Adam's AD Admin

I wrote about hash tables a while back in regards to counting OS types. The one thing I didn't lookinto back then was how to export the information to CSV. Easy, I hear you cry - just use export-csv!  Not quite as easy as you would imagine. The main thing to tackle is the fact that Hash Tables are not objects as we would usually consider them.  If you run get-member on a hash table you get the following properties : Count IsFixedSize IsReadOnly IsSynchronized Keys SyncRoot Values What is required is to create an object based on the hash table prior to exporting. Lets create a similar hash table to the one found in my previous post : $complist = get-ADcomputer -filter {enabled -eq $true} -properties operatingsystem $OSlist = @{} $complist | % {try {$OSlist.$($_.operatingsystem) ++}catch{$OSlist.None ++}} Export this to CSV and you get : PS U:\> $OSlist | Export-Csv "OScount1.csv" -NoTypeInformation PS U:\> type .\OScount1.csv "IsReadOnly",...

I'm starting to use compare-object more and more, and one thing I noticed, is that you can compare 2 objects based on multiple attributes. here is how it is constructed... Compare-Object -ReferenceObject $object1 -DifferenceObject $object2 -Property a,b,c,d,e If a,b,c and d are the same, but e is different, compare object will return a difference. In the following example, I use "-eq $null" as a check because by default compare-object returns $null if the objects are the same. #create an array of objects to check against $collection = @() foreach ($entry in ("aaaaa","bbbbb","ccccc","ddddd")){    $store = "" | select "a","b","c","d","e"    $store.a = $entry*1    $store.b = $entry*2    $store.c = $entry*3    $store.d = $entry*4    $store.e = $entry*5    $collection += $store } #create an object similar to those in the array $object = "" | select ...

A new tick box was included in Active Directory Users and computer with Windows server 2008 - the ability to block the deletion of an object even if the user has admin rights to that object.  Looking behind the scenes at what that tick box does is actually add a Deny permission to the ACL of the object for you.  Without the AD management pack, when trying to script this to ensure all OU's are protected, you cannot check for this tickbox - You have to enumerate the permissions and verify all (yes, there is more than 1 permission added) exist.  Consequently, to 'tick' the box by a script, you have to add all the permissions which can be complicated.  I have managed to do this but it got too deeply involved in .net to be a simple solution. In the advent of the AD management pack for powershell though, life is made quite a lot simpler.  The following (one-liner!) will do the job for you. Get-ADOrganizationalUnit -filter {*} -searchbase (get...

As my quest continues to find out more ways to get exceptions (see this last post for my first attempt), I have been sent this post  at MSDN, which greatly helps me on my way. (Thanks Peter and Swaminathan) Until now, it has been somewhat of a mystery to me how to generate the catch [class] to successfully catch the specific error you want.  As demonstrated in the above link, the following command reveals all.... $Error[0] | fl * -force As shown in the link, it reveals Microsoft.ActiveDirectory.Management.ADPasswordComplexityException as the class to catch.  so all you need to do is insert (or run) this line just after an error is generated and you will see what you need to catch! I will be noting all errors / exceptions I encounter so a future blog post will be in the making soon.  I will also be seeing if the -force option reveals anything useful elsewhere!