Showing posts with label activedirectory. Show all posts

2/04/2015

active directory account lockout

Very good resource:
Exchange Guru
Also check for LinkedIn contact sync.

8/18/2014

Managing ADMX files… Windows Server 2008 R2 Domain Controller & Windows Server 2012 / Windows 8 Member Machines

From: KiloRoot From one of the 2008R2 DC's, visit the following links to update the ADMX files: Server 2012/8 Server 2012R2/8.1

Windows 2012 R2 DC Setup Walkthrough

Walkthrough: Windows 2012R2 Domain Controller Setup

http://blogs.catapultsystems.com/drowe/archive/2014/03/24/installing-windows-2012-r2-domain-controller.aspx

4/23/2014

Interesting Idea: E-Mail notice to users of pending password expiry

Powershell on TechNet
Archive Copy of Script

1/30/2014

Run a command on every server in domain. (Powershell v2 compatible)



#############################################################################################################
#
#   run-remote.ps1
#
#   run a command on each server in the domain
#   log results to file and e-mail report of failures
#

$rcmd = "ping cmsweb"
$success = "Reply from"
$logfile = ".\run-remote.log"
$outfile = ".\cmsweb-test.html"
$rptname = "cmsweb reachability"
$recipient = "user@domain.com"

############################################################################################
# Create $list of server names for all Windows servers in Active Directory
#
$strCategory = "computer" 
$strOS = "Windows*Server*"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry 
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOS")
$colProplist = "dnshostname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults) 
 { 
  $objComputer = $objResult.Properties;  
  $Server = $objComputer.dnshostname
  $Server = $Server -replace "\s{2,}", ""
  $Server = $Server -replace "\.usa\.domain\.com", ""
  if ($Server) { $list = $list + $Server } #skip a null value
  } 
$list = $list | sort-object
###

clear-host
$today = get-date
$today | out-file $logfile

"Run:  $rcmd"
$username = read-host "Logon"
$pw = read-host -AsSecureString "Password"
$pass = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
   [Runtime.InteropServices.Marshal]::SecureStringToBSTR($pw))
############################################################################################
# Report Heading

$report=@'
<STYLE>
BODY{font-family: Verdana, Arial, Helvetica, sans-serif;font-size:12;font-color: #000000}
TABLE{border-width: 2px;padding: 1px;border-style: solid;border-color: black;border-collapse: collapse;} 
TH{border-width: 2px;padding: 1px;border-style: solid;border-color: black;background-color: #dddddd;font-size:16;font-weight:bold}
TD{border-width: 2px;padding: 2px;border-style: solid;border-color: black;background-color: #efefef; font-size:12;font-weight:normal} 
TD.error{border-width: 2px;padding: 2px;border-style: solid;border-color: black;background-color: #ffffff;font face="monospace";font-size:10;font-color: #cccccc}
</STYLE> 
<HTML> 
<HEAD> 
<TITLE></TITLE> 
</HEAD> 
<BODY> 
<H2>Server Time Issues</H2> 
<H4>
'@
$report+=$today
$report+="Command:  $rcmd"
$report+="</H4><table><th>Server</th><th>IP Number</th><th>Result</th></tr>"

############################################################################################
# Run for every server in list 


foreach ($computer in $list) {
 If (Test-Connection -computername $computer -Quiet -count 1){ #respond to ping?
  #get IP address
  $conn = test-connection -computername $computer -count 1
  $ip = $conn.IPV4Address.IPAddressToString
  "Executing remotely from $computer - $ip"
  $cmd = "c:\util\psexec.exe /acceptEula \\$computer -u $username -p $pass -w c:\ $rcmd"
  $result = invoke-expression $cmd
  if ($result -like "$success*") { #success 
   "$computer - $ip" + ": <$rcmd> -> Success" | out-file $logfile -append
#   $report+=('<tr><td>' + $computer + '</td>') 
#   $report+=('<td >$ip</td>')  
#   $report+=('<td >Success</td>')  
#   $report+=('</tr>')
   } 
  else { #fail 
   "$computer - $ip" + ": <$rcmd> -> Fail" | out-file $logfile -append
   $report+=('<tr><td>' + $computer + '</td>') 
   $report+=('<td >$ip</td>')  
   $report+=('<td >Fail</td>')  
   $report+=('</tr>')
   }
  }#end if connection
 }#end foreach computer
clear-host
notepad $logfile

