Convert a NT system time (Integer8), in (10^-7)s intervals from 0h 1-Jan 1601, into a readable format. (pwdLastSet, lastLogon, etc)
w32tm /ntte %time%
Convert an NTP time, in (2^-32)s intervals from 0h 1-Jan 1900, into a readable format. (whenChanged, etc)
w32tm /ntpte %time%
Convert a datetime value to a NT system time (Opposite)
http://www.petri.co.il/software/datetointeger8.zip
Display all groups which is „Domain Users“ group member
dsquery group -name "domain users" | dsget group -memberof -expand | dsget group -samid
Display attribute rIDAvailablePool, this attribute specifies the space from which RID pools are allocated.
dsquery * "cn=rid manager$,cn=system,dc=domain,dc=com" -attr ridAvailablePool
Display list of users not logged since 1.11.2010
dsquery * "ou=users,dc=domain,dc=com" -filter "(&(objectCategory=user)(lastLogonTimestamp<=129330396000000000))" | dsget user -samid
Search a computer on the network by description - useful if description contain full user name
dsquery computer -desc *smith* | dsget computer -samid -desc
List groups a user is a member of
dsquery user -samid *userlogin* |dsget user -memberof -expand
dsquery user -samid *userlogin* |dsget user -memberof -expand |dsget group -samid
This command return the user accounts where is "Hide from Exchange address lists" parameter FALSE
dsquery * "ou=users,dc=myDomain,dc=cz" -limit 1000 -attr distinguishedName showInAddressBook | findstr /i "global"
Display all users atributes
dsquery * "ou=users,dc=myDomain,dc=cz" -attr *
I can find it out with this apps:
– Process Explorer – menu Find –> Find Handler or DLL…