I want to search Active Directory for inactive users that have no login for x days/months. I've got such a ldapsearch query:

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"

It gives me the list of all inactive users in domain.test with all attributes.

I would like to add a filter for searching users that have no login for x days/months, and it would be great if the result was the list of sAMAccountNames (inactive user and lastLogonTimestamp >e.g. 3months). I'm aware that LastLogonTimestamp is not the real time of last user logon, but in this case it's not so important.

EDIT: now I only need to know if there is a way to show attribute like "lastLogonTimestamp" in the output of above ldapsearch query?

ANSWER: Attribute lastLogonTimestamp was not set for each object in the output of above ldapsearch query. I haven't noticed that. So grep displayed it:

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountCont‌​rol:1.2.840.113556.1‌​.4.803:=2))" | grep -i lastlogontimestamp 

EDIT: To convert windows lastLogonTimestamp to date I've used:

while read -r line;
    let "ts = ($line / 10000000) - 11644473600" && echo $ts >> linux_timestamp;
    date -d @$ts +'%Y%m%d' >> linux_date;
    done < users_lastlogontimestamp

Any advice very appreciated.

2 Answers 2


You just need to modify your filter to add another condition, so that ldap server returns only entries with lastLogonTimestamp>=timestamp. To retrieve only specific attributes instead of the whole entry, specify the attributes to be returned by the server.

For example:-

ldapsearch -h domain.test -p 389 -D "cn=login,ou=test,dc=domain,dc=test" -w "passwd" -s sub -b "ou=Test,dc=domain,dc=test" "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(lastlogontimestamp>=131550784796762354))" samAccountName lastlogontimestamp
  • Hi, thanks, but the problem is that lastLogonTimestamp values are not comparable, thus I cannot use lastLogonTimestamp<=timestamp_value to get list of users that lastlogon was eg. before 01/06/2017. I need to convert lastLogonTimestamp to date, then use it in ldapsearch query filter.
    – gaspar
    Nov 17, 2017 at 7:55
  • Quick search lists many examples: stackoverflow.com/questions/13091719/… , Convert your date the lastlogontimestamp and use ldapsearch with the value.
    – Najmuddin
    Nov 17, 2017 at 10:28
  • That's right, but what I need is conversion form windows lastLogonTimestamp to date in linux (bash script). I would like to have all operations in one place (without using PowerShell as an additional tool for example).
    – gaspar
    Nov 17, 2017 at 12:01
  • per AD docs, the lastlogintimestamp is the time in ns since 1601 and it can be easily converted, there are many examples available online. for eg: meinit.nl/…
    – Najmuddin
    Nov 21, 2017 at 13:04

Thank you for the answer Najmuddin.

I though that it will be ok to compare lastlogontimestamps - it isn't because lastlogontimestamp values are not comparable. The only was is to convert to date format first, and then compare to get users that lastlogon was eg. before 01/06/2017. And here's the question: how to convert windows lastlogontimestamp to date in bash?

Please let me know if it's the correct way to do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.