Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Wednesday, August 26, 2015

Analyzing the “WhenChanged” Property

Today in my PowerShell class, we played with the WhenChanged attribute in Active Directory. We were looking at is as part of a question on PowerShell.com. The IT Pro needed to know when an object was last changed. While doing some research, I came across some accounts that the WhenChanged property is only replicated on Global Catalogs, and not the ADDS database. In my testing on Windows Server 2012 R2, replication of this date/time value was replicating on both GCs and non GCs. Getting the most recent value is easy then.

 

  Get-ADUser -Filter {Name -eq "ABC34"} -Properties WhenChanged 

The problem here is that this will only reflect the last time stamp of the Domain Controller that you are currently pulling information from. In an AD environment with multiple Sites, the default replication interval is 3 hours. If sites are logically chained together, that means that an update made 2 or 3 sites away from you may not get replicated to you for many hours.

The code below will query each of your Domain Controllers for the most recent WhenChanged attribute on a user account. Just remember, this is coded to hit all of them. In a larger environment, you may want to be careful and restrict the DCs that are queried.

 

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

Function Get-UserChangeDate

{

[CmdletBinding()]

Param

(

    $UserName

)

# Get a list of all Domain Controllers

$SearchBase = "OU=Domain Controllers,$((Get-ADDomain).DistinguishedName)"

$DomainController = Get-ADComputer -Filter * -SearchBase $SearchBase |

    Select-Object -ExpandProperty Name

 

# Get a starting date that.

$Date = Get-Date -year 1000

 

# Cycle through each DC and find the most recent entry.

ForEach ($DC in $DomainController)

{

    $TestDate = Invoke-Command -ComputerName $DC -ScriptBlock {

        Param ($UserName)

            $TestDate = Get-ADUser -Filter {Name -eq $UserName} -Properties WhenChanged |

            Select-Object -ExpandProperty WhenChanged

            Write-Output $TestDate

        } -ArgumentList $UserName

 

    If ($TestDate -gt $Date)

    {

        $Date = $TestDate

    }

    

}

 

$Obj = New-Object -TypeName PSObject -Property @{

    "UserName" = $UserName

    "WhenChanged" = $Date

}

Write-Output $Obj

 

<#

.SYNOPSIS

Queres all Domain Controllers to get the most recent "WhenChanged" value

for a user account.

.DESCRIPTION

Queres all Domain Controllers to get the most recent "WhenChanged" value

for a user account.

 

This value is only replicated to Global Catalog Servers.  None GCs will

not recieve updated information for this attribute.  This cmdlet will

search all DCs and return the most recent value.

 

.PARAMETER UserName

The Username that you want to know when it was last modified.

 

.Example

Get-UserChangeDate -UserName JYoder

 

Returned the Date/Time of the most recent change.

 

.NOTES

===============================================================================

== Cmdlet: Get-UserChangeDate                                                ==

== Author: Jason A. Yoder                                                    ==

== Company: MCTExpert of Arizona                                             ==

== Date: August 28, 2015                                                     ==

== Copyright: All rights reserved.                                           ==

== Version: 1.0.0.0                                                          ==

== Legal: The user assumes all responsibility and liability for the usage of ==

== this PowerShell code.  MCTExpert of Arizona, Its officers, shareholders,  ==

== owners, and their relatives are not liable for any damages.  As with all  ==

== code, review it and understand it prior to usage.  It is recommended that ==

== this code be fully tested and validated in a test environment prior to    ==

== usage in a production environment.                                        ==

==                                                                           ==

== Does this code make changes: NO                                           ==

===============================================================================

#>

 

} # END: Get-UserChangeDate

No comments: