Hi Russ
Just out of idle curiosity, I would be interested to know why you
decided to extend the schema to flag all service accounts. I've seen
organisations use a specific naming convention to identify service
accounts before, but never adding a new attribute.
Tony
From: ActiveDir-owner (AT) mail (DOT) activedir.org
[mailto:ActiveDir-owner (AT) mail (DOT) activedir.org] Behalf Rimmerman, Russ
Sent: Tuesday, 16 May 2006 8:38 a.m.
To: ActiveDir (AT) mail (DOT) activedir.org
Subject: RE: [ActiveDir] Cmp question
I ended up using
oldcmp -report -age 120 -users -f
"(&(objectcategory=person)(objectclass=user)(!(ourAtt ribute=TRUE)))"
And it seemed to work.
Thanks
From: ActiveDir-owner (AT) mail (DOT) activedir.org
[mailto:ActiveDir-owner (AT) mail (DOT) activedir.org] Behalf joe
Sent: Monday, May 15, 2006 2:50 PM
To: ActiveDir (AT) mail (DOT) activedir.org
Subject: RE: [ActiveDir] Cmp question
-af "(!(ourProperty=TRUE))"
It would be more efficient and faster for the query to actually set all
of the non-service accounts to FALSE so then you can do
-af "(ourProperty=FALSE)"
NT filters aren't the greatest for efficiency plus you can get false
positives because an account that you can't see the ourProperty value on
due to security will be reported even if it has ourProperty set to TRUE.
joe