I'm looking to find AD user accounts created between two timestamps. However, I'm facing this redundant issue of not being able to fetch AD user objects with Get-ADUser while using the whenCreated attribute along with -gt or -ge or -lt (excepting -le) in -Filter or -LDAPFilter parameters of the cmdlet. The cmdlet just works fine and starts returning AD user objects immediately when using the -le operator only.
Below is a snapshot of errors when tried with -LDAPFilter with -ge, -lt, -gt in order,
This seems to be a related post. However, I find no working solution there, and when tried using the ! (the not operator) with -le (to bring -gt into effect), I still received a timeout exception. I've also tried to reduce the -ResultPageSize value to 5, still no luck - the timeout error is thrown.
I'd like to filter on the server-side as the directory is huge and retrieving all objects and then filtering on the client-side would not be very much efficient. Any suggestions or workaround is much appreciated. Thank you.
1 Answer
PowerShell conveniently converts the whenCreated attribute from the GeneralizedTime format in UTC to a Local DateTime using property Created.
I cannot test this at the moment, but any of these should work:
# define the start and end dates (Local time) $startDate = (Get-Date -Year 2021 -Month 1 -Day 14).Date # discard the time part, so set to midnight $endDate = (Get-Date).Date try:
Get-ADUser -Filter "Created -gt $startDate -and Created -le $endDate" or filter afterwards using a Where-Object clause:
Get-ADUser -Filter * -Properties Created | Where-Object { $_.Created -gt $startDate -and $_.Created -le $endDate } 
