How to get a report of Active Directory Users suspended a certain time ago

Overview

This article on the legacy Cayosoft Suspend™ configuration describes how to get a report of Active Directory Users suspended 30 days ago.

IMPORTANT: In the Modern Cayosoft Suspend™ configuration, you can set up the reporting via the Report on Suspended AD Objects and Scheduled Operations rule. Refer to the following article for additional information: Report on Suspended AD Objects and Scheduled Operations rule. To learn more about the Modern Cayosoft Suspend™ configuration, refer to the following article: Modern Suspend Configuration.

Configuration

1. Create the AD Users report.

2. In Query criteria specify the following script:

   Copy

   {accountNameHistory -eq "<objectsuspended/>" -and accountNameHistory -like "*SuspendReport*" -and whenChanged -ge $compareDateTime}

3. In Other Query Settings in the Filter specify this script:

   Copy

   { [DateTime]::Parse(([xml]($_.accountNameHistory -like "*type=""SuspendReport""*") [0]).ObjectOperationsReport.start) -ge $compareDateTime }

4. In the Initialization script, provide the following:

   Copy

   { $global:compareDateTime = [DateTime]::Now.AddDays(-30) }

5. Save changes.