Showing posts with label AD. Show all posts

8/02/2013

Powershell - Report on Group Policy Objects


#########################################################################################################################
#
#   GPO-REPORT.PS1
#
#   Create a report of the status of all WSUS GPO's
#

import-module grouppolicy

$today = get-date
$outfile = "gpostatus.html"
$key = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\au"

$days = @{"0" = "Every Day"; "1" = "Every Sunday"; "2" = "Every Monday"; "3" = "Every Tuesday"; "4" = "Every Wednesday"; "5" = "Every Thursday"; "6" = "Every Friday"; "7" = "Every Saturday"}

$gpobjs = get-gpo -all -domain usa.DOMAIN.com | where {$_.DisplayName -like "Software Update*"}

"<HTML>" | out-file $outfile
"<HEAD>" | out-file $outfile -append
"<TITLE></TITLE>" | out-file $outfile -append
"</HEAD>" | out-file $outfile -append
'<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#FF0000" VLINK="#800000" ALINK="#FF00FF" BACKGROUND="?">' | out-file $outfile -append
'<H2>WSUS Group Policy Status</H2>' | out-file $outfile -append
'<H4>' + $today + '</H4><table bordercolor=#000000;  border=2px; cellspacing=0;>' | out-file $outfile -append
'<tr><td ><b><font face="monospace" size="3"> Policy </font></td>' | out-file $outfile -append
'<td ><b><font face="monospace" size="3"> Modified </font></td>' | out-file $outfile -append
'<td ><b><font face="monospace" size="3"> Enabled/Disabled </font></td>' | out-file $outfile -append
'<td ><b><font face="monospace" size="3"> Configuration </font></td>' | out-file $outfile -append
'<td ><b><font face="monospace" size="3"> Install Day </font></td>' | out-file $outfile -append
'<td ><b><font face="monospace" size="3"> Install Hour </font></td>' | out-file $outfile -append
'</tr>' | out-file $outfile -append

$gpobjs | foreach-object {
    $name = $_.DisplayName
 
write-host $name
 
    $modified = $_.ModificationTime
    $enabledvalue = get-gpregistryvalue -name $name -key $key -valuename noautoupdate
    if ($enabledvalue.value -eq "0") {
        $enabled = "enabled"
        }
    else {
        $enabled = "disabled"
        }
    $optionvalue = get-gpregistryvalue -name $name -key $key -valuename auoptions

    if ($optionvalue.value -eq "2") {
        $option = "2-Notify Only"
        }
    elseif ($optionvalue.value -eq "3") {
        $option = "3-Download & Notify"
        }
    elseif ($optionvalue.value -eq "4") {
        $option = "4-Download & Install"
        }
    else {
        $option = $optionvalue.value
        }

    $dayvalue = (get-gpregistryvalue -name $name -key $key -valuename scheduledinstallday).value | out-string
    $dayvalue = $dayvalue -replace "\s+", ""
    $day = $days[$dayvalue]
    $hour = (get-gpregistryvalue -name $name -key $key -valuename scheduledinstalltime).value
    
    if ($enabled -eq "disabled") {
    $option = " "
    $day = " "
    $hour = " "
    }
    '<tr><td ><font face="monospace" size="2">' + $name + '</font></td>' | out-file $outfile -append
    '<td ><font face="monospace" size="2">' + $modified + '</font></td>'  | out-file $outfile -append
    '<td ><font face="monospace" size="2">' + $enabled + '</font></td>'  | out-file $outfile -append
    '<td ><font face="monospace" size="2">' + $option + '</font></td>'  | out-file $outfile -append
    '<td ><font face="monospace" size="2">' + $day + '</font></td>'  | out-file $outfile -append
    '<td ><font face="monospace" size="2">' + $hour + '</font></td></tr>'  | out-file $outfile -append

}#foreach object

"</TABLE></BODY></HTML>" | out-file $outfile -append

7/19/2013

Powershell - Copy Files to all servers

Using Powershell to copy files to every server


##################################################################################
#
# Copy files to all servers with AD accounts that respond to PING
#
#   Requires admin permission on every server
#
##################################################################################

$file1="Windows6.1-KB2520155-x64.msu"
$file2="Windows6.1-KB2520155-x86.msu"
$ServerList = ".\SUCCESS.TXT"
$ErrorList = ".\ERRORS.TXT"
$ListFile = ".\SERVERS.TXT"
New-Item $ListFile -Type file -Force >$nul
New-Item $ServerList -Type file -Force >$nul
New-Item $ErrorList -Type file -Force >$nul
$List = ""

"Execution in progress..."

