Today in my PowerShell class, we played with the WhenChanged attribute in Active Directory. We were looking at is as part of a question on PowerShell.com. The IT Pro needed to know when an object was last changed. While doing some research, I came across some accounts that the WhenChanged property is only replicated on Global Catalogs, and not the ADDS database. In my testing on Windows Server 2012 R2, replication of this date/time value was replicating on both GCs and non GCs. Getting the most recent value is easy then.
Get-ADUser -Filter {Name -eq "ABC34"} -Properties WhenChanged
The problem here is that this will only reflect the last time stamp of the Domain Controller that you are currently pulling information from. In an AD environment with multiple Sites, the default replication interval is 3 hours. If sites are logically chained together, that means that an update made 2 or 3 sites away from you may not get replicated to you for many hours.
The code below will query each of your Domain Controllers for the most recent WhenChanged attribute on a user account. Just remember, this is coded to hit all of them. In a larger environment, you may want to be careful and restrict the DCs that are queried.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | Function Get-UserChangeDate { [CmdletBinding()] Param ( $UserName ) # Get a list of all Domain Controllers $SearchBase = "OU=Domain Controllers,$((Get-ADDomain).DistinguishedName)" $DomainController = Get-ADComputer -Filter * -SearchBase $SearchBase | Select-Object -ExpandProperty Name
# Get a starting date that. $Date = Get-Date -year 1000
# Cycle through each DC and find the most recent entry. ForEach ($DC in $DomainController) { $TestDate = Invoke-Command -ComputerName $DC -ScriptBlock { Param ($UserName) $TestDate = Get-ADUser -Filter {Name -eq $UserName} -Properties WhenChanged | Select-Object -ExpandProperty WhenChanged Write-Output $TestDate } -ArgumentList $UserName
If ($TestDate -gt $Date) { $Date = $TestDate }
}
$Obj = New-Object -TypeName PSObject -Property @{ "UserName" = $UserName "WhenChanged" = $Date } Write-Output $Obj
<# .SYNOPSIS Queres all Domain Controllers to get the most recent "WhenChanged" value for a user account. .DESCRIPTION Queres all Domain Controllers to get the most recent "WhenChanged" value for a user account.
This value is only replicated to Global Catalog Servers. None GCs will not recieve updated information for this attribute. This cmdlet will search all DCs and return the most recent value.
.PARAMETER UserName The Username that you want to know when it was last modified.
.Example Get-UserChangeDate -UserName JYoder
Returned the Date/Time of the most recent change.
.NOTES =============================================================================== == Cmdlet: Get-UserChangeDate == == Author: Jason A. Yoder == == Company: MCTExpert of Arizona == == Date: August 28, 2015 == == Copyright: All rights reserved. == == Version: 1.0.0.0 == == Legal: The user assumes all responsibility and liability for the usage of == == this PowerShell code. MCTExpert of Arizona, Its officers, shareholders, == == owners, and their relatives are not liable for any damages. As with all == == code, review it and understand it prior to usage. It is recommended that == == this code be fully tested and validated in a test environment prior to == == usage in a production environment. == == == == Does this code make changes: NO == =============================================================================== #>
} # END: Get-UserChangeDate |
Comments