How To: Find Active Accounts

Finding which accounts are active should be simple, however, there are numerous ways to define if an account is active or not.  There is the simple method of checking if the accounts are enable or not, however, things get more complicated quickly after that, i.e. when was the account last used, has the account expired, has the account ever been used.

This article provides a number of sample LDAP queries that can be used to determine if accounts are active or not, or you can combine these queries to generate a more complex query to meet your requirements.  The first part of the article shows fragment of the query and the last section shows how to combine these to create the final query.

Account Enabled
With AD an account is active based on a value stored in UserAccountControl attribute, however, the attribute uses bit logic to represent a number of different values, so you can't check for a specific value.  Details of the attribute can be here. The second bit of the UserAccountControl indicates if the account is enabled or not,  when not set (0) the account is active, when set (2) the account is disabled.  Using Matching Rule OID we can check the status of the individual bits in the attribute.  i.e. (useraccountcontrol:1.2.840.113556.1.4.802:=2).  The NetTools substitutions simplifies the entry of matching rules with a single character. See Substitutions.

Account is disabled          (useraccountcontrol|=2)    
Account is enabled           (!useraccountcontrol|=2)

Account Expired
Accounts can be set to automatically expire after a specified date, after which point the user will no longer be able to logon.  The date is stored in the AccountExpires attribute, this attribute uses a 64 bit integer to store the date.  To add to the complexity the attribute can contain more than just a date, it might not be set, or contains a 0 (zero), or 9223372036854775807 then account is not set to expire.  So a query check for expiry has to check for all the possible values to confirm if the account is active or not. Again the use of substitutions can simplify the entry of the Int64 date. 

Account Expired            (&(!accountExpires={-1:})(!accountExpires=0)(accountExpires<={idate:now})) 
Account not Expired     (|(!accountExpires=*)(accountExpires={-1:})(accountExpires=0)(accountExpires>={idate:now}))  

Last Logon
Most account audits state that if an account has not been used to a set period of time, the account should be consider inactive.  The last time the user logs on is stored in the LastLogon attribute, however this attribute is not replicated between domain controllers, so using this attribute you have to collect the LastLogon attribute from all domain controllers to determine the last logon.  There is another attribute that is replicated between domain controllers called LastLogonTimeStamp, however this attribute has a specific replication cycle which means that it may not contain the most recent logon date (more details here), but is usually close enough for most cases.  Again this attribute uses a 64 bit integer to store the date.

Not logged on for 60 days        (lastlogontimestamp<={idate:now-60})
Logged on in the last 30 days   (lastlogontimestamp>={idate:now-30})

Password Changes
In some cases the logonTime or the LastLogonTimeStamp will not be updated when a users logs on, these are normally associated to LDAP Simple binds or access through SharePoint.  another method to determine if an account is still being used to check the last time the user's password was changed, this assumes that an account password expires.

Password change in the last 60 days     (pwdlastset>={idate:now-60})

Unused New Accounts
In this scenario an account is created but has not used since it was created.  The queries that is used to find these accounts depends on user provisioning process and which query should be used, if the user is required to change their password at first logon (scenario 1), or not (scenario 2).  If the user is required to change their password, then we check to see when the password was changed, if not, we check if the lastlogontimestamp has been set.

Scenario 1
Not used in the last 60 days            (&(whencreated>={zdate:now-60})(pwdlastset=0))
has been used in the last 60 days    (&(whencreated>={zdate:now-60})(pwdlastset>={idate:now-60}))

Scenario 2
Not used in the last 60 days                          (&(whencreated>={zdate:now-60})(!lastlogontimestamp=*))
Created in the last 60 days and been used    (&(whencreated>={zdate:now-60})(lastlogontimestamp=*))

Type of Accounts and indices
When creating queries it's best to create a query that limits the number of object that need to be searched and the number of attributes that are returned.  Building a query using attributes that are indexed will increase the performance of the query, reduce the load on the server executing the query, and reduce the amount of network traffic generated (See this Microsoft article for details). Some of the queries shown above use attributes that are not indexed, so using these queries in the format show could be very inefficient.  Limiting the queries to only search for specific object types will significantly increase the performance of the query, i.e only look at user account or computer accounts and the more indices that are used the better. 

Users account               (&(objectCategory=user)(objectclass=user))
Computer Accounts      (&(objectCategory=computer)(objectclass=computer))

Combined Queries
This section shows a number of the above query fragments combination to create the full query:

Find active user accounts:

Find disabled user accounts

Find active accounts, that have not expired

Find all inactive accounts, including expired, password not changed or logon in the last 60 days
(&(objectCategory=user)(objectclass=user) (!useraccountcontrol|=2)(lastlogontimestamp<={idate:now-60})(pwdlastset>={idate:now-60})(&(!accountExpires={-1:})(!accountExpires=0)(accountExpires<={idate:now})))

NetTools includes a number of predefined queries covering user accounts, see Predefined Queries

See Favorites for more examples

How To: Find what Schema updates have been performed

The AD schema can be extended by installing additional schema extensions, which add additional classes and\or attributes.  There is no builtin method to determine what schema extensions have been installed.  NetTools, however, does have an option to display the schema updates that have been added to the AD.

