AD Reporting Documentation

Quick Introduction

AD Reporting can be used to automate your Active Directory audits. You can also perform one off queries such as locating computers that haven’t been used in the last six months. You can also use it to clean up your Active Directory by easily identifying unused or obsolete user and computer accounts based on their last logon time and account status. You can use the built-in scheduler to run scheduled reports, perform actions such as disabling accounts, removing the user from sensitive groups etc.

System Requirements

• • Microsoft .Net 4.8 Framework
  • Microsoft Windows 7, 2008 R2 or later

Main features

• • Pre-built and custom reports
  • Accurately locate the last time users and computers were used.
  • Detailed account status
  • Automate reports and bulk changes
  • Built-in scheduler
  • Powerful bulk administration tools
  • Move, Delete or Disable redundant accounts
  • Command line operation
  • Email, print or export reports
  • No server components or agents to install
  • No changes to Active Directory required

Installing AD Reporting

Files installed by AD Reporting
Program executable: ADReporting.exe
Name: AD Reporting
Path: C:\Program Files (x86)\Dovestones Software\AD Reporting

Upon being installed, the software adds a Windows Service, which is designed to run continuously in the background to execute the scheduled jobs.

Note: Ensure that you have necessary privileges to install and run the product

By default, AD Reporting will be installed as an application, run the self-extracting EXE and follow the instructions.

• To continue with the Start-up Wizard, click Next.

Follow the prompts. A progress bar shows you how long it will take to install AD Reporting.

Remove AD Reporting

You can uninstall AD Reporting from your computer by using the Add/Remove Program feature in the Windows Control Panel.

• On the Start menu (for Windows Server 2012, right-click the screen’s button-left corner), click Control Panel.
• Under Programs, Click Uninstall a Program:
• When you find the program AD Reporting, click it, and then Click Uninstall.
• Follow the prompts. A progress bar shows you how long it will take to remove AD Reporting.

Getting Started

When running AD Reporting for the first time you will want to select your domain and choose which domain controllers to query.

1. Click the Domain Query button in the ribbon and select a Domain you want to query. When you click the domain you will see a list of DCs discovered in your domain, by default all domain controllers will be queried, this will get you the most recent logon time and makes sure you get the values that are not replicated to all DCs. However, you may not want to query certain DCs (if they are across a slow link for example), in this case select the DCs you want to query and then click OK.
   
2. The next step is to specify a user account that will be used to connect to connect to Active Directory and import/update the user objects. Click the Authentication button to enter a username and password to be used for the connection, if you don’t specify a username and password then the credentials of the user running the program will be used.
   
3. Click the Domain button in the ribbon to switch between domains.
   
4. Click the Browse button in the ribbon to see your domain tree, check Organizational Units (OUs) or Groups to query and then OK. Paths to query will be listed below the tree. Details of the users or computers found in the selected OUs or Groups will be displayed in the main grid after we click the Start button.
   

Columns and Attributes

By default, the values of certain attributes are retrieved such as sAMAccountName (username), lastLogon, accountExpires etc. You can add additional attributes/columns that you want to display by clicking the Add/Remove Columns button. You can create your own preset groups to help with different reports. These presets can be used in the Scheduler.

Starting a query in AD Reporting

When you have selected the domain(s) that you wish to target and chosen the OUs/Groups to query you can run the query by clicking the Start button.

Basic Filters

Quick filters allow you to further filter the objects appeared in the AD Reporting grid.

By default, AD Reporting contains thirteen Quick filters:

1. None
2. Account that have not logged on in the last (Filter days)
3. Accounts that have logged on in the last (Filter days)
4. Accounts that have never logged on
5. Account with password that expire in less than (Filter days)
6. Accounts with password that expire in more than (Filter days)
7. Accounts with non-expiring password
8. Accounts that expire in the next (Filter days)
9. Accounts that have expired
10. Locked accounts
11. Unlocked accounts
12. Disable accounts
13. Enable account

You can set also the days for some filter, so you will be able to track:

• Accounts that have not logged or that have logged for a certain period of time.
• Accounts with password that expire in less or more than days.
• Accounts that are set to expire in the next days.

Advanced Filter

Each query has a list of parameters that determine which objects that query will find. Each parameter consists of the following: An attribute, an operator, and a value. An example of a parameter for a User query could be: “Disabled accounts” and this would obviously only return Users accounts that are disabled. In this example, the attribute is the “Enable” attribute, the operator is the “Equals” (check/uncheck the box for enable/disabled accounts).

