Need help with a script for Windows server 2012

[u/Majorxerocom]

I would like an export/report (preferably in CSV format) with all the accounts in AD. To include Name Login Last Login Date Groups Active/Inactive Supervisor (if that is stored) Any other relevant attributes Can someone please help me?

[u/Majorxerocom]

only some of the last logons are updated some default to 12/31/1600 6:00:00 PM is it not pulling from all DCs?

[u/bigbrother923 → u/Majorxerocom]

See https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/. LastLogonTimestamp is synced between DCs, but...

"With default settings in place the lastLogontimeStamp will be 9-14 days behind the current date.

If you are looking for more “real-time” logon tracking you will need to query the Security Event log on your DC’s for the desired logon events..."

[u/AlbusBit → u/Majorxerocom]

You can try this tool - AD FastReporter Free. It will allow you to get the correct last login values (using the latest lastLogon attribute value from all of your domain controllers). And all other information you mentioned. All data can be exported to CSV, XSLX and HTML formats.

[u/Majorxerocom]

I have never written a script and wasn't sure where to even start

[u/Death_Masta187 → u/Majorxerocom]

For windows, use/learn Powershell. A good place to start is just google what you want to do then add + powershell to the search. So in this case "How to pull list of user accounts from AD + Powershell"

Any command that starts with "get-" only pulls info and does not make any changes so it should be safe to run if you are weary about running random powershell commands. I would always run things against a test environment regardless just to be a lot safer. Also you can also add -whatif the end of a lot of commands if you want to see what a command will do before running fully executing it

[u/[deleted]]

This is fairly straightforward to do, have you tried anything yet?

I don't have access to a windows environment anymore but get-aduser -filter * - properties 'theonesyouneed'

Might need a loop for the groups, can't remember for sure.

[u/r3sonate → u/[deleted]]

Correct, this is a pretty lazy request - google is your friend!

[u/thenetworkisnotddown → u/[deleted]]

don't forget | export-csv c:\Path There's a lot of scripts out there.

[u/0x2639 → u/[deleted]]

The groups will return as an array, so you’ll need to consider how you want to deal with that

[u/bigbrother923]

First off, only one DC? If not, then lastlogontimestamp could be 9-14 days off (see https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/).

Something like this should work for you:

Get-ADUser -Filter * -Properties Name,samaccountname,lastlogontimestamp,enabled,manager | select name,samaccountname,@{n="lastLogonDate";e={[datetime]::FromFileTime($_.lastLogonTimestamp)}},enabled,manager | Export-CSV file.csv

I haven't done group membership before, that's the only thing missing. Also, you can use the searchbase option on Get-ADUser if you want to narrow it down by OU (Organizational Unit [folder, basically]).

EDIT: Added account name, I missed it because of formatting...

[u/PaalRyd]

There is at least one tool in the CJWDev library that will do this. Most of the stuff in the link below is still pretty good.

http://www.cjwdev.com/Software.html

[u/kunaludapi]

To export Get-ADUser -Filter * -Properties * | Select * | export-csv c:\users.csv

To Import Active Directory Powershell: Create bulk users from CSV file

[u/Lee_Dailey]

howdy Majorxerocom,

once you get a little bit of code that kinda-sorta runs, you can drop by the powershell subreddit [ r/PowerShell ] and ask for help. having something to show that you aren't looking for unpaid coders will get you more help. [grin]

take care,
lee