The Schema History option uses the WhenCreated attribute to determine when changes were made to the AD, and then using it's internal database to try and retrieve the name of the update based on what attributes or classes have been added.

See Schema History List

How To: Find which DCs have the FSMO roles

You don't have to work with AD for every long before you need to know or find out which domain controller is hosting a certain FSMO role e.g. Schema updates, or troubleshoot password issues etc.  Luckily NetTools is able to display all the FSMO roles with just two clicks.

The Site DC List option in NetTools will display the FSMO roles for all the domain controllers in the forest.

Key for the Roles:

G - Global Catalog
D - Domain Master
I - Infrastructure Master
P - PDC Master
R - RID Master
S - Schema Master

How To: Find the DN of an object

In the Active Directory every object has a unique identifier - a DN or Distinguished Name, this is used by a number of different tools and services to reference the object, so be able to find the DN of an object is a basic task that is required when managing Active Directory.

In NetTools there are numerous options to find or display the DN of objects. Here are few of them:

User Search -  will return a number of common objects for the items found, include the DN in the distinguishedName column.  The DN can be copied using the right click context menu.

ACL Browser - you are able to browse the directory and display the structure in the left hand pane, the right click context menu has an option to copy the DN of the of the selected object.

GPO Explorer - you are also able to browser the directory, and the contents tab will show the objects in the selected OU or container.  There is a DN column in the table of the contents tab which has the DN of the objects.

Output Tables
The table outputs for a number of options include the DN of the objects returned, the column is normally called DN, this can be copied using the right click context menu.

AD Properties - is a context menu item available throughout NetTools.  The AD properties dialog has a simpler format as the properties dialog in AD User & Computers management console, there is a tab called Object which has the DN of the object.

AD Attributes - is another context menu item that is available, this dialog will display all the attributes on an object, the distinguished Name attributes is also displayed.

NetTools V1.26.0

Group Changes  ** New **
An audit function to show the group membership changes for the specified user.  See Group Changes

ACL Browser
Added the List objects permissions into the properties list view
Changed the default behavior when changing between ACL’s so any column sort orders are removed, and ACE are displayed in the order in the ACL.
Changed the first column to include the ACL Index number

Attribute Replication
Fix a scope issue so the attributes in the root object can be checked 

Copy to new Window
Added an context menu option to open a new window with the list unique column details
Now supports the Dynamic and Sort column sorts

Extended Rights
Fixed bug where GUID was not displayed

Added help button on each page which links back to the NetTools website for more information

Group Manger
Added support for email\upn in user input
Added Select All\Deselect All context menu options

LDAP Browser
Fixed indexing error when browsing a directory via the global catalog

LDAP Search
The current filter is now displayed in the text pane for each iteration of the query when in Input Mode

Last Logon Time
Added extra column for PwdLastSet 

Meta Data
Removed the 1000 item display limit on replication details.

Overlapping Subnets
Updated the display adding green and yellow indicator to show if the IP address range is assigned to different sites

Added context menu option to request a privilege

Schema Browser
Added the Index column to show if an attribute is Indexed or not

How To: Check if workstations are still active

There are a number of different ways to check if an AD domain join workstation is still being used or active in the environment.   This article provides a couple of different approaches depending on the number of workstations or type of information required. All approaches are based on the standard assumption that an active workstation will update the pwdlastset, lastlogon, lastlogontimestamp attributes while connected to the domain\network.

Which attribute you use to validate if the workstation is still active will depend on the configuration of the AD:

PwdLastSet – this will change each time the workstation changes it’s password and this change is replicated to all domain controllers, so the time reported by one domain controller will be the same on all.  The frequency at which the password is changed is controlled by the Domain Member: Maximum machine account password age and Domain Member: Disable machine account password changes, GPO settings.  The default maximum password age is 30 days, however, if the password update is disabled, then the PwdLastSet attribute will not changed.  Also in some scenarios if the workstation is used remotely, and not connected to the network for long periods of time, then the pwdlastset will not be updated.

LastLogon – this is the last time that the workstation logged on, however, this attribute is not replicated between domain controllers and you have to retrieve the attribute from all the domain controllers to get the last logon time.  As with the PwdLastSet attribute, if the workstation is used remotely for long periods of time, this attribute may not be updated.

LastLogonTimeStamp -  this attributes is also replicated between domain controllers, however, the replication of this attribute doesn’t happen every time the workstation logs on, by default it will be updated every 14 days, details here , so if 14 days is close enough then this is the best attribute to use.