Filter editor can be customized to meet specific conditions that results from a query. A conditions has one more clauses, each enclosed in parentheses. Each clause evaluates to either True or False. A syntax filter clause is in the following form: <AD Attribute><comparison operator><value>

Logical operators

Logical operators are used to create logical combinations of other filter operators. They may be nested to any depth. The following logical operators are available:

• <And>
• <Or>
• <Not And>
• <Not or>

The content for <And> and <Or> is two filter operator elements. The content for <Not> is a single filter operator element.

Condition

You can combine two or more conditions to build complex queries. You can use the AND and OR operators into a compound condition. AND, OR and NOT, are logical operators. When you use multiple logical operators in a compound condition, NOT is evaluated first, then AND, and finally OR. Operator’s important characteristics are:

• AND connects two conditions and returns true only if both conditions are true
• OR connects two conditions and returns true if either condition is true or if both conditions are true
• Unlike AND and OR, NOT does not connect two conditions. Instead, it negates (reverse) a single condition.

Group

By grouping query clauses, you specify that those clauses should be evaluate as a single unit within the rest of the query, similar to putting parentheses around an expression in a mathematical equation or logical statement.

Add/Remove Columns

By default, AD Reporting displays 12 columns of attributes data for objects, as the saMAccountName and cn attributes.

To change the display, selects add/Remove Columns. In the Add/Remove Columns dialog box, there is a list of columns to choose from to display in the result pane.

Add Column: Can be configured to display operational attributes that are not shown by default.

Import Columns: Can be used to select properties to import from a domain controller

Save Preset: Save the current selected view giving ID and Name

Actions

The actions tab contains a set of commands for the most important use of AD Reporting. This panel can be quickly accessed by clicking the Actions tab in the grey bar panel or by clicking the icon located in the query tab section.

Eight actions can be performed in this tab, let us review section by section.

Enable/disable accounts

In the details pane, right-click the user or computer or just Click Enable/disable from the toolbar Actions menu. Depending on the status of the account, do one of the following:

• To disable, click Disable Account. Click yes to confirm.

• To enable, click Enable Account, Click Yes to Confirm.

Delete

In the details pane, right-click the user account or just click Delete from the toolbar Actions menu, and then click Delete. This will remove the selected user(s) or computer(s) object from Active Directory.

• Click yes to confirm.

Move

In the details pane, right-click the user that you want to move, and then click Move. In the Move dialog box, click the folder to which you want to move the user account.

In the Move dialog box, click the folder to which you want to Move the user account.

• Click Yes to Move the user to another folder.

Note: To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Add to Group, Remove from Group and Remove from All Groups

In the details pane, right-click the User you want to Add or just clicking the equivalent command from the toolbar actions menu. On the Members tab, click Add/Remove

In enter the object names to select, type the name of the group, or computer that you want to add/Remove to the group, and then click OK.

• Click yes to add the user to the group.

• Click yes to remove the user to the group.

• Click yes to remove the user from all groups.

Note: To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

Set Expire Date

In the details pane, right-click the User you want to set the expiration time or just Click Set Expiry Date from the toolbar Actions menu. To specify an exact time, just specify the period from the current time.

• Sets the expiration date for an Active Directory account.

• Click Yes to confirm the account expire at the end of a specific day.

Export Tab

AD Reporting reads the Users/Computers from Active Directory, then you can export these objects to a data source such as a CSV file, Excel (XLS and XLSX), PDF, database (SQL Server and Microsoft ODBC for Oracle) or print.

Pre-built Reports

AD Reporting has many pre-built reports, this makes accessing the most commonly used data as quick and as easy as possible. Need to know which users have been created this week? Simply click on ‘Prebuilt Reports’ in the ribbon and then ‘User Reports’ followed by ‘Users created this week’. There are reports for Users, Passwords, Computers, Groups and Office 365.

Custom Reports

You may come across a pre-built report that is close to what you need but not exactly what you need. Click ‘Create Report’ then locate the report that is closest to what you need and click Clone. Then you can give your report a name and modify the time frequency and attributes used. Click Save to complete your report. You will find your custom report under ‘Custom Reports’ in the ribbon and also available in the Scheduler if you chose ‘Report’ type schedule.

AI Query Assistant (Human-to-LDAP Filter Generator)

The AI Query Assistant in AD Reporting allows you to generate precise LDAP filters using natural language.
Simply describe what you need in plain English, and the AI will automatically generate the corresponding LDAP filter for your report.

This feature significantly simplifies complex filter creation and helps administrators build advanced queries faster and more accurately.

With AI Query Assistant you can:

• Generate LDAP filters from human text
• Combine AI-generated filters with existing report filters
• Instantly run the report
• Save the generated query as a Custom Report
• Reuse the report anytime from the Custom Reports list

Example request: “Give me all users with Title = Developer”
The AI will generate the appropriate LDAP filter and apply it to your report.

