Get list of users created in AD within last few days

Using PowerShell we can get list of users created during a particular time frame, like in last 1 day, 30 days, etc. This may be helpful in AD audit or to track any security breach.

First, create a variable and store the date you want to go back.

Make sure you run the PowerShell as Admin, if you don’t you may get blank values for WhenCreated

$When = (Get-Date).AddDays(-30) # You can change number of days here as per your requirement. 
Get-ADUser -Filter {WhenCreated -ge $when}

#IF you want to list particular properties, you can use below command.
Get-ADUser -Filter {WhenCreated -ge $when} -Properties * | FT Name, UserPrincipalName, WhenCreated

We can also get group membership of these users in same command output.

Get-ADUser -Filter {whenCreated -ge $when} -Properties * | select UserPrincipalname, SamAccountName, Enabled, whenCreated, @{n="GroupMembership"; e={$_.MemberOf | foreach {(Get-ADGroup $_).Name}}}

Export this list to CSV file.

Get-ADUser -Filter {whenCreated -ge $when} -Properties * | select UserPrincipalname, SamAccountName, Enabled, whenCreated, @{n="GroupMembership"; e={$_.MemberOf | foreach {(Get-ADGroup $_).Name}}} | Export-CSV C:\Temp\ADUsersWhenCreated.csv -notype

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s