Single Workstation:

The quickest method is search for the workstation using the Search option under Users to find the workstation’s object in AD, from there right click on the required workstation and from the context menu, select Use With -> Last Logon.  All three attributes are displayed in the one view. The Last Logon column displays the lastlogon attribute from each of the domain controllers in the domain, sorting this column to display the last logon time, the lastlogontimestamp and pwdlastset will be the same across all servers.

Another method to check for activity, but not specifically based on the lastlogon attribute, you can use the object Meta Data to get the list of attributes that have been changed, and then compare the time the changes were made to confirm if the workstation is still active.  To display the Meta Data for an object, complete the search as describe above, from the context menu, select Meta Data, and then sort the form based on the time column. The attributes that are relevant are dBCsPwd, lmPwdHistory, ntPwdHistory, pwdLastSet, supplementalCredentials, unicodePwd which are updated when a password is updated.

Multiple Workstations:

If you want to check the details of a number of workstations, the Last Logon Time option is the easiest option to use.  This option requires a list of samaccountnames of the workstation, with workstations the samaccountname must include the trailing $ character.  Once the list is pasted into the right hand pane, and Go pressed, it will check each entry against all the domain controllers in the domain and it will display the latest time recorded against all the domain controllers.

If you require additional information about the workstations other than the lastlogon details, then the LDAP Search is the best option, the save query below uses Input Mode to return the details, you paste a list of workstations into the Input pane and return any information you require about the workstations, include Operating System, Version, etc.

[Active Workstations]

In this example it assumes that the workstation SamAccountNames will have the trailing $, however, changing the filter to the following and the trailing $ is not required:


Related Items

Troubleshooting Account Lockouts
User Search
LDAP Search
Input Mode

LDAP Search – Base DN Formats

Active Directory support a number of different formats for the Base DN field, these are Distinguished Name, GUID and SID 

Distinguished Name is based on RFC 4514 e.g. CN=user1,CN=users,DC=domain,DC=com

GUID provides the GUID of an object which will be used as the base for searches, i.e <GUID=01f04883-d68e-4367-8ad1-a2faa79a2e5a>

SID format is the same as GUID but the entry is based on a SID i.e. <SID=S-1-5-21-2816452191-2840564649-4223122534-1000>

The SID and GUID option with the Search Scope set to Base Level can be used as quick search for users or other objects in the AD based on the GUID or SID.  The SIDs and GUIDs are entered in standard readable format.

How To: Search for multiple users based on email address

This article show how to create an LDAP query that can be used to search for users based on an email or UPN.  The query uses Input Mode to allow a list of email\UPN to be searched at one time.  It will search for the user's email address in the mail, UPN and proxyaddresses attributes.

You will notice in the filter that the proxyaddresses section of search includes SMTP: in the filter, this is to ensure that only smtp entries are returned, but also to improve the performance of the search, rather than using wildcards.

Here is the Favorite, see Favorites for details on how to import this query into NetTools.

[User Mail Search]
Attributes=displayname, userAccountControl,accountExpires, lastlogontimestamp

Once the query has been imported and selected, paste a list of email addresses into the table view and click Go.

Related Items:

LDAP Search Options
Input Mode
Saved Favorites


How To: Display the properties of the members of a group

This articles explains how to use the ASQ server side control to return the display name and email address of all the members of a specific group.

First go to the Search option under Users in the left hand pane, deselect the Return Users Only option, and then enter the name of the group in the username field, click Go.

Select the required group from the list of returned results and then right click on the item, from the context menu, select Use With -> LDAP Search.  This will populate the LDAP Search option with the details of the group.

Click on the More button, In the Server Side controls section, select the Attribute Scope Query option, and set the Search Scope to Base Level.

In the Attributes field enter, ‘Member, displayname, mail’ and click Go.

In this example we are only returning the display name and email address for the members, however, you can specify any of the user’s attributes you want to display, they just need to be added to the Attributes list.

With this example we don’t specifying which objects to return, we can restrict the results to only user accounts, by changing the filter to (objectclass=user) or (objectclass=group) to only return the groups that are members.

Attributes=Member, displayname, mail

Related items:

ASQ details
User Search
LDAP Search - Options
LDAP Favorties

LDAP Search – Enums

NetTools includes over 50 predefined enumeration to decode the values assigned to specific attributes, these include the definitions of associated values assigned to the attributes. An example would be the UserAccountControl attribute, which is shown below. To display the Enums dialog, click on the button at the end of the filter field.

The dialog can be used to browse the predefined entries and from the context menus, the values can then be used in filters.

There are two type of Enums defined in NetTools, Bit and Value.  The Bit enums are used for attributes that use a bit mask to define the function of the attribute, and a single bit in the value is used to represent an enabled or disabled state of an option.  The Value type is used for attributes that have a single value to represent the function.

The Enums are used by attributes that have the ATTRIBENUM or ATTRIBENUM_NONUM decode type assigned, the attribute name is then used to lookup the corresponding enums assigned to that attribute.  Currently there is no method for a user to add additional Enum to NetTools, they are statically defined in the program.