# Create $list of AD machine accounts for Windows Servers
$strCategory = "computer"
$strOS = "Windows*Server*"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOS")
$colProplist = "dnshostname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults) {
    $objComputer = $objResult.Properties;
    $Server = $objComputer.dnshostname
    $Server = $Server -replace "\.usa\.domain\.com", ""
    $Server = $Server -replace "\s{2,}", ""
    if ($Server) {#skip null
        $Server
        if (Test-Connection -ComputerName $Server -quiet -count 1) {#PING OK
            "    Responds to PING"
            $Server | out-file -encoding ASCII -filepath $ListFile -append
            #Copy Files
            copy-item c:\dns-msu -destination ("\\\\"+$Server+"\\C$") -recurse

            #Check File1
            if (-not(Test-path ("\\\\"+$Server+"\\C$\\dns-msu\\$file1"))) {
                "        FAIL: $file1"
                write-output "$Server - MISSING $file1" | out-file -encoding ASCII -filepath $ErrorList -append
            }
            else {
                "        SUCCESS:  $file1"
                write-output "$Server - OK $file1" | out-file -encoding ASCII -filepath $ServerList -append    
            }

            #Check File2
            if (-not(Test-path ("\\\\"+$Server+"\\C$\\dns-msu\\$file2"))) {
                "        FAIL: $file2"
                write-output "$Server - MISSING $file2" | out-file -encoding ASCII -filepath $ErrorList -append
            }
            else {
                "        SUCCESS:  $file2"
                write-output "$Server - OK $file2" | out-file -encoding ASCII -filepath $ServerList -append    
            }
        }#end if PING OK
        else {#PING FAIL
            "    Does not respond to PING"
            write-output "$Server - PING Failure" | out-file -encoding ASCII -filepath $ErrorList -append
        }#end else PING FAIL
    }#if null
}#foreach

5/21/2012

How to fix a messed up domain controller

Just get rid of it!

Disconnect the DC from the network
Run dcpromo /forceremoval
From 2003, use NTDSUTIL to do a "metadata cleanup" to clean the DC out of your AD. (See below) If you have at least one Windows Server 2008 DC, then open Active Directory Users and Computers from a 2008 DC, find the bad DC, right-click and delete.

Metadata Cleanup using NTDSUTIL
MS Article 216498 explains how to forcibly remove a domain controller account from AD using NTDSUTIL.
http://support.microsoft.com/kb/216498

Time to Check Sysvol
Sysvol is a share you can find on every domain controller, a share that contains files needed by DCs -- the big ones are the file components of group policy objects (GPOs), pieces called "group policy templates" or GPTs, as well as login scripts. Sysvol is a neat, built-in implementation of DFS (Distributed File Services) that is multi-master, meaning that if you have four DCs named DC1, DC2, DC3 and DC4, then you can drop a file into any one of those four Sysvol folders, and eventually DFS will ensure that there's a copy of that file in each of the other three Sysvols. The fact that you can introduce a new file into the family of Sysvols is why it's said to be "multi-master." On 2003 SP3 and later, there's a command that lets you force replication between a source DC (DC3, in this example) and a destination DC (DC2, in this example) that looks like this:

ntfrsutl.exe forcerepl DC2 /r "Domain System Volume (SYSVOL share)" /p DC3

Check SYSVOL before upgrading
Go to a DC. In its Sysvol, create a file, such as [dcname].txt. After you have created a small text file on each DC whose name reflects the DC that you created it on. Wait a while and go to each DC and look in its Sysvol... there should be a file for each domain controller. If, for example, DC4's dc4.txt shows up nowhere, then DC4 probably has the problem. To fix it, run DCPROMO to demote it and, if the rest of the network doesn't see that you've demoted it, remove the DC's account from the Domain Controllers OU and remove its metadata. Once it is successfully removed, test again by creating another unique file in each DC's Sysvol and be sure everything is cool.

Thanks to:
http://www.minasi.com/newsletters/nws1205.htm

5/25/2011

Last Logon

Fixed this to output into something I can open in Excel.

