Pages

Showing posts with label active directory. Show all posts
Showing posts with label active directory. Show all posts

9/28/2016

Duplicate IP address registrations in DNS

Duplicate IP address registrations in DNS


https://blogs.technet.microsoft.com/askpfe/2011/06/03/how-dns-scavenging-and-the-dhcp-lease-duration-relate/


Very useful discussion of this issue and methods to address it.


Also a script to identify duplicate IP addresses in DNS:




#
#Import the Active Directory Module
import-module activedirectory

#Define an empty array to store computers with duplicate IP address registrations in DNS
$duplicate_comp = @()

#Get all computers in the current Active Directory domain along with the IPv4 address
#The IPv4 address is not a property on the computer account so a DNS lookup is performed
#The list of computers is sorted based on IPv4 address and assigned to the variable $comp
$comp = get-adcomputer -filter * -properties ipv4address | sort-object -property ipv4address

#For each computer object returned, assign just a sorted list of all 
#of the IPv4 addresses for each computer to $sorted_ipv4
$sorted_ipv4 = $comp | foreach {$_.ipv4address} | sort-object

#For each computer object returned, assign just a sorted, unique list 
#of all of the IPv4 addresses for each computer to $unique_ipv4
$unique_ipv4 = $comp | foreach {$_.ipv4address} | sort-object | get-unique

#compare $unique_ipv4 to $sorted_ipv4 and assign just the additional 
#IPv4 addresses in $sorted_ipv4 to $duplicate_ipv4
$duplicate_ipv4 = Compare-object -referenceobject $unique_ipv4 -differenceobject $sorted_ipv4 | foreach {$_.inputobject}

#For each instance in $duplicate_ipv4 and for each instance 
#in $comp, compare $duplicate_ipv4 to $comp If they are equal, assign
#the computer object to array $duplicate_comp
foreach ($duplicate_inst in $duplicate_ipv4)
{
    foreach ($comp_inst in $comp)
    {
        if (!($duplicate_inst.compareto($comp_inst.ipv4address)))
        {
            $duplicate_comp = $duplicate_comp + $comp_inst
        }
    }
}

#Pipe all of the duplicate computers to a formatted table
$duplicate_comp | ft name,ipv4address -a

9/29/2015

List all SPNs in Active Directory

From TechNet



cls
$search = New-Object  DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()

 

#list results
foreach($result in $results)
{
        $userEntry  = $result.GetDirectoryEntry()
        Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black"
        Write-host "DN      =      "  $userEntry.distinguishedName
        Write-host "Object Cat. = "  $userEntry.objectCategory
        Write-host "servicePrincipalNames"
        $i=1
        foreach($SPN in $userEntry.servicePrincipalName)
        {
            Write-host  "SPN(" $i ")   =      " $SPN       $i+=1
        }
        Write-host ""

} 

3/03/2014

Windows Domain Time Sync

Windows Domain Time Sync

Do the following on servers/workstations to point them to the domain as time reference and sync time:


w32tm /config /syncfromflags:DOMHIER /update
w32tm /resync /rediscover

12/16/2013

Searching Active Directory user objects for a values in an attribute

Searching Active Directory user objects for value in an attribute:
The following will look for user objects with any value in "audio" attribute
$strFilter = "(&(objectCategory=User)(audio=*))"

$objDomain = New-Object System.DirectoryServices.DirectoryEntry

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher

$objSearcher.SearchRoot = $objDomain

$objSearcher.PageSize = 4000

$objSearcher.Filter = $strFilter

$objSearcher.SearchScope = "Subtree"

$colProplist = "name"

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}

$colResults = $objSearcher.FindAll()

foreach ($objResult in $colResults)

