How to Know When an Object Was Created and Changed in Active Directory

Active Directory keeps timestamp for objects it creates in an attribute called WhenCreated. Attribute WhenChanged keeps the timestamp when an object is changed or modified. These two attributes are available to all the objects in Active Directory. There are various ways to check this information as listed below:

  • Using ADSIEdit
  • Using Active Directory PowerShell cmdlet
  • Using DSQuery

DSQuery is the preferred way to check the values of these two attributes quickly. To check WhenCreated and WhenChanged values for an object, type the following command:

DSQuery * “CN=TestUser,CN=Users,DC=<YourDomainName>, DC=<Com>” –Attr WhenCreated  WhenChanged

In the above command, we are checking values for a user account which resides in the Users container. When executed, the command returns the following output:

WhenCreated,                     WhenChanged

05/20/2013 05:01:23         06/28/2013 06:20:23

About Nirmal Sharma

Nirmal is a MCSEx3, MCITP and was awarded Microsoft MVP award in Directory Services. He is specialized in Directory Services, Microsoft Clustering, Hyper-V, SQL and Exchange and has been involved in Microsoft Technologies since 1994. In his spare time, he likes to help others and share some of his knowledge by writing tips and articles. Nirmal can be reached at [email protected].


About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top