How to get list of users from an OU

Question

How to get list of users from an OU

Art ODell 1

First- I am new at powershell. The issue at hand is that I need to get a list of users from an OU who have not logged on in over 90 days. I have a script that gives my all the users but I need to narrow it down to pull just the users from an OU called XXXX Users. How can I modify my script to pull only those from my target OU?

Art ODell 1

$NumDays = 0
$LogDir = ".Users-Last-Logon.csv"

$currentDate = [System.DateTime]::Now
 $currentDateUtc = $currentDate.ToUniversalTime()
 $lltstamplimit = $currentDateUtc.AddDays(- $NumDays)
 $lltIntLimit = $lltstampLimit.ToFileTime()
 $adobjroot = [adsi]''
 $objstalesearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)
 $objstalesearcher.filter = "(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=" + $lltIntLimit + "))"
 $objstalesearcher.Pagesize=15000

$users = $objstalesearcher.findall() | select `
 @{e={$_.properties.cn};n='Display Name'},`
 @{e={$_.properties.samaccountname};n='Username'},`
 @{e={[datetime]::FromFileTimeUtc([int64]$_.properties.lastlogontimestamp[0])};n='Last Logon'},`
 @{e={[string]$adspath=$_.properties.adspath;$account=[ADSI]$adspath;$account.psbase.invokeget('AccountDisabled')};n='Account Is Disabled'}

$users | Export-CSV -NoType $LogDir

Rich Matheisen 47,901 Reputation points

2022-01-14T03:39:37.373+00:00

If you have more than one domain controller you're going to get inconsistent results. The LastLogonTimestamp is replicated at a random interval between 9 and 14 days. For accurate results you'd have to check each DC and use the property LastLogon. That property is updated on the DC that authenticated the logon and it's not replicated.

Also, I'd be surprised if the value 15000 you've used for Pagesize worked if you actually have that many users in the AD (or OU). Pagesize just determines how many items are returned at one time. I'd drop that number down to, say 1000 or 1500. The AD has a limit on the number of items it will return at one time, and I think it's a lot lower than 15000.

1 answer

Your answer

Art ODell 1 Reputation point

2022-01-13T21:34:02.63+00:00

$NumDays = 0 $LogDir = ".Users-Last-Logon.csv" $currentDate = [System.DateTime]::Now $currentDateUtc = $currentDate.ToUniversalTime() $lltstamplimit = $currentDateUtc.AddDays(- $NumDays) $lltIntLimit = $lltstampLimit.ToFileTime() $adobjroot = [adsi]'' $objstalesearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot) $objstalesearcher.filter = "(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=" + $lltIntLimit + "))" $objstalesearcher.Pagesize=15000 $users = $objstalesearcher.findall() | select ` @{e={$_.properties.cn};n='Display Name'},` @{e={$_.properties.samaccountname};n='Username'},` @{e={[datetime]::FromFileTimeUtc([int64]$_.properties.lastlogontimestamp[0])};n='Last Logon'},` @{e={[string]$adspath=$_.properties.adspath;$account=[ADSI]$adspath;$account.psbase.invokeget('AccountDisabled')};n='Account Is Disabled'} $users | Export-CSV -NoType $LogDir
Rich Matheisen 47,901 Reputation points

2022-01-14T03:39:37.373+00:00

If you have more than one domain controller you're going to get inconsistent results. The LastLogonTimestamp is replicated at a random interval between 9 and 14 days. For accurate results you'd have to check each DC and use the property LastLogon. That property is updated on the DC that authenticated the logon and it's not replicated.

Also, I'd be surprised if the value 15000 you've used for Pagesize worked if you actually have that many users in the AD (or OU). Pagesize just determines how many items are returned at one time. I'd drop that number down to, say 1000 or 1500. The AD has a limit on the number of items it will return at one time, and I think it's a lot lower than 15000.

Answer 1

Andreas Baumgarten 123.6K MVP Volunteer Moderator

Hi @Art ODell ,

maybe these links are helpful:
https://shellgeek.com/powershell-get-ad-user-not-logged-in-x-days/
https://www.winsysadminblog.com/2017/07/get-a-list-of-users-in-active-directory-who-have-not-logged-in-for-specified-number-of-days-using-powershell/

In this examples the command Get-AdUser is used and with -Searchbase you can limit the search on a OU:
https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps#example-1--get-all-of-the-users-in-a-container

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Art ODell 1 Reputation point

2022-01-14T19:45:09.71+00:00

The links were very helpful, thank you!! I am now trying to export the data to csv format, but my csv file has nothing in it after I run it but the headers. I have added my code. ugh!!

Art ODell 1

Get-ADUser -Filter {Enabled -eq $TRUE} -SearchBase "OU=xxxx Users,DC=xxxx,DC=local" -Properties Name,SamAccountName,LastLogonDate | 
Where {($_.LastLogonDate -lt (Get-Date).AddDays(-90)) -and ($_.LastLogonDate -ne $NULL)} | 
Sort | Select Name,SamAccountName,LastLogonDate
Get-process | Select-Object -Property Name, SamAccountName, LastLogonDate | 
Export-CSV -Path C:\xxxx\Lastlogon.csv -NoTypeInformation

Rich Matheisen 47,901 Reputation points

2022-01-14T19:55:40.883+00:00
The -Filter string is incorrect.

Get-ADUser -Filter "Enabled -eq 'true'" . . .

Also, line #3 doesn't pipe the result of the previous code to anything. And line #4 is selecting properties that don't exist (except for "Name" from a Get-Process cmdlet) which is then exported to your CSV.

Share via

How to get list of users from an OU

1 answer

Your answer