Score:-1

The server has returned the following error: invalid enumeration context

cn flag

This is command i am using... Can anyone help me on this..

Get-ADComputer -Filter * -Searchbase "OU=IN0010,OU=BU-L04-Glass,OU=CIN,OU=L00-SGTS-USS,DC=zl,DC=if,DC=atcsg,DC=net" -Properties * | Sort LastLogon | Select Name, LastLogonDate,@{Name='LastLogon';Expression={[DateTime]::FromFileTime($_.LastLogon)}} | export-csv -path c:\Temp\ADComputer.csv -NoTypeInformation

cn flag
How many computers does the first command produce, and do they all have LastLogon?
Score:1
cn flag

Let's break this down nicely:

  1. LastLogon is not replicated among DCs - it's a unique per-DC timestamp for that account. If a computer has never logged onto the DC that your query is hitting, that property won't be populated. If it's mostly logged onto different DCs, the date could be inaccurate. Instead, if you simply want to know if computers have logged on "recently", query LastLogonTimeStamp or LastLogonDate - see note below.

  2. When you want to understand what a query is doing, don't just throw it all through the pipeline and output to CSV. Unless you enjoy having no idea what's happening and opening an empty CSV file, run simple commands first to understand the output and ensure you get the right results before outputting to file. See examples below.

  3. If all you need is the LastLogon or LastLogonDate and the computer name, please do not use -Properties *. Your query will take much longer, because you're literally dragging back all the data in the computer account. If you've got certs stored in computer objects in AD, this can be KBs of data for each object. If you only need two properties, then just select them: Get-ADComputer -filter '*' -properties Name,LastlogonDate. Example of data sizes is at the end.

LastLogonTimeStamp vs LastLogonDate

Unlike LastLogon, LastLogonTimeStamp is replicated among all DCs, but is only precise up to 14 days ago. LastLogonDate is the same as LastLogonTimeStamp, but it's a calculated [DateTime] property (it's not stored in LDAP, but calculated when you query it). Since it's a [DateTime], It's easier to sort and filter.

If LastLogonTimeStamp is 14 or less days old, there may be a newer LastLogon for that machine on one or more DCs. If you need a more precise time, you will need to query all the DCs for LastLogon on all the computer accounts and then compare which has the most recent date. But for typical reporting purposes, such as if you're auditing machine accounts that might be "stale", LastLogonDate is generally fine.

Refer to this article for more info.

Understanding AD/LDAP query results

When you're unsure what your results look like, don't output them to file. To understand what your commands are doing, try a simple filter and let it output to the console. Then refine the query as needed. If you need to process the data after getting the result, do one step at a time and check results before adding more. I've been working with Powershell for 15 years, and I still start off like this - checking what comes out first before doing the next step to filter and process data.

Try the following examples, obviously replacing OU and computer names with correct ones from your environment (by the way, don't reveal real names in your questions.)

# List all the computers in the OU with default properties that Get-AdComputer outputs - this does not include LastLogonDate etc
# e.g. name, distinguishedName, enabled, objectype etc... 
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net"

# Show -all- properties from a computer named "MyComputer"
Get-ADComputer -Filter 'name -eq "Mycomputer"' -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties *

# Show only specific properties from the same computer
Get-ADComputer -Filter 'name -eq "Mycomputer"' -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate

# List all the computers in the OU with names and LastLogonDate only
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate

# As above, using an expression to convert the unreplicated LastLogon property to [datetime] instead
# Note that further processing is needed if you need to compare this date between multiple DCs
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogon | Select Name, LogonDate,@{Name='LastLogon';Expression={[DateTime]::FromFileTime($_.LastLogon)}}

# If your results in a previous command look good, now you can sort and output to CSV
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate | Sort LastLogonDate | select Name,LastLogonDate | export-csv -path c:\Temp\ADComputer.csv -NoTypeInformation

For the last example, the Select Name,LastLogonDate is to exclude the default properties like DistinguishedName and objectClass from the CSV export. Also, if you don't like how LastLogonDate is formatted, you may need to include an expression to format it there too (similar to converting the LogonDate filetime).

LDAP query data size

The file listing below shows the difference in data size if I return just the name and LastLogonDate of one computer into "comp1.txt" vs ALL of the same computer's properties into "comp2.txt". Multiply by the number of machines that are queried - it is very easy to see why a query will take a lot longer when it's dragging unnecessary data out of AD and across the network.

Mode                LastWriteTime         Length Name
----               -------------         ------ ----
-a----       2022-02-14     18:41            894 comp1.txt
-a----       2022-02-14     18:42          69736 comp2.txt
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.