    {$objItem = $objResult.Properties; $objItem.name}

9/04/2011

Powershell: list servers that respond

##################################################################################
#
# Create list of all servers with machine accounts in AD that respond to PING
#
##################################################################################
# Create $list of AD machine accounts for Windows Servers
$ServerList = ".\SERVERLIST.TXT"
New-Item $ServerList -Type file -Force >$nul
"Gathering Server List..."
$strCategory = "computer"
$strOS = "Windows*Server*"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOS")
$colProplist = "dnshostname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults) {
$objComputer = $objResult.Properties;
$Server = $objComputer.dnshostname
$Server = $Server -replace "\s{2,}", ""
$Server = $Server -replace "\.usa\.domain\.com", ""
if ($Server) {#skip null value
$Server
if (Test-Connection -ComputerName $Server -quiet -count 1) {#ping test
write-output $Server | out-file -encoding ASCII -filepath $ServerList -append
" .....OK"
}#if
}#if
}#foreach

Groups.ps1

#powershell to create text files in a subdirectory with group members of a list of groups

$root=([ADSI]"").distinguishedName

$Groups=get-content groups.txt
$Folder=".\wsus-groups\"

foreach ($Group in $Groups) {
$out = $Folder+$Group+".TXT"
$outfile = $out -replace ' ','-'
#delete output file if it exists
if ( test-path $outfile ) { remove-item $outfile }

# "-----------------------------------"
# $Group+":"
$Group = [ADSI]("LDAP://CN=$Group,CN=Users,"+$root)
$list1 = $Group.member -Replace '\,.*$', ''
$list = $list1 -Replace 'CN=',''
# $list
$list | out-file -encoding ASCII $outfile -append
}

Enumerate Mailbox Permissions

$root = [ADSI]'LDAP://RootDSE' $dfDefaultRootPath = "LDAP://" + $root.DefaultNamingContext.tostring() $dfRoot = [ADSI]$dfDefaultRootPath $gfGALQueryFilter = "(&(&(&(mailnickname=*)(objectCategory=person)(objectClass=user))))" $dfsearcher = new-object System.DirectoryServices.DirectorySearcher($dfRoot) $dfsearcher.PageSize = 4500 $dfsearcher.Filter = $gfGALQueryFilter $dfsearcher.PropertiesToLoad.Add("msExchMailboxSecurityDescriptor") $srSearchResult = $dfsearcher.FindAll() "Mailbox ACE User" foreach ($emResult in $srSearchResult) { $uoUserobject = New-Object System.DirectoryServices.directoryentry $uoUserobject = $emResult.GetDirectoryEntry() $emProps = $emResult.Properties [byte[]]$DaclByte = $emProps["msexchmailboxsecuritydescriptor"][0] $adDACL = new-object System.DirectoryServices.ActiveDirectorySecurity $adDACL.SetSecurityDescriptorBinaryForm($DaclByte) $mbRightsacls =$adDACL.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier]) foreach ($ace in $mbRightsacls){ if($ace.IdentityReference.Value -ne "S-1-5-10" -band $ace.IdentityReference.Value -ne "S-1-5-18" -band $ace.IsInherited -ne $true){ $sidbind = "LDAP://" $AceName = $ace.IdentityReference.Value $aceuser = [ADSI]$sidbind if ($aceuser.name -ne $null){ $AceName = $aceuser.samaccountname } "" + $uoUserobject.DisplayName + " " + $AceName } } }

More on aliased server names

regarding authentication during access to machines using a name other than its "real" name.
http://www.marc-antho-etc.net/blog/post/2010/09/08/Multiple-Names-for-a-File-and-Print-Server-Running-Windows-Server-2008-R2.aspx

