you output to the console or wherever you redirect of all users created in the last 90 days.

|improve this answer|||||
0

Here's an example from another site of someone retrieving all AD accounts sorted by creation date:

http://www.experts-exchange.com/Security/Operating_Systems_Security/Windows/Q_21117191.html

You can get the creation date for each account from Active Directory. Every AD object has a WhenCreated and WhenChanged attribute. You can dump these attributes into a flat file using the LDIFDE utility, or you can dump them into a comma-delimited file using CSVDE (both utilities come with Windows 2000).

Here's the syntax to dump the two attributes for the user objects in an OU called Phoenix in a domain called Company.com to the console for viewing (the entire entry should typed as a single line):

ldifde -d ou=phoenix,dc=company,dc=com -l whencreated, whenchanged -p onelevel -r "(ObjectCategory=user)" -f con

If you wanted to save the dump to a file, change the -f switch from con to a file name.

The last logon timestamp uses this format: YYYYMMDDHHMMSS, with the hour shown in Universal Coordinated Time. A time stamp of 20040115182937.0Z corresponds to Jan 15 2004 18:29:37 UCT.

USRSTAT is slow, and the report you get has to be merged with the LDIFDE dump. So, I put together a script that searches for user objects at each domain controller, then lists the local logon time and the creation time. The user logon timestamp requires conversion from a long integer. I borrowed the conversion code comes from Richard L. Mueller (www.rlmueller.net/Programs). Richard's full script also takes the local time zone from the Registry and converts the time from UCT to local time. Nifty

|improve this answer|||||
0

Actually all these answers are not going to work for a huge production AD environments.

The answer is to use DirSync: https://support.microsoft.com/en-us/help/891995/how-to-poll-for-object-attribute-changes-in-active-directory-on-window

Here is a java implementation of this: https://docs.ldap.com/ldap-sdk/docs/javadoc/com/unboundid/ldap/sdk/experimental/ActiveDirectoryDirSyncControl.html

Basically you continuously ask AD for changes based on an incremental token.

|improve this answer|||||
-1

You can do this pretty easily with dsquery

Here's an opposite but related problem

Dsquery docs

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.