I’m on a roll…
This evening while partaking in a little turkey, ham, mashed potatoes, and some sautéed squash fries and visiting with friends and family the code I needed to write to add delta time filter capability popped into my head and this evening I inserted that code so now you can do something like
F:\Dev\Current\CPP\AdFind\Debug>adfind -default -binenc -f "lastlogontimestamp>={{current:-20d}}" lastlogontimestamp -tdcs
AdFind V01.39.00cpp ***BETA*** Joe Richards (joe@joeware.net) November 2008
Transformed Filter: lastlogontimestamp>=128706070664670000
Using server: JOEWARE-DC1.joeware.local:389
Directory: Windows Server 2003
Base DN: DC=joeware,DC=local
dn:CN=$jricha34,CN=Users,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-20:29:00 Eastern Standard Time
dn:CN=DC2,OU=Domain Controllers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/24-09:38:47 Eastern Standard Time
dn:CN=JOEWARE-DC1,OU=Domain Controllers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-15:53:36 Eastern Standard Time
dn:CN=MBX01,CN=Computers,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/22-23:34:48 Eastern Standard Time
dn:CN=$joe,CN=Users,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/17-21:42:24 Eastern Standard Time
dn:CN=mvp,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-08:35:01 Eastern Standard Time
dn:CN=joe,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-16:36:13 Eastern Standard Time
dn:CN=listmail1,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/25-23:37:40 Eastern Standard Time
dn:CN=support,OU=Users,OU=joeware.net,OU=Orgs,OU=Mail,DC=joeware,DC=local
>lastLogonTimestamp: 2008/11/18-22:48:57 Eastern Standard Time
9 Objects returned
Which basically says, show me all objects that have the lastLogonTimeStamp attribute updated with a value from the last 20 days. You could also do –20m for last 20 minutes. Or if you want to be very specific you can specify the days, hours, minutes and seconds with a dd:hh:mm:ss formatted string. The 20 days example would look like –20:00:00:00 or alternately –20:0:0:0.
This will make it even easier for folks to use AdFind for their custom cleanup scripts if OldCmp isn’t doing it for them… Instead of them having to calculate the actual int8 value, they can let AdFind do it for them.
joe
That’s pretty slick, Joe.
I think you just wiped out a whole nuisance procedure for admins who export the records with ADFind, then import to Excel, then filter on the date.
Happy Black Friday!
🙂
It was something I wanted to add for some time now, glad I finally got it in there.
Yesterday while getting the u-joints replaced on my truck I also added a -enccurrent option which is like -enclocal and -encutc but allows you to specify a delta from the current time… so -enccurrent -60d and it will spit out the proper int8 value.