Search for users where AD attribute shows account ready to expire

Question

I am using Active Directory Sync and pulling over attributes on a profile for users.  One of the attributes I am pulling over is the AD Account Expiration.  I am looking for a way to query on this information to be able to send out a report when an account is going to expire in the next 30 days.  This is part of the termination process for my client and the user does not have a ticket opened yet for this.  This process is to alert managers when AD accounts are about to expire to have them either extend the account or for an Offboarding ticket to be generated if the account is to expire.  Because the date comes over as a string of numbers I am using a calculated date field to transform the date on tickets that are generated, but I need a way to pull this information prior to the account expiring.  Does anyone have any ideas on how I can accomplish this?  My client does not have script runner so I am looking for another way to accomplish a report being generated 30 days prior to an Active Directory Account expiration date.

Beth Starr_ozjkiw · Answer

My client does not have script runner to run a PowerShell script from Jira.  They can already do this from Active Directory - Windows PowerShell,  but I was trying to figure out how to run it on a user attribute in Jira prior to the account expiring.

Rafael Pinto Sperafico · Answer

Hi @Beth Starr,

Based on the information provided, it seems you are referring to Windows Active Directory. If so, you could be running the following from PowerShell (create an script, e.g expiringUsers.ps1):

Get-ADUser -Filter * -Properties AccountExpirationDate | 
 Where { $_.AccountExpirationDate } | ForEach {

$daysLeft = ($_.AccountExpirationDate - (Get-Date)).Days

If ( $daysLeft -lt 31 ) {
 $_.SamAccountName
 }

} | Sort-Object | Out-File .\expiringUsers.txt

As result, you should have a list of users in which accounts will be expiring within next 30 days in "expiringUsers.txt"