Step 1 – Configure AI Provider

Before using the AI Query Assistant, you must configure an AI provider on your side.
For detailed configuration instructions, please refer to documentation: How to Configure AI Provider

AD Reporting supports multiple AI providers (Ollama Local, Azure OpenAI, Claude, ChatGPT, etc.), but only one provider can be configured per application instance.

To configure AI Provider:

1. Open AI Provider Settings
2. Select your provider (e.g., Ollama Local)
3. Specify the parameters
4. Click Save

Note: AI Provider must be configured before using the AI Query Assistant.

Step 2 – Generate LDAP Filter Using AI

1. Open the AI Assistant window.
2. In the text box, describe what you need. Example: Give me all users where Name contains John and Department is Sales
3. Click Generate Query
4. The AI-generated LDAP filter will appear in the output field.
5. Review the filter carefully.
6. Click Run Report to execute.
7. (Optional) Click Save Report to store it as a Custom Report.

Important Notes

• AI output is machine-generated and may contain inaccuracies.
• Always validate the generated LDAP filter before running production reports.
• The AI-generated filter will be combined with existing filters from the main screen:
  – AD Path
  – Object Type
  – Selected Columns
  – Time Scale settings

Step 3 – Save as Custom Report (optional)

After generating and testing your AI query:

1. Click Save Report
2. Provide a report name
3. Click Save

The report will now appear under: Custom Reports → AI Query Report

You can:

• Edit
• Clone
• Delete
• Run it anytime

This allows you to convert natural language queries into reusable reporting templates.

Security & Validation

• AI Query Assistant only generates LDAP filters.
• It does not modify Active Directory.
• Output must be validated by the user.
• One AI provider per application instance is supported.

Best Practices

• Keep requests clear and specific
• Use exact attribute names when possible (Title, Department, Name)
• Avoid ambiguous wording
• Always test in a safe environment first

Dashboards

The Dashboards feature allows you to create interactive, visual dashboards based on your Active Directory or Entra ID query results. Dashboards help transform raw data into meaningful insights by displaying key metrics, trends, and distributions in a clear, visual format. Dashboards are fully customizable and designed to support both quick overviews and deep analytical scenarios. 

Dashboards are available from the main ribbon. This section provides access to all dashboard-related operations, including creation, editing, deletion, and data refresh: 

Dashboards in AD Reporting are data-driven and rely on the Results tab as their data source. 

Before using dashboards: 

1. Run a query on a main screen 
2. Ensure the Results tab contains data 
3. Only then open or refresh a dashboard 

Note: If the query has not been executed, dashboards will not have data to display. 

To modify an existing dashboard: 

1. Select the dashboard 
2. Click Update Dashboard 
3. The Dashboard Builder opens with the current configuration 
4. Make your changes 
5. Click Save Dashboard 

All changes are applied immediately and reflected in the dashboard view. 

Dashboards that are no longer needed can be removed easily: 

1. Select the dashboard 
2. Click Delete Dashboard 
3. Confirm the deletion 

Note: Deleted dashboards cannot be restored. 

The Reset Dashboard button is available only for default dashboards. This action restores the selected dashboard to its original state as it was when the application was installed. 

Important: Resetting a dashboard permanently removes all custom changes and configurations made to that dashboard. This action cannot be cancelled. 

Scheduler Tab

Using the Scheduler feature of AD Reporting you can schedule various Actions to run automatically at predefined intervals. Scheduler are often used to automatically add or remove AD objects from groups, send e-mail notifications, clean inactive user and computer accounts from Active Directory, move objects between OUs based on certain policies, etc.

Configuring a Scheduled Task item

When setting up a task, first decide what will trigger that task to start. A trigger is a set of criteria that, when met, starts the execution of a task. You can use a time-based trigger or an event-based trigger to start a task. Each task can contain one or more triggers, allowing the task to be started in many ways. If a task has multiple triggers, the task will start when any of the triggers occur. Click the New icon to start the schedule wizard.

• Enter the name for the new Scheduled Task, and click Next.

• On the Trigger Type and Once Trigger page, you need to define the time or time interval at which the task must be run. Select the desired time or time interval and click Next.
• Select your Schedule Type

• Select the frequency

• Select the type of schedule, Export or Report

On the query Information page will change depending on if you chose Export or Report, in either case you will need to select the Groups/OUs that the Export/Report will use.

The Scheduled Task will be executed on all objects of the chosen type included in the activity scope of the task. You can use the Test Query button to see if you get the desired results.

• If you chose Export type schedule then the next step is to choose where to export to, database or file. If you chose Report type schedule you will be give the option of applying Actions to the report (see later in this section).

