To create a custom Saved Query, follow these steps.
- Right-click Saved Queries and click the New-Query option
- Type in a name for your saved query, such as "Search"
- Click the Define Query button
- Under the Find drop-down list, select Custom Search
- Click the Advanced tab
- Type in your query
Finds all disabled User Accounts
Finds all groups that have no members
Finds all locked out User Accounts
Nice post
ReplyDeleteGenerate list (csv file output) for active users in AD
csvde -d “ou=Users,DC=ABC,DC=net” -r “(&(objectCategory=person)(objectClass=user)(|(useraccountcontrol=512)(useraccountcontrol=66048)))” -L “sAMAccountName,givenName,sn,description,whenCreated” -f report_sno1.csv
Change the event id for disabled user
https://barchive.wordpress.com/2014/03/21/active-directory-audit-the-users/