$report+="</TABLE></BODY></HTML>" 

$report | out-file $outfile 

############################################################################################
#e-mail the report

$messageSubject = $rptname
$smtpServer = "smtp.domain.com"
$smtpFrom = "noreply@domain.com"
$smtpTo = $recipient
$message = $report
send-mailmessage -to $smtpTo -cc "admin@domain.com" -from $smtpFrom -subject $messageSubject -body $message -smtpserver $smtpServer -BodyAsHtml 
###

5/21/2012

How to fix a messed up domain controller

Just get rid of it!

Disconnect the DC from the network
Run dcpromo /forceremoval
From 2003, use NTDSUTIL to do a "metadata cleanup" to clean the DC out of your AD. (See below) If you have at least one Windows Server 2008 DC, then open Active Directory Users and Computers from a 2008 DC, find the bad DC, right-click and delete.

Metadata Cleanup using NTDSUTIL
MS Article 216498 explains how to forcibly remove a domain controller account from AD using NTDSUTIL.
http://support.microsoft.com/kb/216498

Time to Check Sysvol
Sysvol is a share you can find on every domain controller, a share that contains files needed by DCs -- the big ones are the file components of group policy objects (GPOs), pieces called "group policy templates" or GPTs, as well as login scripts. Sysvol is a neat, built-in implementation of DFS (Distributed File Services) that is multi-master, meaning that if you have four DCs named DC1, DC2, DC3 and DC4, then you can drop a file into any one of those four Sysvol folders, and eventually DFS will ensure that there's a copy of that file in each of the other three Sysvols. The fact that you can introduce a new file into the family of Sysvols is why it's said to be "multi-master." On 2003 SP3 and later, there's a command that lets you force replication between a source DC (DC3, in this example) and a destination DC (DC2, in this example) that looks like this:

ntfrsutl.exe forcerepl DC2 /r "Domain System Volume (SYSVOL share)" /p DC3

Check SYSVOL before upgrading
Go to a DC. In its Sysvol, create a file, such as [dcname].txt. After you have created a small text file on each DC whose name reflects the DC that you created it on. Wait a while and go to each DC and look in its Sysvol... there should be a file for each domain controller. If, for example, DC4's dc4.txt shows up nowhere, then DC4 probably has the problem. To fix it, run DCPROMO to demote it and, if the rest of the network doesn't see that you've demoted it, remove the DC's account from the Domain Controllers OU and remove its metadata. Once it is successfully removed, test again by creating another unique file in each DC's Sysvol and be sure everything is cool.

Thanks to:
http://www.minasi.com/newsletters/nws1205.htm

3/27/2011

Powershell: Remove inactive accounts

For every machine account listed in a file, remove machine accounts from all groups and then remove the machine accounts.

$ds = new-object directoryServices.directorySearcher 
 
$names = get-content remove.txt
"------------------------------"
foreach ( $account in $names  ) {
    $account
    $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$account))" 
    $dn = $ds.findOne() 
    if ($dn) {
           #remove computer from groups
           $user = [ADSI]$dn.path 
           "  Removed from groups:"
     foreach ($group in $user.memberof)
       {
       $groupDE = [ADSI]"LDAP://$group" 
       "    "+$groupDE
       $groupDE.remove("LDAP://$($user.distinguishedName)")  
       }

     #remove computer account
     $old = $user.distinguishedname -replace ',.*$',''
     $olduser = $old -replace 'CN=',''
     $usr = $($olduser).tolower()
     $usr + " removed from AD"             
     $location = $dn.path -replace "$old,",''
     $ou = [ADSI]$location
     $ou.delete("computer","cn=$usr")
 }#if
"------------------------------"
}#foreach

Powershell: Report Server Group Membership

Create an HTML report of each server in AD and its group memberships.


