Searching for Active User Accounts

[RobC86]

I'm looking for help with a script to help me display all active user accounts in Active Directory. I have been able to come across a few that show how to display disabled accounts however i want to see just the active ones.

I managed to find this script for disabled user accounts:-

Const ADS_UF_ACCOUNTDISABLE = 2

Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
"<GC://dc=fabrikam,dc=com>;(objectCategory=User)" & _
";userAccountControl,distinguishedName;subtree"
Set objRecordSet = objCommand.Execute

intCounter = 0WScript.Echo VbCrLf & "A total of " & intCounter & " accounts are disabled."

objConnection.Close

Do Until objRecordset.EOF
intUAC=objRecordset.Fields("userAccountControl")
If intUAC AND ADS_UF_ACCOUNTDISABLE Then
WScript.echo objRecordset.Fields("distinguishedName") & " is disabled"
intCounter = intCounter + 1
End If
objRecordset.MoveNext
Loop

However im unsure on how to modify this to show all active accounts.

 

[PHV]

Something like this ?
...
If Not (intUAC AND ADS_UF_ACCOUNTDISABLE) Then
WScript.echo objRecordset.Fields("distinguishedName") & " is NOT disabled"
...

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[PScottC]

How about changing the filter portion of the query?

Replace:
(objectCategory=user)
with
(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

This filter selects user objects that are not disabled.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[RobC86]

Thanks guys, a combination of the two worked. The end code looks like the following:



Const ADS_UF_ACCOUNTDISABLE = 2

Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
"<GC://dc=fabrikam,dc=com>;(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" & _
";userAccountControl,displayName;subtree"
Set objRecordSet = objCommand.Execute

intCounter = 0
Do Until objRecordset.EOF
intUAC=objRecordset.Fields("userAccountControl")
If Not (intUAC AND ADS_UF_ACCOUNTDISABLE) Then
WScript.echo objRecordset.Fields("displayName") & " is enabled"
intCounter = intCounter + 1
End If
objRecordset.MoveNext
Loop

WScript.Echo VbCrLf & "A total of " & intCounter & " accounts are enabled."

objConnection.Close



N.B.(For any future reference) Since the first code i changed the userAccountControl,distinguishedName to ---> userAccountControl,displayName. I found this displays a more friendly output for the username. Then i executed the script using the CScript command and saved it to a log file. Using "CScript ActiveUser.vbs > C:\ActiveUsers.log".