PS Directory.Searcher for searching AD - inconsistent results?

Question

Hi guys,
I'm having problems with a script and need some assistance please. I needed a script to search all the users in my AD and return some information around passwords. I found a few blogs about searching AD for user information, so using that help I cobbled
together a script to return the information I need.
Here's the script:-
cls
$Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$DomainRootPath = [ADSI]"LDAP://$Domain"
$adsearch = New-Object DirectoryServices.DirectorySearcher([adsi]$DomainRootPath)
#$adsearch.filter = "(objectclass=user)"
$adsearch.Filter = "(&(objectCategory=person)(objectClass=user))"
$adsearch.PropertiesToLoad.AddRange(@("name"))
$adsearch.PropertiesToLoad.AddRange(@("lastlogontimestamp"))
$adsearch.PropertiesToLoad.AddRange(@("givenName"))
$adsearch.PropertiesToLoad.AddRange(@("SN"))
$adsearch.PropertiesToLoad.AddRange(@("DisplayName"))
$adsearch.PropertiesToLoad.AddRange(@("pwdLastSet"))
$adsearch.PropertiesToLoad.AddRange(@("description"))
$adsearch.PropertiesToLoad.AddRange(@("userAccountControl"))
$adsearch.Container
$adsearch.PageSize = 1000
$adsearch.SearchScope = "Subtree"
$users = $adsearch.findall()
$users.Count
$report = @()
foreach ($objResult in $users)
$objItem = $objResult.Properties
$llt = $objItem.lastlogontimestamp
$pls = $objItem.pwdlastset
If (!$pls)
$plsDate = "--Never Reset Pwd--"
$PassLastSet = $plsDate
Else
# Interpret 64-bit integer as a date.
$plsDate = $pls = [DateTime]$objItem.pwdlastset.item(0)
$PassLastSet = $plsDate.AddYears(1600).ToLocalTime()
If (!$llt)
$lltDate = "--Never Logged In--"
$lastLogon = $lltDate
Else
# Interpret 64-bit integer as a date.
$lltDate = $llt = [DateTime]$objItem.lastlogontimestamp.item(0)
$lastLogon = $lltDate.AddYears(1600).ToLocalTime()
$temp = New-Object PSObject
$temp | Add-Member NoteProperty name $($objitem.name)
$temp | Add-Member NoteProperty lastlogontimestamp $lastLogon
$temp | Add-Member NoteProperty pwdLastSet $PassLastSet
#$temp | Add-Member NoteProperty displayname $($objitem.displayname)
$temp | Add-Member NoteProperty useraccountcontrol $($objitem.useraccountcontrol)
#$temp | Add-Member NoteProperty givenname $($objitem.givenname)
#$temp | Add-Member NoteProperty sn $($objitem.sn)
$temp | Add-Member NoteProperty comment $($objitem.description)
$report += $temp
$datetime = Get-Date -format yyyy.MM.dd-HH.mm.ss
$csvpath = "C:\powershell logs\"
$csvfile = "$csvpath\$datetime-userlist.csv"
$report | export-csv -notypeinformation $csvfile
My problem is some results are missing for some users. I only have around 200 users and many return a complete set of results. But many users don't return a result for lastlogontimestamp, pwdLastSet or userAccountControl - the three fields that aren't strings...
I'm not sure if this is necessarily a powershell problem (perhaps my AD is corrupt or something weird like that?). When I query the $users array these fields are missing for the users - but when I use the ADSi edit GUI I can see there is data in these fields.
It seems like the Directory.Searcher might have a bug or something?
Apologies if there's a more appropriate place to post this please let me know - any help would be greatly appreciated!!
Many thanks,
Rob
:D

Answer 1

But I believe I provide an apples to apples comparison earlier, perhaps you missed it?
Here's the gist from the post, but the entire post might be worth reading if you did miss it..
Here's an example of a problem user account. To simplify things I'm using the results from your GetUserADProperties.ps1 script.
Script results:
Name = User A
pwsLastSet = NULL (Blank, no result)
lastlogontimestamp = NULL (Blank, no result)
ADSI Edit GUI results:
Attribute: Name       Value: User A         Syntax: Unicode String
Attribute: lastlogontimestamp       Value: 04/01/2012 10:23:21 Coordinated Universal Time         Syntax: Large Integer/Interval
If I double-click a box pops up with the Value: 129701462019825126
Attribute: pwdLastSet       Value: 04/01/2012 11:30:44 Coordinated Universal Time         Syntax: Large Integer/Interval
If I double-click a box pops up with the Value: 129701502443598094
If this isn't an apples to apples comparison  how can I provide one?
:D
You should not be using ADSIEDit.  Use ADUC with the acctinfo.dll extension.
The Large Integer value is the timestamp - it may be set to a value that indicate that it has not been set.
ADSIEdit is not necessarily a live view of AD objects.  It is an editor for raw objects and it is very easy to break AD with it.
If yu have been  using it regularly then perhps this explains why you have issues with AD.
Is this a corporate AD implementation?
Is this AD 2003/2008 or R2?
Is this just a home test rig?
If WS2003 then what level is it at?
Somewhere in the above is the reason you are seeing issues.  Everything you ae providing just points to some bits of missing information. The scripts are working correctly.  The results from adsiedit may not be what they seem.
jv