Find Inactive Users using Powershell

This is a quick hitter that came about when I was chatting with a few friends online.   We were talking about finding inactive users using powershell.   We also wanted to output their userid(samaccountname) and their last logon time.

In this case the LastLogonTimeStamp attribute was good enough for this query.  Note that this attribute is replicated but it is 9-14 days behind the current date

For full disclosure this is something I'd usually use oldcmp for but in this case the customer wasn't allowing third party tools.

The main problem I was having was the output of LastLogonTimeStamp via powershell.  The date doesn't get automatically converted from its native 64 bit format.  Luckily the Microsoft team has included the LastLogonDate which is the conversion of the LastLogonTimestamp.  MVP Richard Mueller has a great explanation of the LastLogonDate attribute in Powershell    It is important to emphasize that LastLogonDate is not an actual Active Directory attribute.  LastLogonDate was key otherwise it makes this query more complex because we would have had to include a conversion into the command.

For the query I went with the search-adaccount cmdlet.  We were looking for accounts that had not been active within 90 days

search-adaccount -usersonly -accountinactive -timespan "76" | select-object samaccountname, lastlogondate

If you want to export that to a CSV then that command can be piped into export-csv

search-adaccount -usersonly -accountinactive -timespan "76" | select-object samaccountname, lastlogondate | export-csv Users.csv

Why did I choose 76 instead of 90?  That goes back to the DS blog about lastlogontimestamp being up to 14 days behind.

Active Directory Administrative Center also has some handy built-in searches that can help if you prefer a GUI

Update  Good friend and Microsoft PFE Eric J suggested that I add a screenshot with the Windows 2012 version of ADAC and the powershell history viewer output.  Great suggestion Eric!

The powershell command in the history viewer is interesting. I like the version above a lot better :)

Get-ADObject -LDAPFilter:"(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(|(lastLogonTimestamp<=129888720000000000)(!lastLogonTimestamp=*)))" -Properties:allowedChildClassesEffective,allowedChildClasses,lastKnownParent,sAMAccountType,systemFlags,userAccountControl,displayName,description,whenChanged,location,managedBy,memberOf,primaryGroupID,objectSid,msDS-User-Account-Control-Computed,sAMAccountName,lastLogonTimestamp,lastLogoff,mail,accountExpires,msDS-PhoneticCompanyName,msDS-PhoneticDepartment,msDS-PhoneticDisplayName,msDS-PhoneticFirstName,msDS-PhoneticLastName,pwdLastSet,operatingSystem,operatingSystemServicePack,operatingSystemVersion,telephoneNumber,physicalDeliveryOfficeName,department,company,manager,dNSHostName,groupType,c,l,employeeID,givenName,sn,title,st,postalCode,managedBy,userPrincipalName,isDeleted,msDS-PasswordSettingsPrecedence -ResultPageSize:"100" -ResultSetSize:"20201" -SearchBase:"DC=MK2012,DC=com" -SearchScope:"Subtree" -Server:"w2012DC1.MK2012.com"


The issue I have with the ADAC method is that it doesn't allow the user to export the findings and include the   LastLogonTimeStamp date in a converted form.


I'm looking forward to other suggestions comments on how to improve this powershell command.   Remember we are talking quick-hitter one liner here.

Is It a Domain Controller

I recently went into our test lab and there was a guy working in there and he asked me.

If I'm on a machine how do I know if it is a Domain Controller

These are often my favorite types of questions.  No time to check Bing/Google, no time to check a book.  Just a quick question that is answered in seconds.   By the way in those situations it is also ok to say "I don't know" or "I'll get back to you".  A lot of times you will see people blowing smoke and making stuff up.

The guy wasn't trying to be an ass but trying to learn AD and the lab is a perfect place for it.  We have a lot of VMs in our lab and I didn't know what box he was on when I walked in.

