Friday Mail Sack – Very Late Edition

re: Friday Mail Sack – Very Late Edition

RickSheikh — Wed, 03 Mar 2010 15:13:26 GMT

A "back door" way to give you an idea would be to find out the 'create time' for the domain and then see how many users, groups, computers you can find with a create time that was at *about* the same time. It's unlikely someone is going to create a boat load of objects at the time the domain is created so if you have a bunch of stuff created at about that time, it is likely an upgrade. A simple two one-liners approach would be to use PowerShell (with Quest cmdlets)or you may use ADWS as well.

Get-QADobject "dc=notsogood,dc=domain" | select creationdate

(For instance if the result were ->) 6/14/2008 2:25:03 AM

Then do this, to find out how many users were created that day, and so forth and so on for other objects.

Get-QADUser -sl 0 -createdon (get-date).adddays(-416) | measure-object

re: Friday Mail Sack – Very Late Edition

NedPyle [MSFT] — Mon, 01 Mar 2010 15:14:04 GMT

Yes, via auditing. What OS are your DC's?

re: Friday Mail Sack – Very Late Edition

orcus — Mon, 01 Mar 2010 15:08:11 GMT

Is there a way I can find out who created an object in AD?

re: Friday Mail Sack – Very Late Edition

Brian Desmond -MVP- — Sat, 27 Feb 2010 21:35:30 GMT

The presence of the replicator group is another potential indicator

re: Friday Mail Sack – Very Late Edition

Yusuf Dikmenoglu — Sat, 27 Feb 2010 18:12:19 GMT

Hello Ned,

it would be an honor for me, if you would publish my name on the "one-and-only" AD-Blog. ;-)

Another guaranteed option is, if the NetBIOS domain name have a point in the Name. Example: "Company.com". Then the domain was 100% upgraded from a NT- to a AD-Domain.

Best Regards

Yusuf Dikmenoglu