5/31/2011

List Exchange Mailbox Permissions

$root = [ADSI]'LDAP://RootDSE' 
$dfDefaultRootPath = "LDAP://" + $root.DefaultNamingContext.tostring()
$dfRoot = [ADSI]$dfDefaultRootPath
$gfGALQueryFilter =  "(&(&(&(mailnickname=*)(objectCategory=person)(objectClass=user))))"
$dfsearcher = new-object System.DirectoryServices.DirectorySearcher($dfRoot)
$dfsearcher.PageSize = 4500
$dfsearcher.Filter = $gfGALQueryFilter
$dfsearcher.PropertiesToLoad.Add("msExchMailboxSecurityDescriptor")
$srSearchResult = $dfsearcher.FindAll()
"Mailbox ACE User"
foreach ($emResult in $srSearchResult) {
 $uoUserobject = New-Object System.DirectoryServices.directoryentry
 $uoUserobject = $emResult.GetDirectoryEntry()
 $emProps = $emResult.Properties
 [byte[]]$DaclByte = $emProps["msexchmailboxsecuritydescriptor"][0]
 $adDACL = new-object System.DirectoryServices.ActiveDirectorySecurity
 $adDACL.SetSecurityDescriptorBinaryForm($DaclByte)
 $mbRightsacls =$adDACL.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier])
 foreach ($ace in $mbRightsacls){
  if($ace.IdentityReference.Value -ne "S-1-5-10" -band $ace.IdentityReference.Value -ne "S-1-5-18" -band $ace.IsInherited -ne $true){  
    $sidbind = "LDAP://"
    $AceName = $ace.IdentityReference.Value 
           $aceuser = [ADSI]$sidbind
    if ($aceuser.name -ne $null){
     $AceName = $aceuser.samaccountname
    }

    "" + $uoUserobject.DisplayName  + " " +  $AceName
  }
 }
}

3/27/2011

Powershell: Import Group Members

This script will be used to import a file of the same format that I export from the previous post. After using Excel to review and change the listings. I use these group memberships to filter group policy permissions to apply WSUS client settings to servers.

############################################################################
#
# IMPORT-SERVER-GROUP.PS1
#
# Assign servers to WSUS group from CSV file.  
# Note:  removes server from any existing groups that contain WSUS
#
# CSV Format:  (include headings)
#
#  Server, Group
#  SERVER01, WSUS Test Group
#
############################################################################

$list = @(Import-Csv WSUS-TEST.CSV)
$today = get-date

"==========================================================================="
" CHANGE LOG - " + $today

foreach ( $item in $list ) {
 $account = $item.Server;
 $target = $item.Group;

"---------------------------------------------------------------------------"
 "    " + $account

#Find computer object and remove it from groups
 $ds = new-object directoryServices.directorySearcher 
 $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$account))" 
 $dn = $ds.findOne() 
 if ($dn) { #found
  #remove computer from groups
  $user = [ADSI]$dn.path 
  "      Removed from groups:"
  foreach ($group in $user.memberof)
   {
   $groupDE = [ADSI]"LDAP://$group" 
   "        "+$group
   if ($strGroup -match "WSUS") {
    $groupDE.remove("LDAP://$($user.distinguishedName)")  
    }#if
   }#foreach
 }#if

$dn=0;

#Find group object and add server to it
 $ds = new-object directoryServices.directorySearcher 
 $ds.filter = "(&(objectClass=Group)(name=$target))" 
 $dn = $ds.findOne() 
 if ($dn) { #found Group
  $group = [ADSI]$dn.path 
  $groupDE = [ADSI]"LDAP://$($group.distinguishedname)" 
  $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$account))" 
  $dn = $ds.findOne()
  if ($dn) { #found machine account
   $usr = [ADSI]$dn.path
   $ADuser = [ADSI]"LDAP://$($usr.distinguishedname)"
   "      Added to " + $target
   $groupDE.add("LDAP://$($ADuser.distinguishedName)")  
   }#if
 }#if
}#foreach
"==========================================================================="
############################################################################

Powershell: List AD Group Membership


###########################################################################
#
#    List AD Group Membership of a user in specified OU
#
###########################################################################
$root=([adsi]"").distinguishedName
$ou=[adsi]("LDAP://ou=Engineering,ou=Chicago,ou=Information Technology,"+$root)
$user=$ou.psbase.children.find("cn=Smith\, Billy")
$groups = $user.memberof
foreach($group in $groups){
    $strGroup = $group.split(',')[0]
    $strGroup = $strGroup.split('=')[1]
    $strGroup
    }#foreach
###########################################################################