My initial thought was to tell him to look for admin tools etc but then after a second I realized not every box has the admin tools installed.  Then I thought look for the AD Domain Services and see if they are started.  That thought lasted for a half second.  We still have 2003 DCs too so if he was on one of those then no services.

The answer I gave him was to run:

net share 

If the sysvol share is present then it is a domain controller.

I started thinking of other ways and reached out to some friends and asked what they would have suggested for this quick question.


One suggestion by my friend Troy was to run


netdom query dc


I thought that was a good one and team that with hostname so that the person knows the name of the machine works great.

My buddy Eric had a good one, it is a bit more involved because it would require the person to know about AD ports...but if they are learning they should know some of these. Use netstat -ano and look for AD ports (88, 389, 3268, and others)

netstat -ano  or netstat -ano | findstr /i listening

There are a lot of ways to do this.  You could look for SRV records.  If ADUC was installed you could have them check there for the DC.

If you also look at the drop down when you login and it has no local server name then that is another good indication.  In this case he was already logged in.

So what answers would you have given?  Are there quicker easier ways that you would have told someone just starting out with AD to check if they are at a domain controller?

Update from Kurt (thanks for your service in the Army...in war zones).    I posed this question to a mid-level AD admin.  His response was "run dcpromo, it will tell you if it is a DC".   That is true and something I didn't think of in the 5 second response.  This is why I love AD...so many ways to do something and a lot of great solutions.

My only caveat about this method is that if someone was being careless didn't read and clicked next next and finished the wizard then they could also be demoting a DC....I'm hoping people using AD can read :)

In the example below the computer is obviously a DC.

Note: The dcpromo method won't work in Windows 2012...because they killed that off...more on that in future posts.   I'm guessing very few folks are currently running Windows 2012 in production.  Example of start > run > dcpromo on a Windows 2012 DC below.

Update 2: Krzystof  had a great suggestion in the comments and that was to use systeminfo 

systeminfo /i "os configruation"

Speaking at Microsoft TechGate Conference on 9/15

This mainly applies to readers that are in the DC, Virginia, and Maryland region as I don't think anyone is going to fly in for this :)

Microsoft is sponsoring TechGate 2012 on September 15, 2012 at their Reston, VA office.  There are 15 sessions and five workshops so it should be a good day.  It will also not be 100 degrees every day by that time so come out if you can.

You can find more information and register for the conference here:

http://techgateconference.com/

As you can see I will be speaking about new Active Directory features in Windows Server 2012.  I'm really looking forward to it.  l'm also hoping to devote 10 minutes at the end to discuss what features folks would like to see in R2 or future versions.  That is feedback I'll take back to the AD team during the MVP summit in early 2013.

I'm really looking forward to meeting other members of the DC IT community in a few months.

MVP Award - Year Four

I woke up yesterday to great news that I've been awarded the MVP award in Directory Services for the fourth year.  I have previously written blogs with long thank you lists so I won't do that again.  Just a continued huge thanks to everyone I mentioned in those two blog entries.  I've learned from a lot of people and glad to help others.

My favorite part about being an MVP is the MVP summit and I'm really looking forward to going to Seattle again in the late winter.

This is an exciting time for Active Directory.  Windows 2012 is being released later this year.  Windows Azure Active Directory is coming online.  We will have a lot to learn but that is the fun part for me.

Outstanding Cloud & Identity Talk

I generally don't post videos or presentations as blog entries but this is one I haven't seen posted by a lot of folks and is a must watch for anyone in the Identity, Active Directory, Directory Services field.

The main reason I love this talk is because the presenter.  Microsoft's Kim Cameron     Kim is the Chief Architect of Identity in the Identity and Access Division at Microsoft.  In other words when it comes to anything Active Directory/DS.  Kim is "the man"

Vittorio had an excellent blog about Kim   (Kim was retiring when that blog was written but has come back and he talked about that in this presentation)

This is a twenty minute Kim's keynote from the European Identity & Cloud Conference 2012.

