For a number of years now I have been using OldCmp to find and remove inactive user and computer accounts. The other day I thought I would have a crack at using the AD Powershell cmdlets to at least do the finding part. It wasn’t as difficult as I thought. Here’s an example looking for enabled… Read More »
I’ve had the script shown below for quite a while, but as I recently tested it successfully against Windows Server 2012 AD (Release Candidate), I thought I would share it with the community. Note that I have only tested it with single domain forests. Import-Module activedirectory [string] $menu = @’ Active Directory FSMO Role Holder… Read More »
Recently, I have been working in an Windows Server 2008 R2 AD environment that has a number of RODCs in branch offices. The environment uses DFSR (i.e. not FRS) for SYSVOL replication an I wondered whether I could simply remove the connection objects named “RODC Connection (FRS)”. To me, the use of “FRS” in… Read More »
Here’s a handy Powershell script to check for duplicate attribute values on AD objects. Why is this useful? Well, you might have provisioning systems that assign unique values (e.g. employeeID) to AD objects. Things can start to go wrong if it turns out that more than one object has been assigned the same attribute value. … Read More »
Here’s a Powershell script I wrote to delegate permissions to a service account to manage user objects within a number of OUs. The script takes as input a file containing the distinguished names (DNs) of the OUs. The approach should be reasonably obvious from the comments in the script. The only complexity comes from having… Read More »
I’ve been working with the Windows Server 2008 R2 Active Directory cmdlets quite a bit recently. If you’ve come from a background of using ADFIND, the cmdlets take a bit of getting used, but for me it’s definitely been worth the time spent. One thing that frustrates me a little is that the names… Read More »
Good books continue to deliver value long after the publication date. Here’s an example of how they helped repair a broken bed support recently. (with apologies to Gil Kirkpatrick, whose Active Directory Programming book has been a huge help to me over the last 10 years). PS. Details of how exactly the bed was broken are… Read More »
The objectGUID attribute is a little tricky to work with, especially if you want to use it as part of an LDAP filter. This is because the value in stored within the directory as an octet string – essentially an array of one-byte characters. This syntax is not especially user-friendly, which is why it is… Read More »
As promised, here are the Powershell data files from my Teched NZ 2011 demos. I’ve also included the FSMO role mover script. te_2011.zip Let me know if you have any questions. Enjoy!
When preparing for a migration of AD objects from one forest to another it is useful to know if any of the names are going to conflict. There are, as you probably know, a number of different naming attributes in AD, but the one most likely to cause problems in the event of a conflict is sAMAccountName. … Read More »