###########################################################################
#
#    server-group.ps1
#
#    Report group membership for each Windows Server in AD
#
###########################################################################

# Create $list of AD machine accounts for Windows Servers 
$strCategory = "computer" 
$strOS = "Windows*Server*"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry 
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOS")
$colProplist = "dnshostname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults) { 
    $objComputer = $objResult.Properties;  
    $Server = $objComputer.dnshostname
    $Server = $Server -replace "\s{2,}", ""
    $Server = $Server -replace "\.usa\.DOMAIN\.com", ""
    if ($Server) { $list = $list + $Server } #skip a null value
    }#foreach
 
# Prepare output file
"<HTML>" | out-file server-groups.html
"<HEAD>" | out-file server-groups.html -append
"<TITLE></TITLE>" | out-file server-groups.html -append
"</HEAD>" | out-file server-groups.html -append
'<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#FF0000" VLINK="#800000" ALINK="#FF00FF" BACKGROUND="?">' | out-file server-groups.html -append
"<H1>Servers' Group Membership</H1>" | out-file server-groups.html -append
 
foreach ($target in $list) {
    $ds = new-object directoryServices.directorySearcher 
    $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$target))" 
    $dn = $ds.findOne() 
    if ($dn) { #found
        $user = [ADSI]$dn.path 
        $userDE = [ADSI]"LDAP://$($user.distinguishedname)" 
        $user.name
        "<b>" + $user.name + "</b><BR>" | out-file server-groups.html -append
        $groups = $user.memberof
        foreach($group in $groups) {
            $strGroup = $group.split(',')[0]
            $strGroup = $strGroup.split('=')[1] 
            "     "+$strGroup
            "        " + $strGroup + "<BR>" | out-file server-groups.html -append
            }#foreach
        }#if
    }#foreach
"</BODY></HTML>" | out-file server-groups.html -append

###########################################################################

Powershell: Import Group Members

This script will be used to import a file of the same format that I export from the previous post. After using Excel to review and change the listings. I use these group memberships to filter group policy permissions to apply WSUS client settings to servers.


############################################################################
#
# IMPORT-SERVER-GROUP.PS1
#
# Assign servers to WSUS group from CSV file.  
# Note:  removes server from any existing groups that contain WSUS
#
# CSV Format:  (include headings)
#
#  Server, Group
#  SERVER01, WSUS Test Group
#
############################################################################

$list = @(Import-Csv WSUS-TEST.CSV)
$today = get-date

"==========================================================================="
" CHANGE LOG - " + $today

foreach ( $item in $list ) {
 $account = $item.Server;
 $target = $item.Group;

"---------------------------------------------------------------------------"
 "    " + $account

#Find computer object and remove it from groups
 $ds = new-object directoryServices.directorySearcher 
 $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$account))" 
 $dn = $ds.findOne() 
 if ($dn) { #found
  #remove computer from groups
  $user = [ADSI]$dn.path 
  "      Removed from groups:"
  foreach ($group in $user.memberof)
   {
   $groupDE = [ADSI]"LDAP://$group" 
   "        "+$group
   if ($strGroup -match "WSUS") {
    $groupDE.remove("LDAP://$($user.distinguishedName)")  
    }#if
   }#foreach
 }#if

$dn=0;

#Find group object and add server to it
 $ds = new-object directoryServices.directorySearcher 
 $ds.filter = "(&(objectClass=Group)(name=$target))" 
 $dn = $ds.findOne() 
 if ($dn) { #found Group
  $group = [ADSI]$dn.path 
  $groupDE = [ADSI]"LDAP://$($group.distinguishedname)" 
  $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$account))" 
  $dn = $ds.findOne()
  if ($dn) { #found machine account
   $usr = [ADSI]$dn.path
   $ADuser = [ADSI]"LDAP://$($usr.distinguishedname)"
   "      Added to " + $target
   $groupDE.add("LDAP://$($ADuser.distinguishedName)")  
   }#if
 }#if
}#foreach
"==========================================================================="
############################################################################

Powershell: Export Group Membership

Putting the pieces together
This post pulls together some of my previous fragments into something more specifically useful.