Some things I liked

• Use the efficiencies of the cloud to enable efficiencies in identity
• The Cloud Motor Runs on Identity
• Identity Management as a service is an inevitability
• There ae other vendors who have similar directories...not as good of course :)

There are a lot of people that talk about the cloud and give talks.  This is one from a guy who truly knows his stuff.   Kim also has an excellent blog entry that goes with this video.

I'm personally excited that AD and Directory Services types can evolve our skills and have work for years to come.

New MCSE - Personal FAQs

As most blog readers know Microsoft has brought back the MCSE & MCSA certifications and titles.  For those newer to the field the MCSE was one of Microsoft's most popular certifications and tracks.  I'm on the AD/Server side of the house so for me this goes back to an MCSE in Windows NT, 2000, & 2003.

With the 2008 tracks Microsoft did away with the MCSE & MCSA and introduced the MCITP an MCTS tracks and certifications.

The MCSE and MCSA are back again but this time they stand for

Microsoft Certified Solutions Expert
Microsoft Certified Solutions Associate

The Microsoft Learning team has put together a nice page with a lot of information.

MSCE: Reinvented for the Cloud

There are also some good videos on the site and the Microsoft Learning YouTube Channel

There was a lot of great information on the site, but I still had questions and after asking around I noticed others had the same questions.  MSLearning has a Twitter Account and that is where I learned a lot more about the new certs and the future. I compiled some of my FAQs here:

MK FAQ 1 : What happens if I have the MCITP:SA do I need to start from scratch?

So that was good news, as you can see the MCITP:SA will automatically receive the new MCSA: Windows Server 2008 Certification.

MK FAQ 2 : What happens if I have the MCITP:EA?

This was interesting because the MCITP: EA and MCITP: SA will both have the same MCSA: WS2008 title.   I was hoping for two certs as I have both :)   

Note: It was common for people to get both the MCITP:EA and MCITP:SA certifications.

MK FAQ 3 : When will our transcripts be updated?

According to the twitter conversation above transcripts should change on April 24, 2012.

UPDATE:  Blog reader let me know in the comments that his transcript was updated on 4/17/2012.  Nice job by Microsoft getting ahead of schedule.

MK FAQ 4 : What happens to our old certifications?

This one I really like a lot!   I like that old certs will enter a legacy state and be stated that way on the official Microsoft transcript.

I also like that new exams and certifications will also retire.  It makes people need to stay somewhat current and re-certify.  Other companies already use the model the most famous probably being Cisco.   

I know there are going to be cynics out there that remember MCSE's being referred to as "paper tigers" or MCSEs that got their certs through brain dumps and that made us all look bad but Microsoft is definitely moving in the right direction in my opinion.

I'll take an analogy from the Army.  Every Army soldier goes through bootcamp and has "basic" skills but there is a lot more training and experience needed to become a Ranger or Special forces and deal with the advanced issues/topics.   That is how I look at a lot of these certs (from any company).  They are a good step but getting an MCSA or MCSE doesn't mean someone knows everything....it is an ongoing process.

One of my AD Heroes is Joe Richards and he once rated himself a 6 out of 10 in AD.   Again it is a lifelong learning process...no one knows it all not even a guy like Joe (love how humble and cool he is)

I'd like to hear from the community.  What do you think about the new changes and updates?

Security Compliance Manager 2.5 Released

Ned Pyle wrote a blog entry in January on the  Microsoft askds blog  about Security Compliance Manager 2.5 Beta

The tool has been officially released and is no longer in beta.

From the download center

We are pleased to announce that version 2.5 is released and now available for download from the Microsoft Download Center!

          Download SCM 2.5 now


I've been testing 2.5 Beta and really glad that it is now out of beta as it will be much easier to get the tool approved for use where I work.

You can read about the key features & benefits on the Microsoft site so I won't copy and paste them again here.

There will be follow up blog posts with more info and screen shots from the tool.