One of the enhancements of the 1.0.5 release is more attributes being exposed in their native formats. For example, AD cmdlets automatically convert the properties which should be date/time to the DateTime time so you don’t have to worry about the conversions and can just work with them.
Let’s see which Date/Time attributes my account has:
Get-QADUser "Dmitry Sotnikov" -IncludeAllProperties | Get-Member -MemberType NoteProperty | where {$_.Definition -like "*DateTime*" } | Format-List Name, Definition
Name : accountExpires
Definition : System.DateTime accountExpires=12/31/9999 11:59:59 PM
Name : badPasswordTime
Definition : System.DateTime badPasswordTime=10/29/2007 1:22:06 PM
Name : createTimeStamp
Definition : System.DateTime createTimeStamp=6/16/2004 3:59:22 PM
Name : lastLogoff
Definition : System.DateTime lastLogoff=1/1/1601 12:00:00 AM
Name : lastLogon
Definition : System.DateTime lastLogon=10/30/2007 12:04:22 PM
Name : lockoutTime
Definition : System.DateTime lockoutTime=1/1/1601 12:00:00 AM
Name : modifyTimeStamp
Definition : System.DateTime modifyTimeStamp=10/29/2007 12:20:24 AM
Name : pwdLastSet
Definition : System.DateTime pwdLastSet=8/27/2007 4:09:54 PM
Name : whenChanged
Definition : System.DateTime whenChanged=10/29/2007 12:20:24 AM
Name : whenCreated
Definition : System.DateTime whenCreated=6/16/2004 3:59:22 PM
Let’s see what I was doing in the command above:
- I retrieved my user object using Get-QADUser and supplying the name.
- Used -
IncludeAllPropertiesto make the cmdlet retrieve all AD attributes and not just the default set (which would not have:createTimeStampandmodifyTimeStamp). - Used Get-Member and Where to only leave Property members of the DateTime type.
- Formatted the output as a list with the names and definitions (type and value).
Note that you can operate DateTime values for filtering too.
For example, to see a list of accounts which never logged on this year you would do:
$threshold = (Get-Date).AddYears(-1)
Get-QADUser -IncludedProperties lastLogonTimestamp | where { $_.lastLogonTimestamp -le $threshold }
Pretty straight-forward, right? 
Note:
- To have lastLogonTimestamp replicated between DCs the domain should be in Windows 2003 mode.
- If your domain is still in Windows 2000 mode, you have to query for lastLogon from each DC (for every user), as lastLogon is a non-replicated attribute.
- lastLogonTimestamp is updated each 14 days by default (in reality it is more often): http://msdn2.microsoft.com/en-us/library/ms676824.aspx.
Tags: AD, AD cmdlets, Active Directory, Examples, PowerShell, one-liner, oneliner
Subscribe by email
