Fun with the AD Administrative Center

re: Fun with the AD Administrative Center

alt-92 — Fri, 08 Jul 2011 14:39:14 GMT

Another Feat.Req. I've seen mentioned in a couple of places is being able to specify a DC on commandline (dsac.exe /server=dc-at-nearby-site-but-not-default).. and if it would be possible to leave out the default domain entry so you can just specify the subOU for delegation purposes and only have that visible instead.

re: Fun with the AD Administrative Center

NedPyle [MSFT] — Tue, 05 Jul 2011 14:32:39 GMT

Lots of great feedback here folks - the developers of these tools are now monitoring this thread so keep them coming. :)

Phatmike128 - to your last question, it's a known issue: blogs.technet.com/.../friday-mail-sack-scooter-edition.aspx

But no customer has come forward with a premier support case to ask for a fix so there it sits (as ADUC is pretty much... dead).

re: Fun with the AD Administrative Center

phatmike128 — Mon, 04 Jul 2011 05:10:34 GMT

Hi Ned,

If possible it would be great to have more (all?) attributes and columns available for data filtering, and the ability to export filtered data to a text or CSV file.

I know it's easy enough to do with a script but sometimes it would be just a bit quicker to have access to these through the GUI, since some of those filtering options are already there.

Another thing some of our admins miss with the 2008 ADUC is losing the Exchange related tabs that were available with the 2003 ADUC console and Exchange 2003 installed. Attributes such as mailbox details and proxy addresses were helpful to have rather than having to open the Exchange Management Console. Is that something that may be possible to integrate? - I'm sure the product teams explicitly seperated them for a reason...

When using "Find" in 2008 ADUC you cannot see the Attribute Editor tab, only when drilling down into OUs manually. Is this a bug or intentional? I now use ADAC for that reason, to search and view the Attribute Editor tab.

re: Fun with the AD Administrative Center

coderaven — Tue, 21 Jun 2011 01:18:22 GMT

@gallwapa: For DHCP mgmt, you may want to look at this -- blogs.technet.com/.../use-the-powershell-dhcp-module-to-simplify-dhcp-management.aspx. I also know that on the Script Repository, there are modules that basically control NETSH and do full management. For all I know you may be modifying these solutions for a better one. Either way, hope this helps a little.

Allan

re: Fun with the AD Administrative Center

gallwapa — Sun, 19 Jun 2011 05:29:17 GMT

As long as its feature request time...

DHCP / DNS server management through cmdlets. My management scripts are ginormous and complex

re: Fun with the AD Administrative Center

coderaven — Sat, 18 Jun 2011 06:05:06 GMT

Y'all are correct that the -Filter takes a little getting use to and it can get sticky depending on what you are doing. I do try to use the -Filter as much as I can, it is consistent with other PowerShell cmdlets. If you don't want to mess with that though or are in a hurry, revert to -LDAPFilter. -LDAPFilter is golden, simple multi-filter, same ole LDAP filtering and you can use it in conjunction with ADAC LDAP Filtering searches. Just do an advanced search -> convert to LDAP -> Copy -> Paste -> ... | foreach-Object { Set-ADUser -Identity $_.DistinguishedName -doSomeThingFancy}

@gallwapa: yea, the ISE will eat your lunch. Always keep a console open unless your getting funky with it or creating/updating your functions then open ISE

@sgrinker: thanks for correcting on the EXE name you are correct. After reading such a great article and seeing ADAC about 25 times -- ya know.

@ned: Request -- Not really "needed" but a Transcript of work (Start-Transcript; End-Transcript) would be nice to have.

I envision it would work something like View -> Transcript and you would have a Window of all PowerShell equivalent commands the ADAC has sent to the web service. This could be integrated pretty easy with a roll forward and roll back ability. I think it would be very nice to have it when doing requested changes that had to be approved in some way or project work so that you can paste the commands in documentation allow the work to be recreated or rolled back even after the fact if something goes wrong.

This same functionality could work with other management tools like SCCM/SCOM/SCVMM/Exchange etc. Older tools don't have command equivalents so it was not really possible or considered.

Allan

re: Fun with the AD Administrative Center

gallwapa — Fri, 17 Jun 2011 20:05:53 GMT

@sgrinker - thanks for that. I guess I glossed over that. I had been checking -ne "" -and length -gt 0

re: Fun with the AD Administrative Center

sgrinker — Fri, 17 Jun 2011 18:14:33 GMT

@gallwapa - You can get the same results as "-eq $Null" with the following syntax, granted I more than agree this isn't as intuitive!

Get-ADuser -Filter "EmployeeID -notlike '*'" -properties EmployeeID

The sytax (and many others) are within...

help about_activedirectory_filter

Although I do agree that more intuitive PowerShell-esque filtering would be a nice to have.

re: Fun with the AD Administrative Center

gallwapa — Fri, 17 Jun 2011 17:56:27 GMT

Example of error:

PS C:\Windows\system32> Get-ADuser -Filter "EmployeeID -eq '$null'" -properties EmployeeID

Get-ADUser : The search filter cannot be recognized

At line:1 char:11

+ Get-ADuser <<<< -Filter "EmployeeID -eq '$null'" -properties EmployeeID

+ CategoryInfo : NotSpecified: (:) [Get-ADUser], ADException

+ FullyQualifiedErrorId : The search filter cannot be recognized,Microsoft.ActiveDirectory.Management.Commands.Get

ADUser

re: Fun with the AD Administrative Center

gallwapa — Fri, 17 Jun 2011 17:54:18 GMT

AD Powershell: Ability to filter where attribute -eq $null . QADCmdlets can do this

ADAC: thumbnailPhoto view, update, edit. Moreover (and this is the reason we want to extend ADAC) the ability to add arbitrary UI elements for properties in the schema (in our case, we have a text field that only IT staff can edit/view)