Active Directory Powershell Blog

Redirecting Well Known Containers (CN=Users; CN=Computers etc.)

2009-11-25T22:03:00Z

In this post we will see the Powershell way of redirecting Users and Computers containers (i.e. Powershell equivalent of tools: redirusr.exe and redircmp.exe ). By now you might know that you can use Get-ADDomain cmdlet for viewing the well-known containers of a domain, For example: PS C:\Users\Administrator.DSWAMIPAT-W7-V1> Get-ADDomain | select *Container ComputersContainer : CN=Computers,DC=dswamipat-w7-vm1,DC=nttest,DC=microsoft,DC=com DeletedObjectsContainer : CN=Deleted Objects,DC=dswamipat-w7-vm1,DC=nttest,DC=microsoft,DC=com...(read more)

Accessing Replication Metadata using ADPowerShell

2009-11-01T09:50:00Z

Metadata associated with Active Directory Replication is exposed in AD via many constructed attributes. Some of these metadata attributes come in pairs of binary blob & xml representation of the metadata element. Constructed Replication XML Metadata Attribute Available on Objects Corresponding Binary Attribute msDS-ReplQueueStatistics Root DSE - msDS-ReplAllInboundNeighbors Root DSE - msDS-ReplAllOutboundNeighbors Root DSE - msDS-NCReplCursors NC Head replUpToDateVector msDS-NCReplInboundNeighbors...(read more)

View/Configure Protected ACL and Fixing Broken Inheritance

2009-10-22T19:33:19Z

ACL inheritance is one of key concept in Active Directory delegation of control. It allows ACEs set on a parent container gets inherited by its child objects. It simplifies access management significantly as it allows the management to be done on the container level rather than on individual leaf objects. However, sometimes we may want to block such inheritance on some special objects. With a protected ACL set on the object, any inheritable ACEs set on its parent will not be able to propagate down...(read more)

Add Object Specific ACEs using Active Directory Powershell

2009-10-13T22:37:12Z

Active Directory Powershell implements two Powershell Provider cmdlets specifically for access control management in Active Directory: Get-ACL and Set-ACL. This blog series is to give a few examples on how to use them. Note that it is not intended for a detailed explanation of access control and delegation in Active Directory and with an assumption that the readers have had basic knowledge. Additional information on Active Directory access control and delegation can be found in the Best Practices...(read more)

How to view SOAP XML messages to and from AD Webservices and Powershell

2009-10-06T01:12:48Z

I am sure many of us are curious to see the XML messages communicated between the AD Powershell webservices client and a Windows server hosting AD Webservices whenever a powershell cmdlet gets executed. In this blog, I am providing information to view those messages by enabling Windows Communication Foundation (WCF) logging through ADWS configuration. For more in general on WCF configuring message logging, please see: http://msdn.microsoft.com/en-us/library/ms730064.aspx 1) Stop Active Directory...(read more)

How to find extended rights that apply to a schema class object

2009-09-23T01:44:31Z

Recently, I came across this question (how to find extended rights that apply to a schema class) in our internal mailing lists. Extended rights are special permissions that denote a special task or function. These rights apply to one or more object classes and can be found stamped in the security descriptor of an object. There are KB articles that describe how to find extended rights that apply to a given objectClass using VBScript or C++. http://support.microsoft.com/kb/302514 I was curious to find...(read more)

Active Directory Management Gateway Service released to web - manage YOUR Windows 2003/2008 DCs USING AD POWERSHELL !

2009-09-18T03:15:19Z

RTW version of Active Directory Management Gateway Service (ADMGS), an Active Directory Web Services (ADWS overview here ) out of band release for down level servers is now available to download from Microsoft Download Center Page . ADMGS is a down level release of in-box version of Windows Server 2008 R2 ADWS and provides the same functionality. One can download and install ADMGS on servers and domain controllers running the following operating systems: Windows Server® 2003 R2 with Service...(read more)

Token Bloat Troubleshooting by Analyzing Group Nesting in AD

2009-09-05T05:52:51Z

This tool started when I was finding ways to analyze the complexity of group memberships in AD. Other than the usual average/median/min/max of number of members, number of memberships etc, I was also interested in finding out the maximum nesting levels of groups and the recursive group membership count. For e.g. in the diagram below, the maximum nesting level of ‘group a’ is 3 and its recursive group membership count is 6. Analyzing the recursive group membership of a group is helpful in troubleshooting...(read more)

