Time Zones and Account Expiration

[DeeJay]

We currently have domain controllers in Cupertino, CA (PST or GMT -8:00) and
Bangalore, India (GMT +5:30). When we set account expirations in Cupertino
they replicate correctly to the DC's in Bangalore. But when an account
expiration is set for a user in Bangalore, they replicate back to Cuperino
as the date set -1. Example:

Account Expiration Set At
Appears on Cupertino DC as Appears in Bangalore DC as
foobar1 March 30th Cupertino March
30th March 30th
foobar2 March 30th Bangalore March
29th March 30th

This of course is a problem as we want helpdesk technicians in India to
assist us with setting account expirations but Cupertino users need to logon
to their AD accounts up until the date their account expires. Any idea on
exactly what method or methodology Active Directory uses to determine the
proper date for Account Expirations? I really cannot find any proper
documentation on this or support information. Thanks!

 

[Richard Mueller]

Hi,

Dates like accountExpires are stored in UTC (Coordinated Universal Time or
what used to be called GMT). When it is midnight 3/30 in Bangalore, I think
it is 7pm 3/30 in Greenwich England and 11am 3/30 in California. If the
account expires at the end of the day 3/30 in Bangalore, this is 11am that
day in California. I suspect ADUC displays this as the end of the day 3/29,
since it does not show the time.

I don't see a fix except to take the one day offset (actually 13 hrs) into
account. You cannot assign values to accountExpires directly.

 

[Richard Mueller]

Hi,

My mistake, it can be done with the AccountExpirationDate property method in
a script. Assuming I have the time differentials correct, the people in
Bangalore must set the expiration date to be 13 hours later (their local
time). That is, to set expiration as midnight 3/30 (in California), the
script should set the expiration date to 1pm 3/31 (local time) in Bangalore.
In brief, a VBScript program could be:

Set objUser = GetObject("LDAP://cn=Joe User,ou=Sales,dc=MyDomain,dc=com")
' Set account expiration for the end of the day 3/30/2006 in California.
' This is 12:00am 3/31.
dtmExpire = #3/31/2006#
' Add 13 hours to account for time zones.
dtmExpire = DateAdd("h", 13, dtmExpire)
' Assign expiration date.
objUser.AccountExpirationDate = dtmExpire
' Save changes.
objUser.SetInfo

Note that daylight savings time changes can mess this up, but only by an
hour, no matter what ADUC shows. You could have the script prompt for the
expiration date. Note, end of day 3/30 is #3/31/2006#.

 

[DeeJay]

Richard,

You are absolutely correct! Using a AD User Information tool I can see that
when I attempt to set an Account Expiration in Bangalore the account is set
to expire +10:30h from PST. (See attached, image shows +11:30h but reflects
+1hr for DST since account was set to expire after 4/2/2006) If I modify the
script to use 10:30 for the amount of time it uses for the DateAdd function
then theoretically this should set the expiration time to 12:00AM PST and
accounts in California should expire properly. I will try it out, thank you
so much.

- DJ