Active Directory Powershell Blog

Disable loading the default drive ‘AD:’ during import-module

M. Ali — Mon, 12 Apr 2010 17:34:00 GMT

All of you who have used the Active Directory (AD) powershell module would have noticed that every time you import the AD module, a default drive ‘AD:’ is also loaded. So when you type the following command: Import-module ActiveDirectory...(read more)

Find out when your Password Expires

M. Ali — Fri, 26 Feb 2010 23:12:00 GMT

Few weeks ago I came across this question “How to find out an account’s password expiration date” in one of our internal mailing-list. This looks like a simple question, but when we tried to find the answer we realized it is not a trivial...(read more)

Adding/removing members from another forest or domain to groups in Active Directory

M. Ali — Wed, 20 Jan 2010 19:54:36 GMT

Adding/removing members belonging to the same domain from a group is very simple using AD Powershell cmdlets. All you have to do is pass an identifier (either samAccountName, distinguishedName, securityIdentifier or GUID) of the member and group to one...(read more)

Redirecting Well Known Containers (CN=Users; CN=Computers etc.)

M. Ali — Wed, 25 Nov 2009 22:03:00 GMT

In this post we will see the Powershell way of redirecting Users and Computers containers (i.e. Powershell equivalent of tools: redirusr.exe and redircmp.exe ). By now you might know that you can use Get-ADDomain cmdlet for viewing the well-known containers...(read more)

Accessing Replication Metadata using ADPowerShell

M. Ali — Sun, 01 Nov 2009 09:50:00 GMT

Metadata associated with Active Directory Replication is exposed in AD via many constructed attributes. Some of these metadata attributes come in pairs of binary blob & xml representation of the metadata element. Constructed Replication...(read more)

View/Configure Protected ACL and Fixing Broken Inheritance

M. Ali — Thu, 22 Oct 2009 19:33:19 GMT

ACL inheritance is one of key concept in Active Directory delegation of control. It allows ACEs set on a parent container gets inherited by its child objects. It simplifies access management significantly as it allows the management to be done on the...(read more)

Add Object Specific ACEs using Active Directory Powershell

M. Ali — Tue, 13 Oct 2009 22:37:12 GMT

Active Directory Powershell implements two Powershell Provider cmdlets specifically for access control management in Active Directory: Get-ACL and Set-ACL. This blog series is to give a few examples on how to use them. Note that it is not intended for...(read more)

How to view SOAP XML messages to and from AD Webservices and Powershell

M. Ali — Tue, 06 Oct 2009 01:12:48 GMT

I am sure many of us are curious to see the XML messages communicated between the AD Powershell webservices client and a Windows server hosting AD Webservices whenever a powershell cmdlet gets executed. In this blog, I am providing information to view...(read more)

How to find extended rights that apply to a schema class object

M. Ali — Wed, 23 Sep 2009 01:44:31 GMT

Recently, I came across this question (how to find extended rights that apply to a schema class) in our internal mailing lists. Extended rights are special permissions that denote a special task or function. These rights apply to one or more object classes...(read more)

Active Directory Management Gateway Service released to web - manage YOUR Windows 2003/2008 DCs USING AD POWERSHELL !

M. Ali — Fri, 18 Sep 2009 03:15:19 GMT

RTW version of Active Directory Management Gateway Service (ADMGS), an Active Directory Web Services (ADWS overview here ) out of band release for down level servers is now available to download from Microsoft Download Center Page . ADMGS is a down level...(read more)

Token Bloat Troubleshooting by Analyzing Group Nesting in AD

M. Ali — Sat, 05 Sep 2009 05:52:51 GMT

This tool started when I was finding ways to analyze the complexity of group memberships in AD. Other than the usual average/median/min/max of number of members, number of memberships etc, I was also interested in finding out the maximum nesting levels...(read more)

Active Directory Powershell to manage Sites and Subnets – Part 3 (Getting Site and Subnets)

M. Ali — Tue, 18 Aug 2009 14:30:00 GMT

Hello folks! Here are few Active Directory Powershell script snippets that you will find useful while writing scripts. They deal with fetching sites, subnets and servers. Most of the snippets are simple and self-explanatory and can be simply copy-pasted...(read more)

Active Directory Powershell to manage Sites and Subnets – Part 2 (New-XADSubnet)

