asked on

Active Directory Saved Query Expired Accounts

I am trying to set a query in the Active Directory Saved Queries, to display the Expired Users accounts.
So far the custom query I found was

(&(&(objectCategory=person)(objectClass=user)(!AccountExpires=0)(!AccountExpires=9223372036854775807)))

But it provides all accounts with an expiration date set.

With a different sintax I have tried also the following:

(&(objectCategory=person)(objectClass=user)" _ & "(!accountExpires=9223372036854775807)(!accountExpires=0))

and it gives no result, even knowing that there are expired accounts.
Any better query?
I am not looking for Shell scripts.

Thanks.

Meir Rivkin

the LDAP filter is:

(&(objectCategory=person)(objectClass=user) (!accountExpires=9223372036854775807) (!accountExpires=0))

Open in new window

from http://www.rlmueller.net/AccountExpires.htm
i tried run it using DSQUERY on command line and it worked great.

NSEMonsanto

ASKER

Thanks, however it is like the first query I posted, and shows all users with expiring accounts set (too comprehensive), not expired ones.

Meir Rivkin

try:

(&(objectCategory=person)(objectClass=user)(accountExpires<=128635956000000000)(!accountExpires=0))

Open in new window

NSEMonsanto

ASKER

Same same: no results.
even changing the operators <=> it doesn't make a difference: no users.
Your query makes more sense so far, it looks for accounts that have expired up to date.
However it looks like there should be a sharper definition I cannot get my head around.

Mike Kline

So not willing to use adfind or powershell...do you only want a saved query?

NSEMonsanto

ASKER

Thanks for the effort.
You got it right, I'd like to use the saved query.

C.

ASKER CERTIFIED SOLUTION

Chris Dent

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Shalom Carmel

Theoretically the following answers your question, but it seems not to always work
(objectcategory=user)(userAccountControl:1.2.840.113556.1.4.803:=8388608 )

Try this query to find users who must change password on next login:
(objectCategory=user)(pwdLastSet=0)

Users whose password never expires
(objectcategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

http://www.selfadsi.org/ads-attributes/user-userAccountControl.htm

Chris Dent

8388608 is password expired, not account expired (http://support.microsoft.com/kb/305144). As such, it won't work for accounts that have expired anyway.

Chris

NSEMonsanto

ASKER

Thanks Chris.

Your explanation is sound, and makes a whole lot of sense.
I will then just find the way to translate time into 100ths of seconds.

Cheers,

C.