Adam's AD Admin

I’ve just had a look at how to use the ad recycle bin... and guess what, you need PowerShell to use it! Once you are running at R2 forest functional level, you need to enable the recycle bin... Get-ADOptionalFeature -filter {name -eq "Recycle Bin Feature"}} | Enable-ADOptionalFeature -scope ForestOrConfigurationSet Once that is done, you can delete an object safe in the knowledge that it will be available for full restore. so, how do we restore it? get-adobject -filter {displayname -eq "Adam Stone"} -IncludeDeletedObjects | Restore-ADObject -TargetPath "cn=users,dc=domain,dc=com" It's not the way I imagined the feature will be implemented, but an improvement on the previous restore process.  Look out for a future post building this into a function!

A new tick box was included in Active Directory Users and computer with Windows server 2008 - the ability to block the deletion of an object even if the user has admin rights to that object.  Looking behind the scenes at what that tick box does is actually add a Deny permission to the ACL of the object for you.  Without the AD management pack, when trying to script this to ensure all OU's are protected, you cannot check for this tickbox - You have to enumerate the permissions and verify all (yes, there is more than 1 permission added) exist.  Consequently, to 'tick' the box by a script, you have to add all the permissions which can be complicated.  I have managed to do this but it got too deeply involved in .net to be a simple solution. In the advent of the AD management pack for powershell though, life is made quite a lot simpler.  The following (one-liner!) will do the job for you. Get-ADOrganizationalUnit -filter {*} -searchbase (get...

Manage Shadow Group Membership - PowerShell Function I looked at a quick script to update a shadow group here , and then thought, this would make a good function. I have used my function template (refer to that post if you want to know more about how to format a function), to build up a reusable script to update group membership based on user and computer object location in AD. A traditional shadow group is all members of an OU. In my mind, there are a few assumptions to this statement. Being that you have taken the time to create an OU, put objects in it, and created a group to mirror those objects, you probably have only 1 type of object (i.e. user) and they are all similar in some respect (i.e. same office location). This function takes that in mind and only updates groups with users or computers - not other groups etc. Moving away from the traditional meaning of shadow group, I have added (for my own benefit as I required the functionality) a parameter to change the searchsco...

AD Cmdlet Reference Link Use this quick link to list all my current and any future posts of the AD Cmdlet Reference series. Cheers!

Get-ADGroup A simple cmdlet for powershell 2 AD management pack to get group information in one line. Example usage get-adgroup -identity "domain admins" get-adgroup -filter 'GroupScope -eq "Universal"' Define the parameters Identity takes a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser. Full help file here . In a script This script gets detailed information about all the groups that user1 is a direct member of. get-aduser user1 -Properties memberof | select -expandproperty memberof | foreach {get-adgroup $_} Powershell without the Management pack To emulate the second example above, get all universal groups, I have chosen my GC search script  to return the information.  Note, all group type values have been list...

ADMGS - How to install on Server 2003 and Server 2008 From someone who has done a lot of AD related scripting in powershell v1, it has taken me a while to get to grips with using the new AD cmdlets in PowerShell v2.  Needless to say, I have started 'dipping my toe' into the vast 'sea of cmdlets' now available and am finding them quite useful.  So much so, that enabling the ability to use the cmdlets in my older domains has become essential.   I no longer want to have to write v1 and v2 scripts, or more specifically, ad cmdlet and non-ad-cmdlet enabled scripts.  Here enters the 'Active Directory Management Gateway Service'  .This provides the connectivity for the AD-cmdlets to communicate with a domain controller in your domain. Pre-requisites For a small installer, this guy need a fair few prerequisites - each OS version being slightly different. Windows 2008 (tested on 32bit) It is best that you have SP2 inst...

I have been fortunate enough to be involved in quite a large RODC deployment in a Windows 2008 domain. Even more fortunate is that we are currently upgrading this domain to R2 so I am getting the chance to try out the new powershell 2 AD cmdlets. I have been looking quite a lot into RODC operations, and the importance of the Password Replication Policy (PRP from now on) component has become increasingly more apparent. My first thoughts of PRP were entirely user based. "It allows users to logon to a remote site when the WAN link is down" was my impression. But, when a user logs on to a domain from a trusted computer, there is 2 parts to the authentication - user AND computer. Therefore it is just as important to add the computer objects to the allow PRP as it is the users. While you are there, add any server that is in the same site as the RODC as they will need to authenticate too. My preferred way of doing this create 3 groups and add them to the PRP policy : all users, al...