• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4200
  • Last Modified:

Get-ADUser - Account created by?

Hey guys, trying to run the following PS to get a list of user accounts created in the past 30 days.

Question, is there a way to pull the account/user that created the new account?

Import-Module ActiveDirectory
$date = get-date
Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge ((Get-Date).AddDays(-30)).Date} | Select GivenName, Surname, Name, UserPrincipalName, SamAccountName, whenCreated, Enabled | Export-Csv C:\Scripts\Reports\ADUsersCreatedLast30Days.csv
0
GCTTechs
Asked:
GCTTechs
  • 2
2 Solutions
 
becraigCommented:
There is a great tool you can use to find out this information if you already have the required level of auditing turned on.
http://www.netwrix.com/active_directory_auditing.html

If you have not been auditing user creation etc that information might be lost to you.
0
 
Premkumar YogeswaranCommented:
For pulling the owner of an object, we need to use Get-ACL command-let

Open PowerShell

ipmo activedirectory
Set-Location AD:
Get-Acl "Distinguished name" | Fl Path,owner

Open in new window


Note: If object is created by Domain Admin, then owner will be displayed as Domain Admin Else it will display the name of user created the object.
0
 
Premkumar YogeswaranCommented:
For Bulk user:

ipmo activedirectory
Set-Location AD:
Import-CSV ./User.csv | % { Get-Acl $_.UserDN | Select Path,owner | Export-Csv C:\temp\Owner_info.csv }

Open in new window


Note: Input should be as DN
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now