This post describes the exact steps to use the Active Directory PowerShell cmdlets in your 2003 environment today.
As a Microsoft Premier Field Engineer I frequently get asked for more information on Active Directory topics. Most of the time I end up passing along one or more of the links in today's post. This list will be extremely valuable for anyone who wants to get started with Active Directory or even for a seasoned AD admin who wants to go deeper.
Today we will address the token size SID history scenario with a PowerShell script that documents the extent of SID history in your environment and creates a SID mapping file for use with the ADMT to migrate security resources to the new SIDs.
This post is part four in the "PowerShell: SID Walker, Texas Ranger" series on documenting and remediating SID history in your AD forest. In today's post we will look at the final step of remediating SID history: removing the SID history data from our migrated AD objects using PowerShell. Cleaning up this stale data will greatly reduce the chance of token size issues for your users.
In Active Directory we need to know who has the keys to our organizational units (OUs), the place where our users and computers live. Over the years OUs have grown to meet needs. Different teams may have been delegated access for managing users, groups, and computers. Then you come along as the new administrator. You probably have no idea where permissions have been granted to your OUs. And the scary thing is… neither does anyone else. I know, because I’ve been there. I hear the same thing from our customers.
Out-of-the-box we do not have a specific tool to report all of the OU permissions. You have to click each OU and view the security tab one-by-one, and we all know that is entirely impractical. Today’s post contains a free script download to generate a report of this vital information.
I would advise all Active Directory shops to review this report on a quarterly basis to make sure there are no surprise administrators lurking in your domain.
Hi folks. It's your friendly, neighborhood PFE again. In order to avoid the long lines to buy a treadmill the first week of January I thought I would save you some time and give you an easier New Years Resolution… Learn PowerShell.
For years many of us have relied on trusty command line utilities like PING, IPCONFIG, and REPADMIN. Some of us are still hanging on to those instead of embracing the brave new world of PowerShell.
In an effort to assist with the transition and to introduce some of the cool new cmdlets in PowerShell v3 I have created a free reference guide showing how the old meets the new. For example, instead of PING try the PowerShell cmdlet Test-Connection, instead of NSLOOKUP use Resolve-DNSName, instead of GPUPDATE use Invoke-GPUpdate.
The guide attached at the bottom of this blog post contains four packed pages of PowerShell pleasure for your perusing.
Have you ever needed to copy data between attributes in Active Directory? Maybe you need to copy an ExtensionAttribute value into a different ExtensionAttribute. Maybe you need to copy email, UPN, or SIP addresses. You may even want to move the EmployeeNumber value into the EmployeeID attribute instead. What if you needed to create a new Description based on a combination from other attributes?
Today I posted over on the Hey Scripting Guy blog with a quick tip to unlock Active Directory user accounts. Check it out:
Active Directory Account Unlock Shortcut for Help Desk
Back in May I released a post on the Hey Scripting Guy blog showing how to create a shortcut to unlock a user account with a PowerShell desktop shortcut. That post was very popular, and the comments evolved into another shortcut to reset passwords. Due to the popularity and utility of the idea I decided it deserved its own blog post. I’ve also learned a little more about the Set-ADAccountPassword cmdlet to simplify my previous code.
You know the drill. It’s Monday morning. Last Friday 47 users decided it was a good idea to change their password before the weekend. It’s Monday. They forgot, just like I would. Personally I never change my password on a Friday for this reason. I need a couple days to use it before the weekend.
What could make this worse? Holiday weekends… like US Thanksgiving. (grin) Now it’s been at least five days since I reset that password. There’s no chance I’ll remember it unless it’s written down on that sticky note under the mouse pad.
Now all 47 of those users must call the helpdesk first thing Monday before they can begin another week of productivity for the company. The self-service password project has not gotten enough budget or resources for implementation, and until it does every Monday morning is going to look very familiar. That’s where we come in with PowerShell.
This post is the fifth in the "SID Walker, Texas Ranger" series on SID history remediation with PowerShell. Today we're wrapping up with a handy summary of each post in the series. We will also take the function library we've been using and upgrade it to a PowerShell module. Then we'll walk through the entire SID history remediation process using the provided cmdlets in this module.
Get-GPOReport from the Group Policy PowerShell module can report all GPOs, but it can be a bit overwhelming. What if you want a simple spreadsheet listing of the same information? This script gives you a thorough CSV report of all GPO links, where enforced, where blocked, and more. If you support group policy, then this script is guaranteed to please.
