Adam's AD Admin

A new tick box was included in Active Directory Users and computer with Windows server 2008 - the ability to block the deletion of an object even if the user has admin rights to that object.  Looking behind the scenes at what that tick box does is actually add a Deny permission to the ACL of the object for you.  Without the AD management pack, when trying to script this to ensure all OU's are protected, you cannot check for this tickbox - You have to enumerate the permissions and verify all (yes, there is more than 1 permission added) exist.  Consequently, to 'tick' the box by a script, you have to add all the permissions which can be complicated.  I have managed to do this but it got too deeply involved in .net to be a simple solution. In the advent of the AD management pack for powershell though, life is made quite a lot simpler.  The following (one-liner!) will do the job for you. Get-ADOrganizationalUnit -filter {*} -searchbase (get...

As my quest continues to find out more ways to get exceptions (see this last post for my first attempt), I have been sent this post  at MSDN, which greatly helps me on my way. (Thanks Peter and Swaminathan) Until now, it has been somewhat of a mystery to me how to generate the catch [class] to successfully catch the specific error you want.  As demonstrated in the above link, the following command reveals all.... $Error[0] | fl * -force As shown in the link, it reveals Microsoft.ActiveDirectory.Management.ADPasswordComplexityException as the class to catch.  so all you need to do is insert (or run) this line just after an error is generated and you will see what you need to catch! I will be noting all errors / exceptions I encounter so a future blog post will be in the making soon.  I will also be seeing if the -force option reveals anything useful elsewhere!

AD Cmdlet Reference Link Use this quick link to list all my current and any future posts of the AD Cmdlet Reference series. Cheers!

Get-ADGroup A simple cmdlet for powershell 2 AD management pack to get group information in one line. Example usage get-adgroup -identity "domain admins" get-adgroup -filter 'GroupScope -eq "Universal"' Define the parameters Identity takes a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser. Full help file here . In a script This script gets detailed information about all the groups that user1 is a direct member of. get-aduser user1 -Properties memberof | select -expandproperty memberof | foreach {get-adgroup $_} Powershell without the Management pack To emulate the second example above, get all universal groups, I have chosen my GC search script  to return the information.  Note, all group type values have been list...

Add-ADDomainControllerPasswordReplicationPolicy This cmdlet is there to manage the Password Replication Policy for RODC's.  A handy tool as without the AD management pack, you can only do this at the command line with repadmin! Example usage Add-ADDomainControllerPasswordReplicationPolicy -identity $RODC -AllowedList $group Define the parameters Both identity and AllowedList (also, DeniedList) take a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser or in the case below, Get-ADDomainController. In a script In this script, I get every RODC, and firestly build a list of group names from the first 6 characters of the RODC name.  I then get the allowed list from the RODC and check my built list against the PRP entries.  For any that are not already memb...

Get-ADDomainController Get-ADDomainController is useful to easily return all, or a subset of your domain controllers.  This can be easily filtered by type, OS, AD Site, or a number of other values. Example usage #get all read only DC's Get-ADDomainController -filter {isreadonly -eq $true} # get the domain controller DC1 Get-ADDomainController -identity "DC1" # get the PDCE for the domain Get-ADDomainController -Discover -Service "PrimaryDC"} # get a GC but force it to rediscover (clear any cached DC) Get-ADDomainController -Discover -Service "GlobalCatalog" -ForceDiscover Define the parameters Identity takes a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". Service takes the following : PrimaryDC or 1 GlobalCatalog or 2 KDC or 3 TimeService or 4 ReliableTimeService or 5 ADWS or 6 Filter uses the format {isreadonly -eq $true...

Add-ADGroupMember Quite an easy one to start with, but quite handy too. Saves a few lines of code from ps1. Example usage Add-ADGroupMember -identity "Group name" -members "new group member" Add-ADGroupMember "Group name" "list of new group member" Define the parameters Both identity and members take a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser. In a script #set the group name $Group = "All Managers" #get the objects that you want to add to the group (in this case, users with Manager in the description) $users = get-aduser -filter {description -like "*Manager*"} #Add the users to the group Add-ADGroupMember $Group $users Powershell without the Management pack How you gener...