# PSLastLogon.ps1
# PowerShell script to determine when each user in the domain last
# logged on.
#

#delete output file if it exists
if ( test-path lastlogon.csv ) { remove-item lastlogon.csv }

Trap {"Error: $_"; Break;}
 
$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$Domain = [ADSI]"LDAP://$D"
$Searcher = New-Object System.DirectoryServices.DirectorySearcher
$Searcher.PageSize = 4000
$Searcher.SearchScope = "subtree"
 
$Searcher.Filter = "(&(objectCategory=person)(objectClass=user))"
$Searcher.PropertiesToLoad.Add("distinguishedName") > $Null
$Searcher.PropertiesToLoad.Add("lastLogon") > $Null
 
# Create hash table of users and their last logon dates.
$arrUsers = @{}
 
# Enumerate all Domain Controllers.
ForEach ($DC In $D.DomainControllers)
{
    $Server = $DC.Name
    $Test = $Server -replace "\..*$",""
    $Test = $Test.ToUpper()
 #   $Test
  if (!($Test.startswith("SECDC02"))) {
    $Searcher.SearchRoot = "LDAP://$Server/" + $Domain.distinguishedName
    $Results = $Searcher.FindAll()
    ForEach ($Result In $Results)
    {
        $DN = $Result.Properties.Item("distinguishedName")
        $LL = $Result.Properties.Item("lastLogon")
        If ($LL.Count -eq 0)
        {
           $Last = [DateTime]0
        }
        Else
        {
            $Last = [DateTime]$LL.Item(0)
        }
        If ($Last -eq 0)
        {
            $LastLogon = $Last.AddYears(1600)
        }
        Else
        {
            $LastLogon = $Last.AddYears(1600).ToLocalTime()
        }
        If ($arrUsers.ContainsKey("$DN"))
        {
            If ($LastLogon -gt $arrUsers["$DN"])
            {
                $arrUsers["$DN"] = $LastLogon
            }
        }
       Else
        {
            $arrUsers.Add("$DN", $LastLogon)
        }
    }#foreach
  }#if
}#foreach
 
# Output latest last logon date for each user.
$Users = $arrUsers.Keys
ForEach ($DN In $Users)
{
    $Date = $arrUsers["$DN"]
    $output = '"'+$DN+'",'+$Date
    $output | out-file -encoding ASCII  lastlogon.csv -append
}

Last Logon Date

# PSLastLogon.ps1
# PowerShell script to determine when each user in the domain last
# logged on.
#
# ----------------------------------------------------------------------
# Copyright (c) 2011 Richard L. Mueller
# Hilltop Lab web site - http://www.rlmueller.net
#
# This program queries every Domain Controller in the domain to find the
# largest (latest) value of the lastLogon attribute for each user. The
# last logon dates for each user are converted into local time. The
# times are adjusted for daylight savings time, as presently configured.
 
Trap {"Error: $_"; Break;}
 
$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$Domain = [ADSI]"LDAP://$D"
$Searcher = New-Object System.DirectoryServices.DirectorySearcher
$Searcher.PageSize = 200
$Searcher.SearchScope = "subtree"
 
$Searcher.Filter = "(&(objectCategory=person)(objectClass=user))"
$Searcher.PropertiesToLoad.Add("distinguishedName") > $Null
$Searcher.PropertiesToLoad.Add("lastLogon") > $Null
 
# Create hash table of users and their last logon dates.
$arrUsers = @{}
 
# Enumerate all Domain Controllers.
ForEach ($DC In $D.DomainControllers)
{
    $Server = $DC.Name
    $Test = $Server -replace "\..*$",""
    $Test = $Test.ToUpper()
    $Test
  if (!($Test.startswith("SECDC02"))) {
    $Searcher.SearchRoot = "LDAP://$Server/" + $Domain.distinguishedName
    $Results = $Searcher.FindAll()
    ForEach ($Result In $Results)
    {
        $DN = $Result.Properties.Item("distinguishedName")
        $LL = $Result.Properties.Item("lastLogon")
        If ($LL.Count -eq 0)
        {
           $Last = [DateTime]0
        }
        Else
        {
            $Last = [DateTime]$LL.Item(0)
        }
        If ($Last -eq 0)
        {
            $LastLogon = $Last.AddYears(1600)
        }
        Else
        {
            $LastLogon = $Last.AddYears(1600).ToLocalTime()
        }
        If ($arrUsers.ContainsKey("$DN"))
        {
            If ($LastLogon -gt $arrUsers["$DN"])
            {
                $arrUsers["$DN"] = $LastLogon
            }
        }
       Else
        {
            $arrUsers.Add("$DN", $LastLogon)
        }
    }#foreach
  }#if
}#foreach
 
