Active Directory export users in security group with select properties

Question

Active Directory export users in security group with select properties

NIT1100011 1

I have a security group. All members in this group, and nested groups, I need to extract the display name, creation date, password last changed, and one or two other properties. The Get-ADGroupMembership does not contain these properties.

I am trying to do something like (I know this is way off but it illustrates the end goal logic to you I believe:

$sam= Get-ADGroupMember -id "Sample Security Group" -Recursive |select sama*

Get-ADUser -Properties * -id $sam |select name,whencreated,passwordlastset,enabled,lastlogondate

Newbie Jones 1,386 Reputation points

2022-05-26T11:45:38.017+00:00
I cry internally when I see -properties * (from a performance perspective of course).

If you have a group with a 1000 user, its is returning all attributes for those 1000 users which you are then dropping with the select-object. Let's just get the one we need.

Get-ADUser -Properties whencreated,passwordlastset,enabled,lastlogondate -id $_.samaccountname | Select-Object name,whencreated,passwordlastset,enabled,lastlogondate

On a side note, lastlogondate is a converted version of lastLogonTimestamp.

It is replicated across domain controllers, but LastLogonTimeStamp only updates in relation to the “ms-DS-Logon-Time-Sync-Interval”.
By default, the value for this setting is 'NOT SET', but that actually translates to 14 days.

LastLogon is more accurate but you have to query all domain controllers to actually find the highest (most recent) login and return that value.

You can use lastLogondate as long as you are aware it might be 14 days out.

1 answer

Your answer

Newbie Jones 1,386 Reputation points

2022-05-26T11:45:38.017+00:00

I cry internally when I see -properties * (from a performance perspective of course).

If you have a group with a 1000 user, its is returning all attributes for those 1000 users which you are then dropping with the select-object. Let's just get the one we need.

Get-ADUser -Properties whencreated,passwordlastset,enabled,lastlogondate -id $_.samaccountname | Select-Object name,whencreated,passwordlastset,enabled,lastlogondate

On a side note, lastlogondate is a converted version of lastLogonTimestamp.

It is replicated across domain controllers, but LastLogonTimeStamp only updates in relation to the “ms-DS-Logon-Time-Sync-Interval”.
By default, the value for this setting is 'NOT SET', but that actually translates to 14 days.

LastLogon is more accurate but you have to query all domain controllers to actually find the highest (most recent) login and return that value.

You can use lastLogondate as long as you are aware it might be 14 days out.

Answer 1

Rich Matheisen 47,901

I don't think you were too far off. Try this:

Get-ADGroupMember -id "Sample Security Group" -Recursive |
    ForEach-Object{
        Get-ADUser -Properties * -id $_.samaccountname |
            Select-Object name,whencreated,passwordlastset,enabled,lastlogondate
    }

Share via

Active Directory export users in security group with select properties

1 answer

Your answer