Reporting on changed attributes
I have a script that runs right now that shows me accounts that were modified in the past 24 hours. It does the job but reports on any kind of change (obviously). I want to narrow this down to just report on a particular attribute changed, in my case the email attribute. Is there an easy way to do this or would I have to run two reports and compare?
September 14th, 2015 5:50pm

Yes this is possible. You can use the replication metadata to narrow down which attribute has been touched. I explain how to use them here: http://blogs.technet.com/b/pie/archive/2014/08/25/metadata-0-introduction-what-are-metadata-and-why-do-we-care.aspx

If you have a Windows 8 or a Windows Server 2012 handy you can use the PowerShell cmdLet: Get-ADReplicationAttributeMetadata. For example to list all date of modification of the mail attribute on the People OU of the contoso.com domain, it will look like this:

Get-ADObject ` 
    -SearchBase "OU=People,DC=contoso,DC=com" ` 
    -SearchScope Subtree ` 
    -LDAPFilter "(&(objectCategory=person)(sAMAccountName=*))" ` 
    -Properties msDS-ReplAttributeMetaData | ` 
        Get-ADReplicationAttributeMetadata -Server DC2008R2 | ` 
            Where-Object { $_.AttributeName -eq "mail" -and $_.Version -gt 1 } | ` 
                Format-Table Object,LastOriginatingChangeTime,Version -AutoSize 

Free Windows Admin Tool Kit Click here and download it now
September 14th, 2015 7:19pm

The above mentioned PS command should work fine in your situation.

If you still unable to short-out the concern, you may also look into Lepide active directory auditing tool that could be a good alternative approach to manage and schedule this task automatically.

September 15th, 2015 2:41am