AD DirectorySearcher Syntax

I am looking to return results from AD containing user accounts created since
a given date.
I believe that I am close with something like this:

$searcher=New-object DirectoryServices.DirectorySearcher
$searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
$date)"
$results = $searcher.FindAll()

When $date contains a something like $date = get-date -year 2007 -month 02
-day 15, (i.e about three weeks ago) I get an error indicating a problem with
the filter

I haven't been able to straightened out this syntax yet.

Any help would be appreciated

--
Merkel-DBA

The ldap filter syntax doesn't contain a > operator. You have to use >=
--
Richard Siddaway
Please note that all scripts are supplied "as is" and with no warranty
Blog: http://richardsiddaway.spaces.live.com/
PowerShell User Group: http://www.get-psuguk.org.uk


"Stephen Merkel" wrote:

> I am looking to return results from AD containing user accounts created since
> a given date.
> I believe that I am close with something like this:
>
> $searcher=New-object DirectoryServices.DirectorySearcher
> $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
> $date)"
> $results = $searcher.FindAll()
>
> When $date contains a something like $date = get-date -year 2007 -month 02
> -day 15, (i.e about three weeks ago) I get an error indicating a problem with
> the filter
>
> I haven't been able to straightened out this syntax yet.
>
> Any help would be appreciated
>
> --
> Merkel-DBA

On Mar 9, 10:23 am, Stephen Merkel
<StephenMer...@discussions.microsoft.com> wrote:
> I am looking to return results from AD containing user accounts created since
> a given date.
> I believe that I am close with something like this:
>
> $searcher=New-object DirectoryServices.DirectorySearcher
> $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
> $date)"
> $results = $searcher.FindAll()
>
> When $date contains a something like $date = get-date -year 2007 -month 02
> -day 15, (i.e about three weeks ago) I get an error indicating a problem with
> the filter
>
> I haven't been able to straightened out this syntax yet.
>
> Any help would be appreciated
>
> --
> Merkel-DBA

get-ldap -server testboy -cred $ldapcred -dn "cn=Users,dc=JUNGLE" -
search "(&(objectcategory=person)(objectClass
=user)(whenCreated <= $threeweeksago))" -attr

(this uses get-ldap from NetCmdlets)

Lance

could also try the get-adobject from pscx
--
Richard Siddaway
Please note that all scripts are supplied "as is" and with no warranty
Blog: http://richardsiddaway.spaces.live.com/
PowerShell User Group: http://www.get-psuguk.org.uk


"Lance" wrote:

> On Mar 9, 10:23 am, Stephen Merkel
> <StephenMer...@discussions.microsoft.com> wrote:
> > I am looking to return results from AD containing user accounts created since
> > a given date.
> > I believe that I am close with something like this:
> >
> > $searcher=New-object DirectoryServices.DirectorySearcher
> > $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
> > $date)"
> > $results = $searcher.FindAll()
> >
> > When $date contains a something like $date = get-date -year 2007 -month 02
> > -day 15, (i.e about three weeks ago) I get an error indicating a problem with
> > the filter
> >
> > I haven't been able to straightened out this syntax yet.
> >
> > Any help would be appreciated
> >
> > --
> > Merkel-DBA
>
> get-ldap -server testboy -cred $ldapcred -dn "cn=Users,dc=JUNGLE" -
> search "(&(objectcategory=person)(objectClass
> =user)(whenCreated <= $threeweeksago))" -attr
>
> (this uses get-ldap from NetCmdlets)
>
> Lance
>
>

>> $searcher=New-object DirectoryServices.DirectorySearcher

> get-ldap -server testboy -cred $ldapcred -dn

> could also try the get-adobject from pscx

PS> logparser -h -i:ads

Input format: ADS (Active Directory)
Returns properties of Active Directory objects

You need to convert the Date into a format that the LDAP filter recognizes for whenCreated field. Also, as mentioned, you should use ">=", not ">". See example below:

$past = [datetime]::UtcNow.adddays(-15)
$ldappast = "{0:0000}{1:00}{2:00}0000000Z" -f $g.year,$g.month,$g.day
$s = new-object directoryservices.directorysearcher([ADSI]'')
$s.filter = "(&(objectcategory=person)(objectclass=user)(whenCreated>=$ldappast))"
$s.findall()

LDAP date filters expect a format of:
YYYYMMDDHHMMSS.Z

Example for March 12, 2007:
20070312000000.0Z
I've filled in 0's for Hours, minutes, seconds since I don't care.
0Z indicates UTC.



