Powershell: I got something wrong.

Grey

Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,Description

Ok, this line isn't working to find the users that changed their password between the 16th and the 21st. Where did I go wrong?

EddieJennings

@grey said in Powershell: I got something wrong.:

Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,Description
Ok, this line isn't working to find the users that changed their password between the 16th and the 21st. Where did I go wrong?

Are you receiving an error message or incorrect results?

Dashrender

It fails for me on the use of PassWordNeverExpires

help does show that option for Get-AdUser

PS C:\WINDOWS\system32> help passwordneverexpires

Name                              Category  Module                    Synopsis
----                              --------  ------                    --------
Get-ADComputer                    Cmdlet    ActiveDirectory           Gets one or more Active Directory computers.
New-ADComputer                    Cmdlet    ActiveDirectory           Creates a new Active Directory computer.
New-ADUser                        Cmdlet    ActiveDirectory           Creates a new Active Directory user.
Search-ADAccount                  Cmdlet    ActiveDirectory           Gets Active Directory user, computer, or servi...
Set-ADAccountControl              Cmdlet    ActiveDirectory           Modifies user account control (UAC) values for...
Set-ADComputer                    Cmdlet    ActiveDirectory           Modifies an Active Directory computer object.
Set-ADUser                        Cmdlet    ActiveDirectory           Modifies an Active Directory user.

Grey

@eddiejennings Shown:

PS Z:\Scripts> Get-ADUser -filter {PasswordNeverExpires -eq $false -and PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017" -and enabled -eq $true} -Properties PasswordLastSet,Name,DistinguishedName 

Get-ADUser : Error parsing query: 'PasswordNeverExpires -eq $false -and PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017" -and enabled -eq $true' Error Message: 'syntax error' at position: '75'.
At line:1 char:1
+ Get-ADUser -filter {PasswordNeverExpires -eq $false -and PasswordLast ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Get-ADUser], ADFilterParsingException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Microsoft.ActiveDirectory.Management.Commands.GetADUser
 

PS Z:\Scripts> Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,DistinguishedName 

Get-ADUser : Error parsing query: 'PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and -lt "8/21/2017") -and enabled -eq $true' Error Message: 'syntax error' at position: '76'.
At line:1 char:1
+ Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLas ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Get-ADUser], ADFilterParsingException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Microsoft.ActiveDirectory.Management.Commands.GetADUser

It worked prior to adding the -gt/-lt params, or with just one of those params.

EddieJennings

I think Dash is on the right trail. Try it without the PasswordNeverExpires parameter.

Dashrender

OK

Get-ADUser -filter {PasswordNeverExpires -eq $false}

and

Get-ADUser -filter {PasswordNeverExpires -eq $false} -Properties PasswordLastSet,Name,Description

do work. Though I'm guessing that the -Properties option is meant to limit the output to only those three things, which it does not do, but I could be wrong on the expectation.
In either case, the output from both commands is the same.

Grey

@eddiejennings said in Powershell: I got something wrong.:

I think Dash is on the right trail. Try it without the PasswordNeverExpires parameter.

That param is fine. The dates are what's generating the error as it's not able to figure out both lt and gt, I think?

Dashrender

@grey said in Powershell: I got something wrong.:

@eddiejennings said in Powershell: I got something wrong.:

I think Dash is on the right trail. Try it without the PasswordNeverExpires parameter.

That param is fine. The dates are what's generating the error as it's not able to figure out both lt and gt, I think?

yeah, when I only put that one filter in place, it's failing for me, the rest work.

JaredBusch

@grey Specify PasswordLastSet after the -and also otherwise it has no idea what you are trying to -lt.

Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and PasswordLastSet -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,Description

Dashrender

damn - JB beat me by a few seconds

EddieJennings

I should only respond to posts when I can give them due attention. I feel like a fool for missing that.

Dashrender

I wonder if you can drop the and, and give the -gt -lt commands to the single commandlet?

JaredBusch

@dashrender said in Powershell: I got something wrong.:

I wonder if you can drop the and, and give the -gt -lt commands to the single commandlet?

not how that works.

Dashrender

@jaredbusch said in Powershell: I got something wrong.:

@dashrender said in Powershell: I got something wrong.:

I wonder if you can drop the and, and give the -gt -lt commands to the single commandlet?

not how that works.

Yeah I just tried, and nope failed.

JaredBusch

@dashrender said in Powershell: I got something wrong.:

@jaredbusch said in Powershell: I got something wrong.:

@dashrender said in Powershell: I got something wrong.:

I wonder if you can drop the and, and give the -gt -lt commands to the single commandlet?

not how that works.

Yeah I just tried, and nope failed.

There is no -between functionality in powershell.

Grey

@jaredbusch said in Powershell: I got something wrong.:

@grey Specify PasswordLastSet after the -and also otherwise it has no idea what you are trying to -lt.
Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and PasswordLastSet -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,Description

You win at the Internet today. I should have caught that.

JaredBusch

@grey said in Powershell: I got something wrong.:

@jaredbusch said in Powershell: I got something wrong.:
@grey Specify PasswordLastSet after the -and also otherwise it has no idea what you are trying to -lt.
Get-ADUser -filter {PasswordNeverExpires -eq $false -and (PasswordLastSet -gt "8/16/2017" -and PasswordLastSet -lt "8/21/2017") -and enabled -eq $true} -Properties PasswordLastSet,Name,Description
You win at the Internet today. I should have caught that.

I did enough time in development. I know how it goes.