PowerShellTip: Get Get AD Domain Controllers operating system

Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem

PowerShellTip: Get AD Global Catalog status from all DC

 

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers | %{"$($_.Name) : $($_.isglobalcatalog())"}

PowerShell Script: Get Inactive AD Users

Simple script to show inactive Active Directory users. Export data to CSV.
Based on Last Logon Time Stamp.

Link for download:
Get-InactiveADUsers-CSV.ps1

Happy Birthday, Active Directory!

 

 

Introduction of Active Directory to the world was part of the release of Windows 2000 Server on February 17, 2000.

Happy Birthday 20th, Active Directory!

How to view BitLocker Recovery Key in PowerShell

Installtion

PS> Install-Module -Name ActiveDirectory.Toolbox

Usage

PS> Import-Module ActiveDirectory.Toolbox

Commands

Get-ADComputerBitLockerInfo [[-ComputerName] <string[]>]

or

Get-ADComputerBitLocker [[-ComputerName] <string[]>]

Link for download

PowerShell Gallery | ActiveDirectory.Toolbox

Note:
#Requires -Modules ActiveDirectory

How to view LAPS password in PowerShell

Installtion

PS> Install-Module -Name ActiveDirectory.Toolbox

Usage

PS> Import-Module ActiveDirectory.Toolbox

Commands

Get-ADComputerLAPSInfo [[-ComputerName] <string[]>]

or

Get-ADComputerLAPS [[-ComputerName] <string[]>]

Link for download

PowerShell Gallery | ActiveDirectory.Toolbox

Note:

#Requires -Modules ActiveDirectory

PowerShellTip: Move AD Group to another OU

 

Import-module ActiveDirectory
Get-ADGroup MyGroup | Move-ADObject -identity {$_.objectguid} -TargetPath 'ou=GroupsToDelete,dc=MyCompany,dc=com'

How many users are in AD group?

Some times I need to check how many users are in a particular AD group, unfortunately ADUC doesn't show this info.
So I using Powershell to check this group info

Import-Module ActiveDirectory
$ADGroup = Get-ADGroupMember "Domain Users" -recursive
$ADGroup.Count

PowerShell Script: Get AD Domain and Forest functional level

Simple script to show Active Directory domain and forest functional level, FSMO roles, all sites in the forest, Global Catalog servers.

Link for download
.\Get-ADInfo.ps1

Example of usage:

[PS].\Get-ADInfo.ps1

PowerShell Script: Remove AD Groups for Users in specific OU

This small script remove all Active Directory (AD) groups for users in specific Organizational Unit (OU).
Except group "Domain Users"

 

Example of usage:

[PS].\Remove-ADGroups-for-Users-in-OU.ps1 -OU "OU=Users,OU=Disabled Accounts,DC=myDomain,DC=local" -Confirm:$False

 

Script can be useful for OU with disabled users accounts.

 

Link for download
Remove-ADGroups-for-Users-in-OU.ps1

PowerShell Script: Get LAPS Password Information from Active Directory

A small script for export Computers LAPS Password information from Active Directory to csv file.

Script generates a CSV file with computer names and LAPS Passwords.
    ComputerName;OperatingSystem;Password;PasswordExpTime;DistinguishedName

Requirement of the script:
   - Active Directory PowerShell Module
   - Needed rights to view AD LAPS Attributes: ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
  
Example of usage:

[PS].\Get-ADComputers-LAPS-Password.ps1
[PS].\Get-ADComputers-LAPS-Password.ps1 -OU "OU=Computers,OU=IT Department,DC=myDomain,DC=com"

Links for download
PowerShell Gallery | Get-ADComputers-LAPS-Password
GitHub | Get-ADComputers-LAPS-Password.ps1
Get-ADComputers-LAPS-Password.zip

PowerShell Script: Get BitLocker Recovery Information from Active Directory

A small script for export Computers BitLocker Recovery Information from Active Directory to csv file.

This script generates a CSV file with computer names and BitLocker Recovery Keys:
    ComputerName;OperatingSystem;Date;Time;GMT;PasswordID;RecoveryPassword;DistinguishedName

Requirement of the script:
    - Active Directory PowerShell Module
    - Needed rights to view AD BitLocker Recovery Info

Example of usage:

[PS].\Get-ADComputers-BitLockerInfo.ps1
[PS].\Get-ADComputers-BitLockerInfo.ps1 -OU "OU=Computers,OU=IT Department,DC=myDomain,DC=com"

Links for download

PowerShell Gallery | Get-ADComputers-BitLockerInfo

GitHub | Get-ADComputers-BitLockerInfo.ps1

Get-ADComputers-BitLockerInfo.zip

How to delegate right to unlock locked Active Directory (AD) user accounts?