# Output latest last logon date for each user.
$Users = $arrUsers.Keys
ForEach ($DN In $Users)
{
    $Date = $arrUsers["$DN"]
    "$DN;$Date"
}

3/27/2011

Group Policy Notes

"Stream of conciousness" notes on Group Policies

FWIW

- either the computer settings or the user settings get applied, not both -- as one might expect.
- e.g. logging on machine in TRAINING OU - only the computer settings are applied (since user object is in another OU.)
- when appropriate - disable user or computer portion -- whichever doesn't apply.
- GP can link to domain, site, OU, local
- cannot be applied to container (e.g. builtin, computers, users)
- avoid using site GPO's.
- order of application: Local, Site, Domain, OU
- GPO components: GP Container, GP Template
- Advertise application = allows install from add/remote programs. (Publish = do the install automatically.)
-start-run dssite.msc, domain.msc, dnsmgmt.msc, winsmgmt.msc
- sysvol\[domain]\Policies (templates) - (must match) AD System\Policies container
- GUID's are universal.
- Other paths to GPT - group policy templates - both of the below point to the exact same location

c:\windows\sysvol\domain\policies

c:\windows\sysvol\sysvol\[domain]\policies
- When working directly with GPT's always use: c:\windows\sysvol\domain\policies
- GPC replicates with AD. GPT's replicate via RPC with FRS or DFSR (in 2008AD functional level)
- In 2003, ADSIEDIT shows properties and replication status of policies.
- ADM folder on sysvol is not necessary, access to them from somewhere is needed when administering.
- a copy of this folder is made for every policy - this is the vast majority of the space consumed for policies on sysvol
- versions - bit 5 from right is incremented when user policy is changed, bit 1 is incremented when computer policy is changed.
- do NOT disable default domain policy and make your own domain policy.

- If you copy the default domain policy and disable the default domain policy and work from the copy "works" but some software looks for the GUID for adjusting.
- just leave the default domain policy blank and create another policy.
- SYSVOL replication can use DFSR in 2008 functional level domain. Requires running DFSRMIG.EXE

- Local policies are saved in: c:\windows\system32\GroupPolicy
- gPLink points to the GPC, GPC points to GPT
- GPC stores version number in "VersionNumber" attribute of the GPO.
- GPT stores version number in GPT.INI file
- utility named GPOTOOL can help identify issues or problems.
- refresh interval
- DC's - 5 minutes
- Others - 90-120 minutes
- run GPRESULT /V - shows what happened last time policy was applied - uses RSOP which requires read permission for domain.

- ADPREP /DOMAINPREP /GPPREP -> sets permissions.
- Restore Domain Policies to default and resets ACLs - caution! Find KB article for caveats.
- DCGPOFIX.EXE - Win2003 & later
- RECREATEDEFPOL.EXE - Win2000
- Templates

- ADM - pre-Vista - language specific - required for each policy
- ADMX - based on XML - Vista & later
- ADML files - associated with an ADMX file - language specific portion of template.
- c:\windows\PolicyDefinitions on Vista and later machines.

- GPMC - Group Policy Management Console
- v1 - Windows XP, 2003
- v2 - Vista and later
- administer from one or the other not both.
- Go into GPMC and backup GPO's!!!!!!!!!!!!!!!!!!!!!!!!!!!
- custom ADM files must be imported.

- Using a Central Store of ADMX files: KB929841

AD Attributes Reference

ADSI & LDAP in scripts is very powerful, but there are so many little details to get right. There are often ways to make a script to see all your options, but sometimes it's good to be able to just look up what exactly attribute names are or see a list of them all.
Here on MSDN

2/25/2009

Fix Time Sync Problems on Windows Domain

Fix Time Sync Problems on Windows Domain

Confirm outside time source is working
Identify PDCe in root AD domain: logon to a root DC and run
NETDOM QUERY PDC
Logon PDCe and confirm no errors are returned when syncing:
W32TM /SYNC
Create a file with names of all DC's in root domain (except the PDCe) using the following command:
NETDOM QUERY DC > ROOTLIST.TXT

Cleanup the file and run the following commands to reset the DC's to update time from the domain hierarchy and then sync time.

PSEXEC @ROOTLIST.TXT W32TM /CONFIG /SYNCFROMFLAGS:DOMHIER /UPDATE

PSEXEC @ROOTLIST.TXT W32TM /RESYNC /REDISCOVER

Confirm time synced:

W32TM /MONITOR

Create a file with the names of all the DC's in the subdomain and repeat the above for the subdomain.

Repeat for workstations.

Pages