Forum Discussion
microchipmatt
Apr 21, 2021Copper Contributor
PowerShell Command to get a list of Users ENABLED in the last 24hrs in AD
Is there a PowerShell command to query a list of users enabled in the last 24 hrs in AD? I have one for recently created, but need one for User's enabled in the last 24 hours now. Thanks in advance ...
farismalaeb
Steel Contributor
$date=[datetime]::Today.AddDays(-1)
Get-ADUser -Properties WhenCreated -Filter 'WhenCreated -ge $Date'
If this answer helped, PLease click on Best response.
Get-ADUser -Properties WhenCreated -Filter 'WhenCreated -ge $Date'
If this answer helped, PLease click on Best response.
microchipmatt
Apr 22, 2021Copper Contributor
farismalaeb does -ge stand for get enabled? If so, Interesting, I will try this 🙂
- microchipmattApr 22, 2021Copper ContributorI'm pretty sure this will only query users created in the last 24hrs....I'm looking for a script that will identify any users enabled in the last 24 hrs.
- farismalaebApr 22, 2021Steel ContributorOh yes,
To get the enabled users within 24, you will need to read this information from Windows EventLog\Security.
Just make sure that the Account Management Group Policy is enabled.
And use the following line of code to get the information.
$date=Get-date
Get-WinEvent -FilterHashtable @{Logname="Security";ID="4722";StartTime=$date.AddDays(-1);EndTime=$date}