joeware - never stop exploring... :)

This question came in the newsgroups today and I thought it was a good one to show off an AdFind feature that you won’t find duplicated in many places… The ability to specify dates for those nasty Int8 fields…

The question was (paraphrased)….

How do I find all accounts that have a specific Account Expires Date?

Right off I need to explain something. This isn’t asking what accounts will have expired passwords on such and such a day, instead it is asking what accounts are configured to expire on a specific day. Account expiration and account password expiration are two entirely separate things. So now that that is out of the way…

AdFind as of, I think, V1.31.00 got two -binenc option modifiers added to it, one called LOCAL and the other called UTC. You can find the info on these modifiers and that switch when you do adfind /??? and look at [QUERY OPTIONS]. It says the following:

   -binenc       Transform filter elements to proper format:
                    {{GUID:guid value}} converts to LDAP format of binary.
                    {{SID:sid value}} converts to LDAP format of binary.
                    {{BIN:hex string}} converts to LDAP format of hex binary.
                    {{UTC:YYYY/MM/DD-HH:MM:SS}} converts to int8 of UTC date/time.
                    {{LOCAL:YYYY/MM/DD-HH:MM:SS}} converts to int8 of Local date/time.

A little secret that isn’t documented is that you don’t have to specify the time if you just want to specify a date. So if you need to find all accounts set to expire on 8/26/2006 for instance, the following query will do it.

adfind -default -tdcs -binenc -f “&(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})" samaccountname accountexpires

 This query has the following switches

• -default : look at the default NC of the default domain controller
• -tdcs : Decode int8 time attributes into a sortable time format
• -binenc : Encode binary attributes marked for replacement in the query

The filter itself is

“&(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})" The & says take all of these separate pieces of the query and return to me the intersection of the results

• (objectcategory=person) : contacts or users – you do this so you use an indexed attribute. You don’t have to worry about contacts as they don’t expire so they won’t have the attribute accountexpires set to anything…
• (accountexpires>={{LOCAL:2006/08/26}}) : Convert the value 2006/08/26 to an int8 format, BTW, that is in my localtime, not UTC (GMT) and then give me a list of all accounts that have a value of that or greater.
• (accountexpires< ={{LOCAL:2006/08/26}}) : Convert the value 2006/08/26 to an int8 format and then give me a list of all accounts that have a value of that or less.

Note, it should be obvious but that filter will not work in any other LDAP query tool alive. I don’t think anyone has started using my “language” for specifying filter metadata.

The query returns the following attributes

• sAMAccountName : Pre-W2K UserID
• accountExpires: Date and time that the account expires (this is translated from int8 because of -tdcs)

 

Here is a sample run:

F:\>adfind -default -tdcs -binenc -f “&(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})" samaccountname accountexpires -e AdFind V01.31.00cpp Joe Richards (joe@joeware.net) March 2006 Transformed Filter: &(objectcategory=person)(accountexpires>=128010384001650000)(accountexpires< =128011248001650000) Using server: 2k3dc02.joe.com:389 Directory: Windows Server 2003 Base DN: DC=joe,DC=com dn:CN=joe,OU=MailUsers,OU=joeware2,OU=Exchange,DC=joe,DC=com >accountExpires: 2006/08/26-01:00:00 Eastern Standard Time
>sAMAccountName: joe
1 Objects returned

If you want that in CSV format, simply tack on the CSV switch

F:\>adfind -csv -default -tdcs -binenc -f “&(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})" samaccountname accountexpires -e "dn","samaccountname","accountexpires" "CN=joe,OU=MailUsers,OU=joeware2,OU=Exchange,DC=joe,DC=com","joe","2006/08/26-01:00:00 Eastern Standard Time"

Oh you don’t want the DN, tack on the -nodn switch

F:\>adfind -nodn -csv -default -tdcs -binenc -f “&(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})" samaccountname accountexpires -e "samaccountname","accountexpires" "joe","2006/08/26-01:00:00 Eastern Standard Time"

 Oh, if you are paying really close attention, you probably notices the -e switch in there too…. This is one of my favorite switches that I use in a vast majority of my queries. It is the environment switch, what it does is that it looks at the environment variables currently defined and imports them into the current switches. My number one purpose in doing this is to point at various different Active Directory and ADAM directories… So to see what it did to the command above, use the -po switch which Prints Out the switches and parameters specified… Added to the command above in my current command prompt Window and it outputs the following extra info

Selected Switches
    -binenc
    -csv
    -default
    -e
    -f &(objectcategory=person)(accountexpires>={{LOCAL:2006/08/26}})(accountexpires< ={{LOCAL:2006/08/27}})     -h 2k3dc02     -nodn     -po     -tdcs Selected Attributes     samaccountname     accountexpires

Notice the -h 2k3dc02 that I didn’t specify on the command line? That is the only extra switch being picked up here.

The -e switch is documented in adfind /??? under the [MISC OPTIONS] section and this is what it says:

   -e xxx        Load switches from environment. Will read env vars with prefix
                 and dash (adfind-) by default and load them in. Any switches
                 specified explicitly on the command line will override. To
                 specify a different prefix, specify string after -e. For
                 example to specify the host switch create an env var of
                 adfind-h. To specify properties specify the env var adfind-
                 or adfind-props. To specify a switch that doesn’t take a
                 a value, specify a value of {~} because you can’t set a
                 an environment variable to blank.
                    Ex: Queries ADAM on localhost port 5000 for subnets.
                       set adam1-h=.:5000
                       set adam1-config={~}
                       set adam1-f=objectcategory=subnet
                       set adam1-props=name siteobject
                       adfind -e adam1

By default, I always have my primary AD/Exchange environment info set in the ADFIND-* variables. That way if I add a simple -e I don’t have to enter the hostname to get to that environment or even the authentication info if it is different[1]. So if you look at the adfind- variables right now you see

F:\>set adfind-
adfind-h=2k3dc02

I also usually have A1 through A9 environment variables set for various ADAM instances I have running on different machines; these are used by specify -e A1 through -e A9. I also have an AB environment variable set that point at an Address Book ADAM instance which is used with -e AB.

There is also a -ef option if you rather put the settings in a file.

Like I said, I love the -e option, it makes for much less typing when I need to…

   joe 

  

[1] I actually use CPAU to fire up a command prompt running in the security context of that environment as well so I don’t have to specify the userid/password in the environment variables. 

Rating 3.50 out of 5