Skip to main content

Add-ADDomainControllerPasswordReplicationPolicy - AD Cmdlet Reference

Add-ADDomainControllerPasswordReplicationPolicy

This cmdlet is there to manage the Password Replication Policy for RODC's.  A handy tool as without the AD management pack, you can only do this at the command line with repadmin!

Example usage
Add-ADDomainControllerPasswordReplicationPolicy -identity $RODC -AllowedList $group

Define the parameters

Both identity and AllowedList (also, DeniedList) take a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser or in the case below, Get-ADDomainController.

In a script
In this script, I get every RODC, and firestly build a list of group names from the first 6 characters of the RODC name.  I then get the allowed list from the RODC and check my built list against the PRP entries.  For any that are not already members, I add them

foreach ($RODC in $(Get-ADDomainController -filter { isreadonly -eq $true })) {
   [string]$sitecode = $($RODC.name).substring(0,6)
   $list = "$($sitecode)Servers","$($sitecode)Users","$($sitecode)computers"
   $allowedPolicy = $(Get-ADDomainControllerPasswordReplicationPolicy -id $rodc -allowed) | select "samaccountname"
   Foreach ($group in $list) {
      If ($($allowedPolicy | % {$_.samaccountname}) -notcontains $group){
         Add-ADDomainControllerPasswordReplicationPolicy -identity $RODC -AllowedList $group
      }
   }
}



Powershell without the Management pack

I have searched for this functionallity within .net to no avail.  The only way I have found to do this sort of thing without the AD management pack is to call repadmin from within powershell.

repadmin /prp add $RODC allow $group
Labels:

Comments

Post a Comment

Popular posts from this blog

Assigning Permissions - AGDLP

AGDLP It seems I have been mildly distracted away from the title of this blog site.   It does say AD Admin, but I seem to have been taken away by file system stuff.   I have to say, it has all been worthwhile, but it’s probably time I got back to the real heart of what I do. There are probably a million permission assigning advice pages, but I thought I would put another one out there after referring to AGDLP in my last post. So, what is this all about – AGDLP.   Well, it is something I learned in my MCSE 2003 studies and has become ingrained into my ideals since.   As a contractor, I get to move job often.   This enables me to forge opinions on how to configure things in a domain, and more importantly how NOT to configure things. AGDLP is definitely on the to do list…for anyone in any size domain or forest, as it follows some very basic principals.   I will explain these whilst I go through what AGDPL stands for. A A is for...
2 comments
Read more

Finding out what 'SearchFlags' are set on you AD attributes

Whilst doing some research into indexed attributes, I posted this  a while back on how to find your index attributes.  Since then, I have looked a little deeper into what indexing really means and found this excellent explanation on the numbers that can be found in the searchflags attribute of a schema object. Using Florian’s reference, I built the following script (which is both powershell v1 and v2 compatible) to get the schema attributes from the forest schema and return (among other things) the breakdown of your attributes search flags. $forest = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest() $schema = [ADSI]('LDAP://CN=Schema,CN=Configuration,dc=' + ($($forest).name -replace "[.]",",dc=")) $attributes = $schema.psbase.children | where {$_.objectClass -eq "attributeSchema"} $collection = @() foreach ($attr in $attributes){ $store = "" | select "Name","lDAPDisplayName","singlev...
2 comments
Read more

Updated : V0.992 Filesystem Powershell module

Update : version 0.992  now available including DFS-r Hot on the heals of my AD sites module , I have been looking at some file system functions.  This module is driven primarily by my own needs, but after a prompt on the powergui website from someone after a way of managing DFS with powershell (thanks packetboy), this is what I have come up with.  All help files are included with examples, but I will publish the help and examples over time. Requirements This module has been built on a Windows 2008 R2 platform and therefore the DFS functions will be based around the 2008 R2 version of DFSUTIL.  This is not to say that it is not compatible with anything earlier, it has just not been tested. Installation and use Download the zip file and extract to your modules folder. This can be found by running "explorer $pshome\modules" from a PowerShell console. To use, run "import-module Filesystem" Command list and Help To retrieve the list of comma...
14 comments
Read more