Many companies have upgraded bandwidth without updating AD replication topology. Today's post features PowerShell one-liners to report on your AD site links and then tweak them for high performance.
My last post on getting started with Active Directory was so popular that I thought I would do one for getting started with Group Policy. Once again this link list will satisfy everyone from beginner to advanced. I know there are many other third party resources and books, but I want to surface some Microsoft white papers and articles that may not always be obvious. Enjoy!
Do you remember SIDWALK? This resource kit utility was written back in the NT 4.0 days to assist with domain migrations. It used a mapping file to rewrite old SIDs with new SIDs across ACLs. That utility is a teenager now. It's time we rewrite it... in PowerShell. In part one of this series we will learn how to parse SIDs out of SDDL that we receive from Get-ACL.
Today we have several domain controller operating systems that support the Active Directory module cmdlets. Clients on Windows 7 and 8 can install the Remote Server Administration Tools (RSAT) to script with the Active Directory module against these DCs.
With all of these versions now the first question that comes to mind is compatibility.
The Windows Server 2012 Active Directory PowerShell module has some handy new cmdlets. However, many IT shops struggle to stay current on the latest operating system releases due to a variety of issues (budget, resources, compatibility, etc.). They desperately want to use the latest features, but their deployment standards have not caught up yet. This leaves them with workable, but sometimes inefficient, tools from previous releases.
Today’s article will show you how to use the latest Windows Server PowerShell modules in a legacy Windows 7 environment. As a bonus we’ll explore compatibility of the AD cmdlets across the different operating systems.
Many of us have inherited SID history in our forest from previous mergers and acquisitions. In today's blog entry on SID history remediation we will unearth a Rosetta Stone, the key to decyphering the identity of civilizations past. This script will export a list of domain names and domain SIDs across your forest and all of its trusts. This domain SID list is the key to understanding from where the SID history of our users originated.
After speaking about SID history and token size at PowerShell Saturday last month an attendee approached me with a common concern. I was so excited to code the answer that I did it in the airport on the way home.
Joe User has been with the company for 23 years and has accumulated more group memberships than the entire desktop support team. Joe has rotated through five different departments during his career and managed to survive all of the layoffs. As a result he has access to every share in the company. Even worse his access token is so big that it won’t fit through the door.
We would love to clean up his group memberships, but we have no way of knowing when he was added to all these groups. If we could see the dates he joined those groups it would give us a clue about removing just the older group memberships. Without this information his token will continue to bloat.
Time for some AD PowerShell v3 goodness!
PS - I'm also going to give you a handy chart showing PowerShell equivalents for REPADMIN in AD PowerShell v3.
Now most people don't plan to spend their entire career on the help desk. It is a starting point for bigger things in IT. PowerShell can be your career LAUNCH PAD. Seriously. PowerShell skills will differentiate you from your peers and slingshot you to the front of the pack.
What if you could get all of the data you needed to close a ticket in seconds?
TIP: Anyone who wants to write scripts for Active Directory will eventually run into the famous userAccountControl attribute. The good news is that in PowerShell we have two cmdlets that make this easy: Set-ADAccountControl and Search-ADAccount.
The very same day I posted the SID history script I found a shorter way to do it. I'm calling a "do over". When you display a list of object properties sometimes one of those properties contains multiple entries in an array or object collection. In order to expand those multiple values into single rows we pipe the output to Select-Object -ExpandProperty.
Do you schedule DCPROMO activities for the weekend? After hours? Middle of the night? I remember those days. Often it was hard to get in the right frame of mind to think through all of the exact procedural steps during those late night change controls.
Today’s post will show you how to easily promote and demote a Windows Server 2012 domain controller remotely with a script. You don’t even need to logon to the target server.
Generally change controls have three plans:
You have all three of these scripts for DCPROMO in today’s post.
Today's post will help you clean up site link descriptions and give you some nice reporting capability. Some folks like to set their site link description field to list each of the member sites in the link. If that is you, then you'll love this script. Today's script enumerates all of the member sites in a site link and then concatenates their names into the description of the site link. Also, it will make a note in the description for any site links that have change notification enabled. Now that's handy! There is also a bonus site reporting script in the download attached.
Today I am releasing updated functionality in the PowerShell Active Directory SID History module. New features include: inventory SID history in share permissions, new Access database reporting template, bug fixes, and more!