{"id":68103,"date":"2006-01-25T20:49:00","date_gmt":"2006-01-25T20:49:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/01\/25\/how-can-i-get-a-list-of-all-the-objects-that-have-been-added-to-active-directory-since-a-specified-date\/"},"modified":"2006-01-25T20:49:00","modified_gmt":"2006-01-25T20:49:00","slug":"how-can-i-get-a-list-of-all-the-objects-that-have-been-added-to-active-directory-since-a-specified-date","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-get-a-list-of-all-the-objects-that-have-been-added-to-active-directory-since-a-specified-date\/","title":{"rendered":"How Can I Get a List of All the Objects that have been Added to Active Directory Since a Specified Date?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I get a list of all the objects that have been added to Active Directory since a specified date?

— KR<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, KR. First of all we\u2019d like to apologize if our answer here is still a little soggy. No doubt you\u2019ve seen cartoons where someone receives a package in the mail, they hear it ticking and – suspecting the worse – they immediately plunge the box into a bathtub full of water. (Fortunately, in cartoons, there\u2019s always a bathtub full of water whenever you need one.) Inevitably, of course, they discover that the package wasn\u2019t a bomb after all, just a clock.<\/P>\n

Hey, we didn\u2019t say it was all that funny, just something that happens over and over again.<\/P>\n

To tell you the truth, we have the same reaction any time we get asked a question involving dates and Active Directory: we immediately plunge the email into a bathtub full of water. (Which, fortunately, we also have available whenever we need one.) That\u2019s because working with dates and times in Active Directory can be a bit \u2026 interesting \u2026. (Yes, like the infamous date-time values that represents the number of 100-nanosecond intervals that have occurred since January 1, 1601. Which – coincidentally enough – was also the last time any of the Scripting Guys got a raise.) <\/P>\n

Of course, and, inevitably, as soon as we pull the email out of the bathtub we discover the question really wasn\u2019t so bad after all. Such was the case here. Although the date-time value for the whenCreated<\/B> attribute (which tells us when an object was created) is a little bit tricky, at least it doesn\u2019t deal with nanoseconds or random fluctuations in the space-time continuum. That means we can use it in a relatively simple Active Directory search script. In fact, we can use it in a script just like this one:<\/P>

