ADUC Disabled Users Query

Question

Hello,

I am trying to edit a query in ADUC so I can look at users disabled 360 days+. Currently, in the common queries, the number of days can only go up to 180. I was going to edit this query but, the query string shows this message, "The query is valid but will not be shown here because it contains values that must be computed when the query is run." Can someone please advise how to either find the query for editing or create a new query string for this request?

Answer 1

Hello @Asheliza ,

Thank you so much for posting here.

I have checked in my lab, if we choose 180 under Days since last logon, it will show the message as shown below.

As for our requirement to query the users disabled 360 days, I found this way and we could test to see whether it helps.

(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))

(&(whenChanged>=20200401070000.0Z)(whenChanged<=20210501065959.0Z))

Please change the time according to our specific scenario.

Or it is suggested that we could use powershell to do this query. For more information, we could refer to:
https://social.technet.microsoft.com/Forums/sharepoint/en-US/262deb3d-45a2-418c-b3de-7ffd5f1cfe17/i-need-last-month-or-last-30-days-disabled-users-list-with-name-samaccount-email-diplayname-and?forum=winserverDS

For any question or concern, please feel free to let me know.

Best regards,
Hannah Xiong