To delegate the right to unlock user accounts on the OU or domain level in ADUC, you can use the AD delegation wizard.

 

You must perform the following steps.

 

1. Open “Active Directory Users and Computers”

 

Зміними стандартний Organizational Unit (OU) для нових комп'ютерів в Active Directory

Нові комп'ютери в Active Directory за замовчуванням створюються в контейнері (OU) Computers (CN=Computers,DC=myDomain,DC=com)

 

Щоб це змінити - зайдіть на контролер домену як адміністратора домену (Domain Admin)
Виконайте команду:

 

    ReDirCmp Container-DN

 

де Container-DN - це значення адтрибуту DistinguishedName контейнера (OU), в якому за замовчуванням будуть додаватись нові комп'ютери.

Наприклад:

 

    redircmp "OU=New Computers, DC=myDomain, DC=com"

 

 

Щоб повернутись до типових налаштувань:

 

    redirusr cn=Computers, DC = myDomain, dc=com

 

 

Примітка.
Функціональний рівень домену повинен бути не нижче Windows Server 2003

 

 

 

Зміними стандартний Organizational Unit (OU) для нових користувачів в Active Directory

Нові користувачі в Active Directory за замовчуванням створюються в контейнері (OU) Users (CN=Users,DC=myDomain,DC=com)

 

Щоб це змінити - зайдіть на контролер домену як адміністратора домену (Domain Admin)
Виконайте команду:

 

   ReDirUsr Container-DN

 

де Container-DN - це значення адтрибуту DistinguishedName контейнера (OU), в якому за замовчуванням будуть створюватись нові користувачі.

 

Наприклад:

 

    redirusr "OU=New Users, DC=myDomain, DC=com"

 

 

Щоб повернутись до типових налаштувань - виконайте команду:

 

    redirusr cn=Users, dc = myDomain, dc=com

 

 

 

Примітка.
Функціональний рівень домену повинен бути не нижче Windows Server 2003

 

 

Get Active Directory Schema Version from PowerShell

To view Active Directory Schema Version from PowerShell use command

 

[PS]Get-ADObject (Get-ADRootDSE).schemaNamingContext -properties objectVersion

 

 

 

 

View and Change Active Directory MaxPageSize

 

MaxPageSize - This value controls the maximum number of objects that are returned in a single search result, independent of how large each returned object is. To perform a search where the result might exceed this number of objects, the client must specify the paged search control. This is to group the returned results in groups that are no larger than the MaxPageSize value. To summarize, MaxPageSize controls the number of objects that are returned in a single search result.
Default value: 1,000

 

Some LDAP clients can only receive the first 1,000 results when they make an LDAP question to Active Directory, when more results be that requite the query scope. If there are 2,000 results to be returned, the client will receive the “Size Limit Exceeded” error when the paging is not enabled or not present.

 

How we can view or change MaxPageSize value?

 

Tips of the day #1706

Tip of the day #1706-1

Use Windows PowerShell to change the UPN suffix for all users
Change all company.local suffixes to company.com

Import-Module ActiveDirectory

Example 1.
$LocalUsers = Get-ADUser -Filter {UserPrincipalName -like '*company.local'} -Properties userPrincipalName -ResultSetSize $null

$LocalUsers | foreach {$newUpn = $_.UserPrincipalName.Replace("company.local","company.com"); $_ | Set-ADUser -UserPrincipalName $newUpn}

Update AD Group ManagedBy Attribute – PowerShell Script

 

Example 1.

Input File
Groups-170316-1.csv - The input file contains group names.

Script

Import-module ActiveDirectory

$User = "User-170316"

Import-CSV "C:\Scripts\Groups-170316-1.csv" | % {

$Group = $_.GroupName

Get-ADGroup $Group | Set-ADGroup -ManagedBy $User
}

Notes:
$User = <ADUser>


Example 2.

Input File
Groups-170316-2.csv - The input file contains group and user names.

Convert Username to SID and Vice Versa

In Windows environment, each domain and local user, a group or other security objects are assigned a unique identifier — Security Identifier or SID.

SID used to control access to different resources: network shares, registry keys, file system objects, etc.

Now we will see some simple ways to get SID by username and the reverse.