From Evernote:

AD User and computer Stats and Info

# Let's see all the new user accounts created since the 1st of the month

Get-QADUser -CreatedAfter "April 1, 2010"

# Can narrow it down to specific OU to exclude service accounts

Get-QADUser -CreatedAfter "April 1, 2009" -SearchRoot mydomain.local/employees

# Same thing for groups, computers, OUs, or any AD objects

Get-QADComputer -CreatedAfter "April 1, 2009"

Get-QADGroup -CreatedAfter "April 1, 2009"

# Did we hire anyone today?

Get-QADUser -CreatedOn "April 17, 2009"

# Let's see if we have anyone who has been with the company for more than 10 years ;)

Get-QADUser -CreatedBefore (Get-Date).AddYears(-10) -SearchRoot d.local/emp -Enabled

# Let's count how many employees we were hiring monthly

for ($d = Get-Date "January 1, 2009"; $d -le (Get-Date); $d = $d.AddMonths(1)) {

  "$($d.ToShortDateString()) to $($d.AddMonths(1).ToShortDateString()):"

  (Get-QADUser -CreatedAfter $d -CreatedBefore $d.AddMonths(1)).Count

}

And you can use other parameters to get the data by department, city, title, and so on!

Now go to your HR and ask them if they can provide data like that so quickly.

# set the date to be used as a limit - in this example: 90 days earlier than the current date

$old = (Get-Date).AddDays(-90)

# get the list of computers with the date earlier than this date

Get-QADComputer -IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le $old }

A few variations to this depending on how you want to use the data:

# get a csv report

Get-QADComputer -IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le $old } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\temp\outdated.csv

# move old computer accounts to another OU

Get-QADComputer -IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le $old } | Move-QADObject -to quest.corp/obsolete

# remove the computer records from AD (caution: this actually deletes the records, run the command with -whatif switch before running without it)

Get-QADComputer -IncludedProperties pwdLastSet -SizeLimit 0 | where { $_.pwdLastSet -le $old } | Remove-QADObject -to quest.corp/obsolete

The script bellow allows you to locate users with invalid logon attempts

$strFilter = "(&(objectCategory=User)(badPwdCount>=0))"

$objDomain = New-Object System.DirectoryServices.DirectoryEntry

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher

$objSearcher.SearchRoot = $objDomain

$objSearcher.PageSize = 1000

$objSearcher.Filter = $strFilter

$colProplist = "name"

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}

$colResults = $objSearcher.FindAll()

foreach ($objResult in $colResults)

{$objItem = $objResult.Properties; $objItem.name}