• If you chose File in the previous step now select a location to save the file and the option to have it sent via email. If you choose ‘Email file’ then the file is temporarily saved and once the email has been sent the file is removed.

The final page in the wizard is the summary, here you can review your choices and test the schedule. Please note if you have applied Actions then these will be run and effect the objects found in the report.

• If you chose ‘Report’ type towards the beginning of the wizard you will see the Actions page (below). Here you can specify which actions the task will perform when it is executed. To add an action: Click the Add Action button. Select the action you need in the list.

You can also automatically send actions report by email. The email you receive will list each action and the objects effected by that action.

Settings

The option Settings provide an additional window to change the default language, enable logging, Clear the History, set the client timeout and to see the AD Reporting version.

You can also find the AD Reporting Command line. For info about this feature go to the command line operation content.

Command line operation

The scheduler built-in to AD Reporting contains a wizard that will help you automate AD Reporting, however if you do need to use a command line you can use ADReportingCLI.exe. You can find the syntax and command line examples for ADREPORTINGCLI.exe below.

AD Reporting Command Line Syntax

General options:

/? /HELP
Displays command-line help

/LANG
Changes the application language (e.g. /lang:de)

/LOG
Enables application logging

Query Options:

/DOMAIN
The domain name (e.g. mydomain.com)

/DC
The list of domain controllers to query
Multiple DCs should be separated by a comma
If none are specified, all DCs will be queried

/TIMEOUT
The amount of time in seconds to wait for the DC to respond

/USERNAME
The username to authenticate to Active Directory

/PASSWORD
The password to authenticate to Active Directory

/OU
The list of OUs or groups to include in the query
Multiple OUs should be separated by a semicolon

/OBJECTS
The object classes to be retrieved
Parameter values: USERS or COMPUTERS
Multiple object classes can be separated by a comma
If not passed, the default object class will be USERS

/COLUMNS
The list of column IDs to be included in the query
Multiple column IDs should be separated by a comma

/PRESET
The preset columns list ID

/FILTER
The filter expression applied to the retrieved data
e.g.: /filter:”cn LIKE ‘%myname%'”

/QUICKFILTER
Use one of the following: NotLoggedOnInXDays, LoggedOnInXDays, NeverLoggedOn, PasswordExpiresInLessThanXDays, PasswordExpiresInMoreThanXDays, AccountExpiresInTheNextXDays, AccountExpired, LockedAccount, UnlockedAccount, DisabledAccount, EnabledAccount, NonExpiringPassword

/QUICKFILTERPARAMS
Use to specify the days param to the quick filter
Use with quick filters that need a parameter
e.g.: /QUICKFILTERPARAMS:7

/SORT
The sort expression applied to the retrieved data
e.g. /sort:”cn ASC”

Export options:

/FORMAT
The export format (Parameter value: CSV,XLS,XLSX,PDF or DB)

File export Options:

/FILE
The full path of the destination file
Required for CSV, XLS, XLSX and PDF export formats

/ENCODING
The encoding of the file when the export format is CSV
Parameter value: ASCII, UNICODE or UTF8
If not passed, the default encoding will be ASCII

Database export options:

/CONNECTIONSTRING
The database ODBC connection string

/TABLENAME
The destination table name

/TABLEACTION
The action to perform on the table before inserting the data
Parameter value: NONE, CREATE, TRUNCATE or DROP

NONE: Does not modify the table
CREATE: Creates the table
TRUNCATE: Truncates the table
DROP: Drops and recreates the table
If this argument is not passed, the default action will be DROP

Action options:

/ACTION
Defines the action to execute on the results.
Use one of the following: ENABLE, DISABLE, DELETE, MOVE, ADDTOGROUP, REMOVEFROMGROUP, REMOVEFROMALLGROUPS, SETEXPIRYDATE

/ACTIONPARAM
The parameter to pass to the action if it requires it.
For MOVE action, the parameter should be the DN of the destination OU
For ADDTOGROUP and REMOVEFROMGROUP actions, it should be the group’s DN
For SETEXPIRYDATE action, it should be expiry date in system format

Notes:

• The command-line arguments and their values are case insensitive
• When an argument value contains spaces, surround it by double quotes

Example use:

Export the default columns present for users in TestOU1 and TestOU2 organizational units to a CSV file

Export “cn” and “displayName” attributes for users in the “TestOU” organizational unit to a database table named “TestTable” located in a SQL Server database

Support

If you require help with AD Reporting or simply need to ask a question please you can contact us via our support form or send an e-mail to [email protected].

See also the Frequently Asked Questions at https://dovestones.com/faqs/.