How to run a script or program that counts how many accounts don't have something checked in Active Directory

Is there a way I can run something that I can see if I don't have an option checked in the Account tab of active diretory and lets me know who or how many accounts don't have something checked ?

Example I want to see how many accounts don't have check "Smart card is required for interactive logon"

Also I don't have access to the server just access to make changes to AD.
sstretchhAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

iarlaCommented:
Hi there

Have a look at the following:

http://www.eggheadcafe.com/conversation.aspx?messageid=32069750&threadid=32069744

The code is written in VBScript
0
Mike KlineCommented:
what I'd go with is adfind by MVP Joe Richards
http://www.joeware.net/freetools/tools/adfind/index.htm
So some AD attributes are bit flags which means and expressed as integers.  Useraccountcontrol is one of them and needed here.   Joe also has a really good blog entry about it here:
 http://blog.joeware.net/2008/09/05/1453/
Smart Updates of bitwise attributes
So to get your query using adfind
adfind -default -bit -f  "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:1.2.840.113556.1.4.802:=262144)" samaccountname -nodn
That will return the samaccountname with all users that don't have "Smart card is required for interactive logon" checked
...want to know which ones have it checked just remove the ! before useraccountcontrol
Thanks
Mike
 
0
sstretchhAuthor Commented:
I have writes to get in AD but I am doing this from XP and not from the server itself. I see that this runs in the command prompt and able to run it but it's returning 0 results. Any ideas ??

As for the first comment up there with the link to the VB script it actually needs a lot of tweaking but working with the code to see what I can do with it
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Mike KlineCommented:
You can take out the part that checks for the checkbox just to make sure you are getting results for users

adfind -default -f  "&(objectcategory=person)(objectclass=user)" samaccountname -nodn
That will give you all your users.  Just as a test.  Running from XP is fine.
Thanks
 
Mike
0
sstretchhAuthor Commented:
ok that gave me the results of all the different types of users
0
sstretchhAuthor Commented:
Even If i could use the search option that is built into AD that would be great just can't find the right options to search.
0
Mike KlineCommented:
oh boy...I just noticed a typo.  SORRY about that
 
adfind -default -bit -f  "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:1.2.840.113556.1.4.803:=262144)" samaccountname -nodn
I had .802 in the original
Thanks
Mike
0
Mike KlineCommented:
If you wanted to use the search in AD you can use an LDAP query (custom search)
See screenshot
Thanks
Mike
 

AD-search-non-smartcard.jpg
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sstretchhAuthor Commented:
You were very helpful thanks, this is exactly what I was trying to do. We get audited if we don't have over a certain percantage of people we don't set back to CAC card. Now are section can look are self to see who we are missing.
0
Mike KlineCommented:
CAC card...must be DoD :)  Hoooaaahh!!!
Glad I was able to help
Thanks
Mike
0
sstretchhAuthor Commented:
;-P ssssssssssssssshhhhhhhhhhhhh

I am not the admin you are looking for
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.