Adam's AD Admin

For those who need a powershell reference close to hand, the Powershell Toolbar  contains a wealth of resources, including a link to this blog! Thanks Shay for adding me! cheers Adam

Hi I've justhad a comment from a colleague that i haven't put anything up here for a while (thanks Dimce!), which is very true - i can only hold my head in shame! Since that comment, i have found a very nice (albiet from a few years back) article about arrays from Bruce Payette http://blogs.msdn.com/b/powershell/archive/2007/01/23/array-literals-in-powershell.aspx?wa=wsignin1.0 this just says to me that for however long you use powershell, there is always something more to learn! cheers Adam

It has been a while since I have posted anything, mainly due to changing jobs and the time spent with my ever growing family.  This is not to say that I have not been keeping up with scripting development...far from it! I had an interesting one today where a request came in for the following : “I need the bitlocker recovery password for a deleted computer object” As my current environment does not support the AD cmdlets, I looked to the quest tool set and was pleasantly surprised. Here is what I came up with, commented in line... #for easy editing, define the computername that has been deleted $compname = "ABC12345" #search AD including Deleted objects (-tombstone) for recovery information objects and filter where the last known parent contains the computer name. Then just return the password $recoverykey = Get-QADObject -Tombstone -Type "msFVE-RecoveryInformation" -SizeLimit 0 -Includedproperties msFVE-RecoveryPassword -SearchRoot "CN=Deleted Objects...

I have recently been contributing to powergui.org, an RSS feed of my posts follows: feed://powergui.org/rss/rssmessages.jspa?categoryID=55&rssUsername=adamstone  when ever searching for answers, powergui.org always seemed to come up in my google results and has proven a good resource for powershell answers.  Hopefully, I can contribute something back! cheers Adam

On my troubleshooting travels, I came across this link precisly addressing the problem I had encountered.  From this though, I quite liked the neat way in which the user account elevation test was completed.  I have modified it slightly to simplify the code, but it still does what it needs to.  Thanks for the post Oisin! $identity = [Security.Principal.WindowsIdentity]::GetCurrent() $principal = new-object Security.Principal.WindowsPrincipal $identity $elevated = $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if ($elevated) {"elevated - continue"} else{"Not Elevated"}

Get group members of large groups via Powershell I have always been aware that getting the group membership of large groups has been a challenge and have always managed to avoid addressing the issue.  (Is that what we call the 'Too Hard' pile???) Well, I have had a reason to find this out again, but this time I have Powershell to help me out! Why is this such an issue I hear you ask... this link  expalins why.  In a nut shell, you will only every return a maximum of 1500 members for a group, 1000 if you are querying Windows 2000.  I cannot take any credit for the soulution, I can only pass on a now ancient (in poweshell terms that is) Monad link to how to enumerate all the members of a group from /\/\o\/\/ .  As you will see, this link refers to Monad, the pre-release name for powershell.  Please follow the link above or more from /\/\o\/\/ can be found at thepowershellguy.com meanwhile, I have added my own comments to his sc...

Trigger KCC on all Domain Controllers If you need to ensure all DC's have built the latest topology, a quick powershell one-liner (that's powershell v1 and v2).  foreach ($dc in [System.DirectoryServices.ActiveDirectory.domain]::getcurrentdomain().FindAllDomainControllers()){$dc.CheckReplicationConsistency()} Check out all the DC Methods that can be run in this way.

Get-ADDomainController Get-ADDomainController is useful to easily return all, or a subset of your domain controllers.  This can be easily filtered by type, OS, AD Site, or a number of other values. Example usage #get all read only DC's Get-ADDomainController -filter {isreadonly -eq $true} # get the domain controller DC1 Get-ADDomainController -identity "DC1" # get the PDCE for the domain Get-ADDomainController -Discover -Service "PrimaryDC"} # get a GC but force it to rediscover (clear any cached DC) Get-ADDomainController -Discover -Service "GlobalCatalog" -ForceDiscover Define the parameters Identity takes a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". Service takes the following : PrimaryDC or 1 GlobalCatalog or 2 KDC or 3 TimeService or 4 ReliableTimeService or 5 ADWS or 6 Filter uses the format {isreadonly -eq $true...

