Query, expired accounts, Active Directory Users and Computers

Do you know how to set query to find expired accounts on Active Directory Users and Computers?
Hiroyuki TamuraField EngineerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MaheshArchitectCommented:
use ad info tool from CJADEV, it has everything

http://www.cjwdev.com/Software/ADReportingTool/Download.html
0
Klavs RDeveloper, owner of AlbusBitCommented:
You need to create new custom search query in ADUC (Saved Queries -> New -> Query -> Define Query... -> Find: Custom Search -> Advanced).
Use this LDAP Query to get users whose account has expired today or earlier.
(objectCategory=person)(objectClass=user)(accountExpires<=131574168000000000)

Open in new window


To customize accountExpires filter, you need to convert the date to integer8 type. You can do it in PowerShell:
PS (Get-Date "11/12/2017").ToFileTime()
131574168000000000

PS [datetime]::FromFileTime("131574168000000000")
Monday, December 11, 2017 at 00:00:00

Open in new window

0
Kevin StanushApplication DeveloperCommented:
You can use a tool like Hyena to get this information.  Hyena's query library contains a number of pre-defined queries or you can create your own to do this:

  Hyena's Query Library
Its got a 30-day fully functional trial, as well as free support.
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Shaun VermaakTechnical Specialist IVCommented:
Alternatively, you can configure and schedule this tool and never worry about it again
https://www.experts-exchange.com/articles/30820/Active-Directory-Cleanup-Tool-ADCleanup.html
1
Ajit SinghCommented:
Dsquery can be used to get inactive users

dsquery user domainroot -name -inactive 30

Also, there are a bunch of great powershell scripts out there. Powershell is great for managing Active Directory.

However, few more Active Directory clean up solutions out there you can check like; this free ADCleanup, lepide and manageengine to find expired accounts.

Hope this helps!
1
Ajit SinghCommented:
Few more informative article I would like to share:

Active Directory Saved Query Expired Accounts:
https://www.experts-exchange.com/questions/28092283/Active-Directory-Saved-Query-Expired-Accounts.html

Powershell – Expiring and Expired AD Account Notification
https://jeffbotsford.wordpress.com/2011/12/27/powershell-expiring-and-expired-ad-account-notification/
0
Kevin StanushApplication DeveloperCommented:
Technically, you can't do this in ADUC.  ADUC lacks an option to customize the display fields that it offers beyond a hard-coded set of columns.  While you can modify it to allow any column to be displayed, its not easy, and probably not a good idea.  Once modified, you can then just sort on the expiration date and look at the cutoff you are wanting.  But like I said, the mod isn't easy and is sort of a 'voids the warranty' kind of thing.

Having a list of 'expired' accounts without knowing what the account expiration date is/was is not very useful, and the LDAP query language does not have a concept of 'today', so the date is always changing.  The EE link provided by Ajit Singh discusses this in detail.

The only (easy) way to do this is to use a 3rd party tool like has been mentioned or Powershell. ADUC is not designed to be very flexible or useful outside of what Microsoft designed it for.  I also checked and ADAC isn't much better and could not find a way to do it in ADAC either.  This is why there are a lot of 3rd party AD management tools (and Powershell).
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Hiroyuki TamuraField EngineerAuthor Commented:
Thank you!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.