Get Names from AD

[enjay]

I have a script which I got from someone, probably on here, that reports last logon date and password age. This worked beautifully on our old network, but since changing AD structure over the summer, it isn't querying the right field any more.

 

I've pasted the script below. It works if I enter "Firstname Lastname" but I want it to search for the sAMAccountName field instead. Any offers what I need to change?

 

Script is:

 

Set objConnection = CreateObject("ADODB.Connection")

Set objCommand = CreateObject("ADODB.Command")

objConnection.Provider = "ADsDSOObject"

objConnection.Open "Active Directory Provider"

Set objCOmmand.ActiveConnection = objConnection

strmess="Enter Username" & vbcrlf _

& "Wildcards can be used." & vbcrlf & "* means ALL users, I advise you don't do this!!" & vbcrlf

struser=inputbox(strmess," Passwords Changed" ,"username here")

' @@@@@@@@@@@@@ NOTE-- Change "DOMAIN" to your domain name @@@@@@@@@@@@@@@@@@@@@@@@@@

objCommand.CommandText = "select name,distinguishedname from 'LDAP://" _

& "DC=DOMAIN' where objectcategory='user' AND name='" _

& struser & "'"

' @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

 

Set objRecordSet = objCommand.Execute

on error resume next

objRecordSet.MoveFirst

if err.number=0 then

Do Until objRecordSet.EOF

Set objUser = GetObject ("LDAP://" _

& objrecordset.fields("distinguishedname").value)

strpwdchanged = objUser.PasswordLastChanged

strlastlog=objuser.lastlogin

strUserName = objrecordset.fields("name").value

stroutput=strusername & ",Password last changed @ " & strpwdchanged _

& " , last logged on @ " & strlastlog

wscript.echo stroutput

objrecordset.movenext

loop

else

wscript.echo "No users found"

end if

[jinnantonnixx]

It's not really an answer to your question, but Powershell is the far superior tool to do these kinds of tasks.

 

Loads of examples out there, this being one.

PowerShell: Get-ADComputer to retrieve computer last logon date – part 1 | Oxford SBS Guy

[enjay]

You're certainly right, @jinnantonnixx , and Powershell is definitely something which is on my list to grapple with now that we have left the dark days of CC3 behind us. For now, I was just hoping for a quick win with this script!

[jinnantonnixx]

I appreciate Powershell, but I'm not a fan of their syntax. It's object-oriented, but instead of being object-based, the language is verb-based, which I find weird. File handling is fantastically easy.

 

http://www.gegeek.com/documents/cheat_sheets/powershell-basic-cheat-sheet2.pdf

 

I'm still no help, but I suggest you bite the bullet and code it in Powershell.

Edited October 10, 2014 by jinnantonnixx

[mikeyd101]

Hey I started writing powershell scripts last year and made some progress doing LDAP queries against AD. Here's some powershell code:

 

function Get-ADObjects{

param (

$searchroot = [system.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain(),

$Category = "(objectCategory=computer)",

$fieldlist = @("name", "cn")

)

 

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher

$objSearcher.SearchRoot = "LDAP://$searchroot"

$objSearcher.Filter = ($Category)

$objSearcher.SearchScope = "subtree"

$objSearcher.pagesize = 10000

 

# TODO: request / consolidate from all domain controllers

 

#write-host $category - $fieldlist

 

 

foreach ($i in $fieldlist) {

$temp = $objSearcher.PropertiesToLoad.Add($i)

}

 

$colResults = $objSearcher.FindAll()

 

$Results = @()

foreach ($objResult in $colResults) {

$Result = New-Object PSObject

foreach ($Property in $objResult.Properties.getenumerator()) {

if($Property.Value) {

$Result | Add-Member NoteProperty $Property.Key ([string]$Property.Value)

}

}

$Results += $Result

}

$Results

}

 

#$cat = "(&(objectcategory=User)(memberof=CN=Class of 2017,OU=Users,DC=******,DC=******,DC=******,DC=******))"

#$cat = "(&(objectcategory=User)(primaryGroupID=13235))"

#$cat = "(&(objectCategory=user)(memberOf=CN=Class of 2019,OU=Users,DC=******,DC=******,DC=******,DC=******))"

#$cat = "(&(objectCategory=person)(memberOf=CN=Class of 2017,OU=Users,DC=******,DC=******,DC=******,DC=******))"

 

#ldap query

$cat = "(&(objectcategory=User)(!CN=#*)(Description=*2019))"

 

$adusers = get-adobjects -Category $cat -fieldlist @("cn", "name", "samaccountname")

 

write-host users: $adusers.count

 

foreach($user in $adusers)

{

write-host $user.samaccountname $user.adspath

}

 

I've obscured our domain information with *'s. Copy / paste this to a text file xxx.ps1 then your'll probably need to set the executionpolicy, i think I just set mine to unrestricted (this can be dangerous, as allows any ps1 file to run).

 

This will probably get you 75% of the way there if your a coder (if not its probably all greek), your need to extend the requested fieldlist to include the fields your interested in LastLogon and PasswordLastChanged. Also if you have more than 1 DC your'll need to request the information from each DC and consolidate it.

 

The thing I like about PS/LDAP is that you don't need any other libraries or modules to be installed so can be run on any machine with PS.

 

I hope this is of some help. The more I use powershell the more I like its power, it is a pretty steep learning curve tho and I've come from a software development background. Give me a shout if your stuck and I'll try and help out as much as I can.

 

Mike

[ascott2]

Try this

 

get-aduser -Filter {samaccountname -like "ascott*"} -Properties PasswordLastSet,LastLogonDate

 

and for your current First Name, Last Name scenario

 

get-aduser -Filter {GivenName -eq "Joe" -and surname -eq "Bloggs"} -Properties PasswordLastSet,LastLogonDate

Edited October 10, 2014 by ascott2
Added first name last name

[mikeyd101]

get-aduser I think requires that you load the AD module first, which in turn requires either running on DC/server with AD and modules installed or that you have RSAT / & AD powershell modules.

 

This is the very reason i went down the ldap rabbit hole. I realise that i'm re-inventing the wheel but writing the code is helping learn powershell

Edited October 10, 2014 by mikeyd101

[ascott2]

Of course, I agree re-inventing the wheel is sometimes the best way to learn and quite often you can get much better results than out of the box commands. I was just offering an alternative.

 

You don't necessarily have to have RSAT or run directly on a DC, you can use powershell remoting, of course that is just another rabbit hole you would have to delve into Depending on what OS the DC is running, remoting may be enabled by default or you will have to explicitly enable it. The following should allow you to get the output on any machine running as any user, as you pass in credentials to connect to the DC.

 

New-PSSession -ComputerName DC01 -Credential (Get-Credential) -Name DC

Invoke-Command -Session (Get-PSSession -Name DC) -ScriptBlock {

Import-Module ActiveDirectory

get-aduser -Filter {samaccountname -like "ascott*"} -Properties PasswordLastSet,LastLogonDate

}

 

Remove-PSSession -Name DC

 

You could expand on this further and create a session to each DC and output all the results at once.