Add-ADGroupMember Quite an easy one to start with, but quite handy too. Saves a few lines of code from ps1. Example usage Add-ADGroupMember -identity "Group name" -members "new group member" Add-ADGroupMember "Group name" "list of new group member" Define the parameters Both identity and members take a range of identifiers for the object. These include "Distinguished Name", "GUID", "SID", and "samaccountname". As all the cmdlets have been designed for interoperability, I find it best to use output from other commands like get-aduser. In a script #set the group name $Group = "All Managers" #get the objects that you want to add to the group (in this case, users with Manager in the description) $users = get-aduser -filter {description -like "*Manager*"} #Add the users to the group Add-ADGroupMember $Group $users Powershell without the Management pack How you gener...

AD Cmdlets reference Over the next few weeks, my aim is to add a reference to all the AD cmdlets that I am using and the equivilent Poswershell 1 code (or indeed powershell 2 without the AD management pack).  I am finding that I am doing a lot of conversion betweek the 2 versions at the moment and would find a quick reference handy, and if it is for anybody else, the great! First Cmdlet coming soon....any suggestions?

Searching AD using .net and a Global Catalog (GC) Server Although I have been recently been exploring the world of R2 and AD-cmdlts, I have re-visited .net to search a the whole forest in one quick step.  As A GC holds a subset of information on all objects in the forest, we can query any GC in the forest to return these values.  Here, I am doing a search for a specific UPN, but the filter can inculde any attribute stored on the GC. $upn= "first.last@domain.name" $Forest = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest() $GC = $forest.FindGlobalCatalog() $searcher = $gc.GetDirectorySearcher() $searcher.filter = "(userprincipalname=$upn)" $Results = $Searcher.FindAll() The rest of the script is the same as how we ended up in my AD Searcher You might not want to find any GC in the forest, you might want to only choose one from a particular site. As $forest.FindGlobalCatalog() has an option for this,...

Whilst doing some research into indexed attributes, I posted this  a while back on how to find your index attributes.  Since then, I have looked a little deeper into what indexing really means and found this excellent explanation on the numbers that can be found in the searchflags attribute of a schema object. Using Florian’s reference, I built the following script (which is both powershell v1 and v2 compatible) to get the schema attributes from the forest schema and return (among other things) the breakdown of your attributes search flags. $forest = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest() $schema = [ADSI]('LDAP://CN=Schema,CN=Configuration,dc=' + ($($forest).name -replace "[.]",",dc=")) $attributes = $schema.psbase.children | where {$_.objectClass -eq "attributeSchema"} $collection = @() foreach ($attr in $attributes){ $store = "" | select "Name","lDAPDisplayName","singlev...

I have been fortunate enough to be involved in quite a large RODC deployment in a Windows 2008 domain. Even more fortunate is that we are currently upgrading this domain to R2 so I am getting the chance to try out the new powershell 2 AD cmdlets. I have been looking quite a lot into RODC operations, and the importance of the Password Replication Policy (PRP from now on) component has become increasingly more apparent. My first thoughts of PRP were entirely user based. "It allows users to logon to a remote site when the WAN link is down" was my impression. But, when a user logs on to a domain from a trusted computer, there is 2 parts to the authentication - user AND computer. Therefore it is just as important to add the computer objects to the allow PRP as it is the users. While you are there, add any server that is in the same site as the RODC as they will need to authenticate too. My preferred way of doing this create 3 groups and add them to the PRP policy : all users, al...

Every wondered why some queries return much faster than others?  If you search on attributes that are indexed, your DC returns the value much quicker.  How can you find out what attributes are indexed?  use the following  : If you find that your attribute is not being indexed, take a look  here  to find out how to add it to the index. $Collection = @() $domain = [System.DirectoryServices.ActiveDirectory.domain]::getcurrentdomain() $ObjectCategory = "attributeSchema" $ObjectProplist = "name" $LdapQuery = "(&(objectCategory=$ObjectCategory)(searchFlags:1.2.840.113556.1.4.803:=1))" ($domain).name $LDAPdomain = [ADSI]('LDAP://CN=Schema,CN=Configuration,dc=' + ($($domain).name -replace "[.]",",dc=")) $Searcher = New-Object System.DirectoryServices.DirectorySearcher($LDAPdomain, $LdapQuery, $ObjectProplist) $Searcher.pagesize = 1000 $Results = $Searcher.FindAll() foreach ($Object in $Results){    $Store = "...