###########################################################################
#
#  server-group.ps1
#
#       Export group membership for each Windows Server in AD
#              if the group name contains WSUS
#
###########################################################################

#delete output file if it exists
if ( test-path wsus-server-groups.csv ) { remove-item wsus-server-groups.csv }

# Create $list of AD machine accounts for Windows Servers 
$strCategory = "computer" 
$strOS = "Windows*Server*"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry 
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = ("OperatingSystem=$strOS")
$colProplist = "dnshostname"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults) { 
    $objComputer = $objResult.Properties;  
    $Server = $objComputer.dnshostname
    $Server = $Server -replace "\s{2,}", ""
    $Server = $Server -replace "\.USA\.DOMAIN\.COM", ""
    if ($Server) { $list = $list + $Server } #skip a null value
    }#foreach
"Server, Group" | out-file -encoding ASCII  wsus-server-groups.csv # output headings
foreach ($target in $list) {
    $ds = new-object directoryServices.directorySearcher 
    $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$target))" 
    $dn = $ds.findOne() 
    if ($dn) { #found
       $user = [ADSI]$dn.path 
       $userDE = [ADSI]"LDAP://$($user.distinguishedname)" 
       $user.name
       $groups = $user.memberof
       foreach($group in $groups) {               {
           $strGroup = $group.split(',')[0]
           $strGroup = $strGroup.split('=')[1] 
           "     "+$strGroup
           if ($strGroup -match "WSUS") {
               $Target+", "+$strGroup | out-file -encoding ASCII  wsus-server-groups.csv -append
               }#if
           }#foreach
    }#if
}#foreach
###########################################################################

Powershell: List the members of a group


$root=([ADSI]"").distinguishedName
$Group = [ADSI]("LDAP://CN=Domain Admins,CN=Users,"+$root)
$Group.member

3/26/2011

Powershell: Add members to AD group


$users = get-content add.txt
$target = "testGroup"
"=============================="
" ADD TO " + $target
"------------------------------"
 $ds = new-object directoryServices.directorySearcher 
 $ds.filter = "(&(objectClass=Group)(name=$target))" 
 $dn = $ds.findOne() 

 if ($dn) { #found
    $group = [ADSI]$dn.path 
    $groupDE = [ADSI]"LDAP://$($group.distinguishedname)" 

    foreach ($name in $users)
     {
     $ds.filter = "(&(objectCategory=computer)(objectClass=user)(name=$name))" 
     $dn = $ds.findOne()
     if ($dn) {
     $usr = [ADSI]$dn.path
     $ADuser = [ADSI]"LDAP://$($usr.distinguishedname)"
     "    "+$ADuser.name
      $groupDE.add("LDAP://$($ADuser.distinguishedName)")  
              }#if
        }#foreach
    }#if
"------------------------------"

3/25/2011

Powershell: Find inactive group members

Get the members each group in the list. if the members are on a list of inactive accounts, flag them in the output.


$root=([ADSI]"").distinguishedName
 
$Groups=get-content groups.txt
$Accounts=get-content inactive.txt
 
foreach ($Group in $Groups) {
    "-----------------------------------"
    $Group+":"
    $Group = [ADSI]("LDAP://CN=$Group,CN=Users,"+$root)
    $Output = $Group.member –Replace ‘\,.*$’, ‘’
    $Check = $Output -Replace 'CN=',''
    foreach ($Item in $Check) {
        $test = $Item.ToLower()
        if ($Accounts -contains $test) {
            "***************"+$test
            }
            else {
            $test
        }
    }
}

Pages