GetUser List PowerShell Script

Question

I am trying to pull list of the users from specific OU if LastLogon is greater 60 days from today. Here is the script but it seems not working as expected.

Get-ADUser -filter {Enabled -eq 'True'} -SearchBase $OU -Properties * | Select UserPrincipalName, mail, LastLogon, Enabled | Where-Object {{$_.LastLogon -lt (Get-Date).AddDays(-60).ToFileTime().toString()}} #| ConvertTo-Json

Not able filter the data based on date condition. Please help.

I tried below script at suggested by Abraham

(Get-ADUser -filter {Enabled -eq 'True'} -SearchBase $OU -Properties * | Select UserPrincipalName, mail, LastLogon, Enabled).where{$_.LastLogon -lt (Get-Date).AddDays(-60)} #| ConvertTo-Json

Response: Error

    Could not compare \"132629184515770181\" to \"06/07/2021 22:21:36\". Error: \"C
annot convert value \"6/7/2021 10:21:36 PM\" to type \"System.Int64\". Error: \"Invalid cast f
rom \u0027DateTime\u0027 to \u0027Int64\u0027.\"\"

Does (Get-ADUser -Filter {Enabled -eq $true} -Property UserPrincipalName, mail, LastLogon, Enabled).Where{ $_.LastLogon -lt (Get-Date).AddDays(-60)} work for ya? — Abraham Zinala
– Abraham Zinala, Commented Aug 6, 2021 at 22:09
$_.LastLogonDate and $_.LastLogon both has different value and it seems $_.LastLogon has correct date/Time — snowcoder
– snowcoder, Commented Aug 6, 2021 at 22:29
The 18-digit AD timestamps, aka 'Windows NT time format', 'Win32 FILETIME', 'SYSTEMTIME' or 'NTFS file time' are used in Microsoft Active Directory for pwdLastSet, accountExpires, LastLogon, LastLogonTimestamp, and LastPwdSet. The timestamp is the number of 100-nanosecond intervals (1 nanosecond = one billionth of a second) since Jan 1, 1601 UTC. PowerShell uses property LastLogonDate, which is conveniently converted from the LDAP lastLogonTimeStamp into a Local DateTime object. I suggest you use that property and compare like $_.LastLogonDate -lt (Get-Date).AddDays(-60).Date. — Theo
– Theo, Commented Aug 7, 2021 at 12:40

Santiago Squarzon · Accepted Answer · 2021-08-06 23:10:44Z

2

Try with this, my advice, don't call all properties -Properties *, only those you need to query and LDAP query is a lot faster than filtering with Where-Object or .Where() method.

$limitDate = [datetime]::Now.AddMonths(-2).ToFileTime()

$params = @{
    LDAPFilter = "(&(!userAccountControl:1.2.840.113556.1.4.803:=2)(lastLogonTimestamp>=$limitDate))"
    SearchBase = $OU
    Properties = 'mail', 'LastLogonDate'
}

Get-ADUser @params |
Select-Object UserPrincipalName, mail, LastLogonDate, Enabled

edited Aug 6, 2021 at 23:10

answered Aug 6, 2021 at 22:41

Santiago Squarzon

65.6k5 gold badges26 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

snowcoder Over a year ago

THanks @Santiago, I think its working. Could you please help me to add && query to above statement. My requirement is to filter user inactive between 60 to 75 days, I want to run my orchestration to send reminders to those which are inactive less than 90 days and above 90 days, just disabled the user.

Santiago Squarzon Over a year ago

@snowcoder you're asking for something unrelated to the original question, my advice would be to ask a new question explaining what you need.

Collectives™ on Stack Overflow

GetUser List PowerShell Script

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related