In the final part of this series, I will look at dealing with the lastlogontimestamp attribute and easily outputting the data you have gathered to a file. Part 2 left us with : $domains = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest().get_domains() $ObjectCategory = "user" $ObjectProplist = "name","samaccountname","whencreated" $LdapQuery = "(&(objectCategory=$ObjectCategory)(name=ad*))" foreach ($domain in $domains){       ($domain).name       $LDAPdomain = $domain.GetDirectoryEntry()       $Searcher = New-Object System.DirectoryServices.DirectorySearcher($LDAPdomain, $LdapQuery, $ObjectProplist,"subtree")       $Searcher.pagesize = 1000       $Results = $Searcher.FindAll()       foreach ($Object in $Results){             foreach ($prop in $ObjectProplist){            ...

I have been doing some testing on enabling WinRM via group policy, being that WinRM is the service that Powershell v2 sets up it remoting capabilities. Here are the GPO settings that you need to configure WinRM .... set the winrm service to auto start Computer Configuration \ Policies \ Windows Settings \ Security Settings \ System Services Windows Remote Management (WS-Management)  set Startup Mode to Automatic start the service incorporated in to the above - you may need a restart. create a winrm listener Computer Configuration / Policies / Administrative Templates / Windows Components / Windows Remote Management (WinRM) / WinRM Service / Allow automatic configuration of listeners IPv4 filter: * * is listen on all addresses, or if you only want a particular IP address to respond use an iprange eg 10.1.1.1-10.1.1.254 - don't forget that this IP range has to be valid for all hosts that fall in the scope of the GPO you are creating.  You can use 1...

A quick way of delegating PS remoting permissions .... http://msgoodies.blogspot.com/2009/09/using-ps-session-without-having.html

We finished up Part 1  with this script : $LDAPdomain = [ADSI]('LDAP://dc=other,dc=com') $Searcher = New-Object System.DirectoryServices.DirectorySearcher($LDAPdomain,"(objectclass=user)","name","subtree") $Results = $Searcher.FindAll() foreach ($Object in $Results){   $Object.Properties.name } I am going to take things a little further by adding variables which in turn will help remove any hardcoded elements of the script. A quick one first, after running your search for all users, did you notice that you got exactly 1000 results (assuming that you have at least 1000 users in your domain)?  This is the maximum number of records that you can return in one go using LDAP.  What you need to do is tell the searcher to page results by adding this command : $Searcher.pagesize = 1000 This will return the first 1000, but go off and find the next 1000 straight after, and so on. The next thing is to use variables instead of hard coding in the...

In my quest to make my life easier, I have been waiting with bated breath to get my hands on the remoting features of PS v2.  Now that I have access to windows 7 and Windows Server 2008 R2, let the fun begin! When looking for information about these new features, where better to go than the source.  I found this video on Tech.ED where Jeffery Snover (Powershell Godfather as he is introduced!) co presents using Powershell v2 in large Environments.  From my findings (mainly from this video) there are primarily 2 new ways of gathering information from remote computers in PS v2, the all singing all dancing big brother that needs all the options installed and configured, and the little brother version which has less pre-requisites for the remote client, but does not do quite as much. The -computername switch (Little Brother)  One of the biggest things missing in powershell 1 was the ability to run a cmdlet agains a remote machine.  With PS v2 this has c...

One of the first things I learnt to do in powershell was to search AD. I could search in VB but there were a few quirks and limitations that gave me the incentive to take the leap in to PS. That and I had just started a new job supporting a large financial AD environment where we had to do a lot of data capture across multiple domains! As anyone would, I looked at the way VB works and tried to convert it. Here is a direct translation of VB to PS in terms of searching AD ... VB Script : Set objConnection = CreateObject("ADODB.Connection") objConnection.Provider = "ADsDSOObject" objConnection.Open "Active Directory Provider" Set objCommand = CreateObject("ADODB.Command") objCommand.ActiveConnection = objConnection objCommand.CommandText = "<LDAP://dc=other,dc=com>;(objectclass=user);name;subtree" Set objRecordSet = objCommand.Execute If objRecordset.RecordCount > 0 Then    objRecordSet.MoveFirst    Do Until objR...