"Stephen Merkel" <StephenMerkel@discussions.microsoft.com> wrote in message news:5426F595-2289-40F1-B740-485F3E33D629@microsoft.com...
>I am looking to return results from AD containing user accounts created since
> a given date.
> I believe that I am close with something like this:
>
> $searcher=New-object DirectoryServices.DirectorySearcher
> $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
> $date)"
> $results = $searcher.FindAll()
>
> When $date contains a something like $date = get-date -year 2007 -month 02
> -day 15, (i.e about three weeks ago) I get an error indicating a problem with
> the filter
>
> I haven't been able to straightened out this syntax yet.
>
> Any help would be appreciated
>
> --
> Merkel-DBA

Sorry, there is a typo in the second line. Change it to read as follows:
$ldappast = "{0:0000}{1:00}{2:00}000000.0Z" -f $g.year,$g.month,$g.day

It was missing a Period just before 0Z.
"Gaurhoth" <gaurhoth@live.com> wrote in message news:9AA01174-40F2-406E-A220-61D93894B8C2@microsoft.com...
You need to convert the Date into a format that the LDAP filter recognizes for whenCreated field. Also, as mentioned, you should use ">=", not ">". See example below:

$past = [datetime]::UtcNow.adddays(-15)
$ldappast = "{0:0000}{1:00}{2:00}0000000Z" -f $g.year,$g.month,$g.day
$s = new-object directoryservices.directorysearcher([ADSI]'')
$s.filter = "(&(objectcategory=person)(objectclass=user)(whenCreated>=$ldappast))"
$s.findall()

LDAP date filters expect a format of:
YYYYMMDDHHMMSS.Z

Example for March 12, 2007:
20070312000000.0Z
I've filled in 0's for Hours, minutes, seconds since I don't care.
0Z indicates UTC.



"Stephen Merkel" <StephenMerkel@discussions.microsoft.com> wrote in message news:5426F595-2289-40F1-B740-485F3E33D629@microsoft.com...
>I am looking to return results from AD containing user accounts created since
> a given date.
> I believe that I am close with something like this:
>
> $searcher=New-object DirectoryServices.DirectorySearcher
> $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated >
> $date)"
> $results = $searcher.FindAll()
>
> When $date contains a something like $date = get-date -year 2007 -month 02
> -day 15, (i.e about three weeks ago) I get an error indicating a problem with
> the filter
>
> I haven't been able to straightened out this syntax yet.
>
> Any help would be appreciated
>
> --
> Merkel-DBA

Thank you very much, the format of the date was the missing piece I have been
looking for!
--
Merkel-DBA


"Gaurhoth" wrote:

> Sorry, there is a typo in the second line. Change it to read as follows:
> $ldappast = "{0:0000}{1:00}{2:00}000000.0Z" -f $g.year,$g.month,$g.day
>
> It was missing a Period just before 0Z.
> "Gaurhoth" <gaurhoth@live.com> wrote in message
> news:9AA01174-40F2-406E-A220-61D93894B8C2@microsoft.com...
> You need to convert the Date into a format that the LDAP filter
> recognizes for whenCreated field. Also, as mentioned, you should use ">=",
> not ">". See example below:
>
> $past = [datetime]::UtcNow.adddays(-15)
> $ldappast = "{0:0000}{1:00}{2:00}0000000Z" -f $g.year,$g.month,$g.day
> $s = new-object directoryservices.directorysearcher([ADSI]'')
> $s.filter =
> "(&(objectcategory=person)(objectclass=user)(whenCreated>=$ldappast))"
> $s.findall()
>
> LDAP date filters expect a format of:
> YYYYMMDDHHMMSS.Z
>
> Example for March 12, 2007:
> 20070312000000.0Z
> I've filled in 0's for Hours, minutes, seconds since I don't care.
> 0Z indicates UTC.
>
>
>
> "Stephen Merkel" <StephenMerkel@discussions.microsoft.com> wrote in
> message news:5426F595-2289-40F1-B740-485F3E33D629@microsoft.com...
> >I am looking to return results from AD containing user accounts created
> since
> > a given date.
> > I believe that I am close with something like this:
> >
> > $searcher=New-object DirectoryServices.DirectorySearcher
> >
> $searcher.Filter="(&(objectcategory=person)(objectclass=user)(whenCreated
> >
> > $date)"
> > $results = $searcher.FindAll()
> >
> > When $date contains a something like $date = get-date -year
> 2007 -month 02
> > -day 15, (i.e about three weeks ago) I get an error indicating a
> problem with
> > the filter
> >
> > I haven't been able to straightened out this syntax yet.
> >
> > Any help would be appreciated
> >
> > --
> > Merkel-DBA
>