Impacket's GetADUsers.py performs paged LDAP searches against an Active Directory domain and prints each returned user's sAMAccountName, mail, pwdLastSet, and lastLogon. By default it selects enabled users with a mail value; -all includes users without email and disabled accounts, and -user narrows by sAMAccountName. It does not query through SAMR or return badPasswordTime or account-status fields.
Python
RESTRICTED_ACCESS_BLUR_MARKER