Home / server / Questions / 55939
Accepted
Neobyte
Asked: 2009-08-19 21:23:27 +0800 CST

Query enabled but not expired users in AD

  • 772

How can I query AD to give me all users that are enabled, but not expired? I use the QuestAD tools with PowerShell but it doesn't have a "-NotExpired" option or equivalent with Get-QADUser.

I would prefer a PowerShell solution if possible to make it easier for me to play with the data.

active-directory

4 Answers

  1. Best Answer
    Get-QADUser -Enabled -SizeLimit 0 | where {-not $_.AccountIsExpired}
    • 1

  2. Never mind - seems the object itself has a boolean "AccountIsExpired" flag I can test for.

    • 0

  3. Get-QADUser -Enabled -AccountNeverExpires -SizeLimit 0

    • 0

  4. You should be able to do this with a ADO ADSI query:

    (&(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))(|(accountExpires=9223372036854775807)(accountExpires=0)))

    will give all the non-disabled accounts that don't expire.

    (&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(accountExpires<=127818648000000000))

    will give you all of the non-disabled user objects that expired before 1/16/2006

    Here's an example of how to do an ADO ADSI query:

    $strbase = "<LDAP://dc=ms,dc=com>" 
$strFilter = "(&(objectcategory=user)(useraccountcontrol=66048))" 

$strAttributes = "sAMAccountName,displayname" 
$strScope = "subtree" 
$strQuery = "$strBase;$strFilter;$strAttributes;$strScope" 

$objConnection = New-Object -comObject "ADODB.Connection" 
$objCommand = New-Object -comObject "ADODB.Command" 
$objConnection.Open("Provider=ADsDSOObject;") 
$objCommand.ActiveConnection = $objConnection 
$objCommand.CommandText = $strQuery 
$objRecordSet = $objCommand.Execute()

    And according to this post... you'll get the answer much quicker this way then you would with a cmdlet. Also here is a great guide to ADO ADSI, it's references VBscript examples, but you can easily translate the concepts back to Powershell.

    • 0