possible to run this report

[Guest]

I want to run a report on a specific group. I want to be able to see only the users whose accounts have a expiration date set and a member of this specific group.

[kstanush]

Re: possible to run this report

Is this group a domain (NT or AD) group, or a local group on servers and/or workstations ?

[Guest]

Re: possible to run this report

Domain group in AD

[kstanush]

Re: possible to run this report

Find the group in the left window under your domain, click the plus (+) next to the group name, then double-click the Members object under the group name. The members will then be displayed in the right window. Right click on the header for the first column and select 'Sort by Icon'. You can them select the disabled users, and select Edit->Copy to copy the data to the clipboard.

This is the easiest way to create a report like this.

[Guest]

Re: possible to run this report

These accounts arent expired yet. I have accounts for perm employees and contractors. Contractors accounts will have a expiration date but may not be expired at this point. I Want to display all accounts with expiration dates only or atleast grouped together. Thanks for the help thus far.

[Guest]

Re: possible to run this report

I have a bunch of these queries setup as Batch files to run from the Tools menu. Copy and paste the lines between the 'begin and end' below into a batch file.
Change the (MyGROUP) and (MYDOMAIN) to what is appropriate for you.
On the Tools Menu of Hyena, click Tool Settings then "NEW". Give it a name and point the "Command" to your batch file such as "C:\tools\groupexpire.bat"
Whenever you want to run it you can just hit
CTRL-F1.


--Begin Batch file

echo off
echo.
dsget group "CN=MYGROUP, CN=USERS,DC=MYDOMAIN,dc=com" -members -expand |dsg
et user -samid -fn -ln -disabled -acctexpires

echo.
echo.
PAUSE

-- END BATCH FILE

[kstanush]

Re: possible to run this report

Sorry, I misread "disabled" instead of an expiration date. Display the group members in the right window, then select the members that you are interested in (or Control-A for all of them). Then, right click, select Query Active Directory, and select the Users Details (General) query. This will run an AD query on the selected users. The query can be customized through File->manage Object View, but this query is already pre-configured to give the expiration date.

[Guest]

Re: possible to run this report

If you expand all groups by double clicking on "All Groups", I see that you can select multiple groups in the right window, then right click to get the members, then right click again to run the AD query to get the expiration date. Very Nice!

[kstanush]

Re: possible to run this report

Yes, just be careful doing this on very very large sets of group and/or users as AD forces a unique connection for each object, and doing this causes a separate connection for each user, and although we 'free' the connection, AD actually holds onto it for a few minutes.