I want to search Active Directory for inactive users that have no login for x days/months. I've got such a ldapsearch query:

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"

It gives me the list of all inactive users in domain.test with all attributes.

I would like to add a filter for searching users that have no login for x days/months, and it would be great if the result was the list of sAMAccountNames (inactive user and lastLogonTimestamp >e.g. 3months). I'm aware that LastLogonTimestamp is not the real time of last user logon, but in this case it's not so important.

EDIT: now I only need to know if there is a way to show attribute like "lastLogonTimestamp" in the output of above ldapsearch query?

ANSWER: Attribute lastLogonTimestamp was not set for each object in the output of above ldapsearch query. I haven't noticed that. So grep displayed it:

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountCont‌​rol:1.2.840.113556.1‌​.4.803:=2))" | grep -i lastlogontimestamp 

EDIT: To convert windows lastLogonTimestamp to date I've used:

while read -r line;
    let "ts = ($line / 10000000) - 11644473600" && echo $ts >> linux_timestamp;
    date -d @$ts +'%Y%m%d' >> linux_date;
    done < users_lastlogontimestamp

Any advice very appreciated.


You just need to modify your filter to add another condition, so that ldap server returns only entries with lastLogonTimestamp>=timestamp. To retrieve only specific attributes instead of the whole entry, specify the attributes to be returned by the server.

For example:-

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(lastlogontimestamp>=131550784796762354))" samAccountName lastlogontimestamp
  • Hi, thanks, but the problem is that lastLogonTimestamp values are not comparable, thus I cannot use lastLogonTimestamp<=timestamp_value to get list of users that lastlogon was eg. before 01/06/2017. I need to convert lastLogonTimestamp to date, then use it in ldapsearch query filter. – gaspar Nov 17 '17 at 7:55
  • Quick search lists many examples: stackoverflow.com/questions/13091719/… , Convert your date the lastlogontimestamp and use ldapsearch with the value. – Najmuddin Nov 17 '17 at 10:28
  • That's right, but what I need is conversion form windows lastLogonTimestamp to date in linux (bash script). I would like to have all operations in one place (without using PowerShell as an additional tool for example). – gaspar Nov 17 '17 at 12:01
  • per AD docs, the lastlogintimestamp is the time in ns since 1601 and it can be easily converted, there are many examples available online. for eg: meinit.nl/… – Najmuddin Nov 21 '17 at 13:04

Thank you for the answer Najmuddin.

I though that it will be ok to compare lastlogontimestamps - it isn't because lastlogontimestamp values are not comparable. The only was is to convert to date format first, and then compare to get users that lastlogon was eg. before 01/06/2017. And here's the question: how to convert windows lastlogontimestamp to date in bash?

Please let me know if it's the correct way to do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.