On Error Resume Next<\/p>\n
Const ADS_SCOPE_SUBTREE = 2<\/p>\n
dtmCreationDate = “20060101000000.0Z”<\/p>\n
Set objConnection = CreateObject(“ADODB.Connection”)\nSet objCommand =   CreateObject(“ADODB.Command”)\nobjConnection.Provider = “ADsDSOObject”\nobjConnection.Open “Active Directory Provider”\nSet objCommand.ActiveConnection = objConnection<\/p>\n
objCommand.Properties(“Page Size”) = 1000\nobjCommand.Properties(“Searchscope”) = ADS_SCOPE_SUBTREE <\/p>\n
objCommand.CommandText = _\n    “SELECT Name, objectCategory, whenCreated FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE ”  & _\n        “whenCreated>='” & dtmCreationDate & “‘” \nSet objRecordSet = objCommand.Execute<\/p>\n
objRecordSet.MoveFirst\nDo Until objRecordSet.EOF\n    Wscript.Echo objRecordSet.Fields(“Name”).Value\n    Wscript.Echo objRecordSet.Fields(“objectCategory”).Value\n    Wscript.Echo objRecordSet.Fields(“whenCreated”).Value\n    objRecordSet.MoveNext\nLoop\n<\/PRE>\n
As usual, we\u2019re not going to bother explaining most of the code shown here; if you\u2019re not familiar with scripts used for searching Active Directory we recommend you take a look at the two-part Tales from the Script<\/I> series Dude, Where\u2019s My Printer?<\/B><\/A> (And yes, we know: by now anyone who\u2019s ever read this column has already memorized the URL to Dude, Where\u2019s My Printer?<\/I> But we offer it once again, just in case.)<\/P>\n
What we will<\/I> explain is how to work with the whenCreated attribute. You might notice that, early on in the script, we assign a value to the variable dtmCreationDate:<\/P>
dtmCreationDate = “20060101000000.0Z”\n<\/PRE>\n
This is actually the date January 1, 2006. Admittedly, it doesn\u2019t look<\/I> like January 1, 2006, so let\u2019s show you how we went from January 1, 2006 to 20060101000000.0Z:<\/P>\n\n<\/THEAD>\n\n\n\n
\n
2006<\/B><\/P><\/TD>\n
\n
01<\/B><\/P><\/TD>\n
\n
01<\/B><\/P><\/TD>\n
\n
00<\/B><\/P><\/TD>\n
\n
00<\/B><\/P><\/TD>\n
\n
00<\/B><\/P><\/TD>\n
\n
.0Z<\/B><\/P><\/TD><\/TR>\n
\n
Year<\/P><\/TD>\n
\n
Month<\/P><\/TD>\n
\n
Day<\/P><\/TD>\n
\n
Hours<\/P><\/TD>\n
\n
Minutes<\/P><\/TD>\n
\n
Seconds<\/P><\/TD>\n
\n
Time zone (for now, just use .0Z and you\u2019ll be OK)<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
What if we wanted to use 1:35 PM on November 27th<\/SUP>, 2005? That would look like this, keeping in mind that, using a 24-hour clock, 1:35 PM is equal to 13 hours and 35 minutes:<\/P>\n\n<\/THEAD>\n\n\n\n
\n
2005<\/B><\/P><\/TD>\n
\n
11<\/B><\/P><\/TD>\n
\n
2777<\/B><\/P><\/TD>\n
\n
13<\/B><\/P><\/TD>\n
\n
35<\/B><\/P><\/TD>\n
\n
00<\/B><\/P><\/TD>\n
\n
.0Z<\/B><\/P><\/TD><\/TR>\n
\n
Year<\/P><\/TD>\n
\n
Month<\/P><\/TD>\n
\n
Day<\/P><\/TD>\n
\n
Hours<\/P><\/TD>\n
\n
Minutes<\/P><\/TD>\n
\n
Seconds<\/P><\/TD>\n
\n
Time zone (for now, just use .0Z and you\u2019ll be OK)<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
Or, programmatically:<\/P>
dtmCreationDate = “20051127133500.0Z”\n<\/PRE>\n
See? A little quirky, but not too bad. Besides, once you understand how to format the date-time value then you\u2019re home free. With a properly-formatted date-time value in hand we can write a query for conducting the search:<\/P>
objCommand.CommandText = _\n    “SELECT Name, objectCategory, whenCreated FROM ‘LDAP:\/\/dc=fabrikam,dc=com’ WHERE ”  & _\n        “whenCreated>='” & dtmCreationDate & “‘”\n<\/PRE>\n
Notice what we\u2019re looking for: all the objects that were created after the 0 hour (00 hours, 00 minutes, 00 seconds) on January 1, 2006. In other words, show us all the objects that have been added to Active Directory during the year 2006. We should also point out that we\u2019re retrieving the Name<\/B>, objectCategory<\/B>, and whenCreated<\/B> attributes; that means we\u2019ll end up with output similar to this:<\/P>
KenMyer\nCN=User,CN=Schema,CN=Configuration,DC=fabrikam,,DC=com\n1\/3\/2006 8:55:27 AM\n<\/PRE>\n
In other words, we\u2019ll know the name of the object, the type of object (in this case, a user account) and the date and time the object was created. And, fortunately, we don\u2019t have to do any crazy re-formatting in order to display the value of the whenCreated attribute: it automatically gets displayed as a standard date-time value. We only have to use the 20060101000000.0Z syntax when we\u2019re using whenCreated in a Where clause.<\/P>\n
And now, if you\u2019ll excuse us, we have to go dry our clothes. Again. (We really do<\/I> need to stop overreacting any time someone asks us a question, don\u2019t we?)<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I get a list of all the objects that have been added to Active Directory since a specified date?— KR Hey, KR. First of all we\u2019d like to apologize if our answer here is still a little soggy. No doubt you\u2019ve seen cartoons where someone receives a package in the […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,5],"class_list":["post-68103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I get a list of all the objects that have been added to Active Directory since a specified date?— KR Hey, KR. First of all we\u2019d like to apologize if our answer here is still a little soggy. No doubt you\u2019ve seen cartoons where someone receives a package in the […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=68103"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68103\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=68103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=68103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=68103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}