Active Directory Powershell to manage Sites and Subnets – Part 3 (Getting Site and Subnets)

2009-08-18T14:30:00Z

Hello folks! Here are few Active Directory Powershell script snippets that you will find useful while writing scripts. They deal with fetching sites, subnets and servers. Most of the snippets are simple and self-explanatory and can be simply copy-pasted in your existing script. ## Get a specified Active Directory Site. $siteName = "Default-First-Site-Name" $configNCDN = (Get-ADRootDSE).ConfigurationNamingContext $siteContainerDN = ( "CN=Sites," + $configNCDN) $siteDN = "CN=" + $siteName + "," + $siteContainerDN...(read more)

Active Directory Powershell to manage Sites and Subnets – Part 2 (New-XADSubnet)

2009-08-11T19:00:00Z

In an earlier post “Active Directory Powershell to manage sites – Part 1 (New-XADSite)” Jairo explained in detail about how to create a Site in Active Directory using AD Powershell. In today’s post I am going to discuss about how to create Subnets using AD Powershell. Before going into details of creating a subnet object, first let us understand what is a Site and Subnet. The following definition is from: http://technet.microsoft.com/en-us/library/cc782048(WS.10).aspx In Active Directory, a site...(read more)

Three Module Extensions (DC Health, Trust Management and Demo Script)

2009-08-04T19:12:00Z

This is a short blog post to highlight a few module extensions that we have been demoing at conferences this year. They show some of the new features in our PowerShell module as well as a few examples extending them. In this update, there are three modules: DemoScript – This is module wrapping Jeffrey Snover’s start-demo script. It has several updates from various sources inside and outside of Microsoft. This would make a pretty good start to a set of cmdlets to create and run demo scripts, test...(read more)

Use Active Directory Powershell to manage Windows 2003/2008 DCs

2009-06-23T23:58:00Z

Many of the readers have expressed interest in having the ability to manage their down level (running Win 2003/2008) DCs using ADPowershell. The only missing piece was the availability of the Active Directory Web Service (ADWS overview here ). Well, ADWS beta for down level DCs is here. Using this beta download, you can manage your existing Active Directory forests using ADPowershell. Below are the steps to participate in this beta program: Visit http://connect.microsoft.com and enter the invitation...(read more)

Inspecting Deleted Objects before Restore

2009-06-01T21:36:00Z

Accidental deletions can happen in Active Directory in many ways. An administrator can end up deleting a single user object unintentionally or fat finger an entire tree of OUs. A rogue script could end up deleting multiple objects at multiple locations in the AD hierarchy. In Active Directory, when deleted objects are moved to the deleted objects container, they lose their hierarchy (because the DN is mangled to ensure uniqueness). Once accidental deletions happen it's important to analyze the impact...(read more)

Tab completing LDAP attribute names inside Advanced Filters

2009-05-19T20:00:00Z

In my previous post about Advanced filter s I showed how to use Powershell variables to represent values inside filters. Example: PS D:\> $JohnSmith = Get-ADUser JohnSmith PS D:\> Get-ADUser -Filter { manager -eq $JohnSmith.DistinguishedName } ## Gets all the user accounts whose manager is JohnSmith .csharpcode, .csharpcode pre { font-size: small; color: black; font-family: consolas, "Courier New", courier, monospace; background-color: #ffffff; /*white-space: pre;*/ } .csharpcode pre { margin:...(read more)

ACTIVE DIRECTORY POWERSHELL TO MANAGE SITES – Part 1 (New-XADSite)

2009-05-05T21:29:00Z

In this opportunity I am going to provide a solution to manage sites in your Active Directory (AD) forest by extending Active Directory PowerShell by implementing functions that allow creation, retrieval, update (moving to a site link, renaming) and deletion of sites. First of all we need to understand what an AD site is made of. We can say that an AD site is represented by three directory objects and a reference in an attribute in a different object (i.e. the Site Link object). In detail an AD site...(read more)