M. Ali — Tue, 11 Aug 2009 19:00:00 GMT

In an earlier post “Active Directory Powershell to manage sites – Part 1 (New-XADSite)” Jairo explained in detail about how to create a Site in Active Directory using AD Powershell. In today’s post I am going to discuss about how to create Subnets using...(read more)

Three Module Extensions (DC Health, Trust Management and Demo Script)

M. Ali — Tue, 04 Aug 2009 19:12:00 GMT

This is a short blog post to highlight a few module extensions that we have been demoing at conferences this year. They show some of the new features in our PowerShell module as well as a few examples extending them. In this update, there are three modules...(read more)

Use Active Directory Powershell to manage Windows 2003/2008 DCs

M. Ali — Tue, 23 Jun 2009 23:58:00 GMT

Many of the readers have expressed interest in having the ability to manage their down level (running Win 2003/2008) DCs using ADPowershell. The only missing piece was the availability of the Active Directory Web Service (ADWS overview here ). Well, ADWS...(read more)

Inspecting Deleted Objects before Restore

M. Ali — Mon, 01 Jun 2009 21:36:00 GMT

Accidental deletions can happen in Active Directory in many ways. An administrator can end up deleting a single user object unintentionally or fat finger an entire tree of OUs. A rogue script could end up deleting multiple objects at multiple locations...(read more)

Tab completing LDAP attribute names inside Advanced Filters

M. Ali — Tue, 19 May 2009 20:00:00 GMT

In my previous post about Advanced filter s I showed how to use Powershell variables to represent values inside filters. Example: PS D:\> $JohnSmith = Get-ADUser JohnSmith PS D:\> Get-ADUser -Filter { manager -eq $JohnSmith.DistinguishedName...(read more)

ACTIVE DIRECTORY POWERSHELL TO MANAGE SITES – Part 1 (New-XADSite)

M. Ali — Tue, 05 May 2009 21:29:00 GMT

In this opportunity I am going to provide a solution to manage sites in your Active Directory (AD) forest by extending Active Directory PowerShell by implementing functions that allow creation, retrieval, update (moving to a site link, renaming) and deletion...(read more)

HOW TO CREATE A FUNCTION TO VALIDATE THE EXISTENCE OF AN AD OBJECT (Test-XADObject)

M. Ali — Tue, 05 May 2009 21:25:58 GMT

In this posting I am sharing a simple but useful function that you might need to use in many of your scripts. This is a function that returns true if a given AD object exists provided its identity. The Identity parameter can receive any ADObject identity...(read more)

Working with Certificates in Active Directory Powershell

M. Ali — Mon, 27 Apr 2009 01:00:00 GMT

AD Powershell uses .NET class X509Certificate to represent a certificate. Let's see how you can manage the certificates for a user. Update User Certificates You can create a X509Certificate (or X509Certificate2 ) object using the certificate file...(read more)

Active Directory Powershell – Advanced Filter (Part – II)

M. Ali — Tue, 14 Apr 2009 19:45:00 GMT

In my previous post I discussed about the various features available in -Filter parameter aka “advanced filter”. This post extends the previous one and discusses about the various operators supported in Advanced Filter and also give examples using each...(read more)

Active Directory Web Services Overview

M. Ali — Mon, 06 Apr 2009 20:45:00 GMT

Active Directory Web Services (ADWS) is a new windows service introduced in Windows 2008 R2 that enables remote management of any local directory service instance using WS-* protocols. ADWS supports the following web service protocols: WS-Transfer...(read more)

Active Directory Powershell – Advanced Filter

M. Ali — Fri, 03 Apr 2009 15:30:00 GMT

Do you find it difficult reading/writing LDAP filters? Do you wish you could write LDAP filter in a more natural way? Have you ever wished that Ldap filter parser message should point you to the exact error character in your filter string instead of displaying...(read more)

Active Directory Administrative Center for Windows Server 2008 R2 implemented using ADPowershell!

M. Ali — Fri, 27 Mar 2009 21:02:00 GMT

Windows Server 2008 R2 doesn’t just add ADPowershell – it also adds Active Directory Administrative Center (or ADAC), a new GUI tool for AD administrators. Read about it here . What’s more, while you can’t tell just from looking at it, ADAC is implemented...(read more)

Error Reporting in Active Directory Powershell

M. Ali — Wed, 25 Mar 2009 17:59:00 GMT

In this blog, I will discuss the Active Directory (AD) PowerShell error reporting. Good error reporting is critical and it saves time to resolve an issue. Let's start with the basics. In case of error, AD PowerShell cmdlet prints the error details...(read more)