It is sometimes helpful to be able to search for objects in AD by their creation date. The whenCreated attribute is useful for this as it is a replicated attribute (i.e. is consistent across all DCs). The challenge for using whenCreated in LDAP filters is the syntax. The attribute uses the GeneralizedTime syntax to represent… Read More: Powershell: Using the whenCreated attribute in LDAP Filters »
For a number of years now I have been using OldCmp to find and remove inactive user and computer accounts. The other day I thought I would have a crack at using the AD Powershell cmdlets to at least do the finding part. It wasn’t as difficult as I thought. Here’s an example looking for enabled… Read More: Using the AD Powershell cmdlets to find inactive accounts »
I’ve had the script shown below for quite a while, but as I recently tested it successfully against Windows Server 2012 AD (Release Candidate), I thought I would share it with the community. Note that I have only tested it with single domain forests. Import-Module activedirectory [string] $menu = @’ Active Directory FSMO Role Holder… Read More: Powershell script to move FSMO roles »
If you are in a cross-forest mailbox migration scenario and use Exchange message classifications, this script might be useful to you. If you plan to have the same message classifications in the target Exchange Organisation then you will want the classification IDs to match. Without this, there is potential for the classification on migrated mail… Read More: Powershell script to import message classifications »
Here’s a handy Powershell script to check for duplicate attribute values on AD objects. Why is this useful? Well, you might have provisioning systems that assign unique values (e.g. employeeID) to AD objects. Things can start to go wrong if it turns out that more than one object has been assigned the same attribute value. … Read More: Powershell script to check for duplicate attribute values »
Here’s a Powershell script I wrote to delegate permissions to a service account to manage user objects within a number of OUs. The script takes as input a file containing the distinguished names (DNs) of the OUs. The approach should be reasonably obvious from the comments in the script. The only complexity comes from having… Read More: Create new bulk AD delegations with Powershell »
The other day I was doing some troubleshooting on a DAG member in a remote site. I needed to get a picture of the copy and replay queues for the server over a period of time. To do this I wrote a small script to poll the queues at 60 second intervals over a 24 hour period. … Read More: Powershell script to log DAG database queues to file »
I’ve been working with the Windows Server 2008 R2 Active Directory cmdlets quite a bit recently. If you’ve come from a background of using ADFIND, the cmdlets take a bit of getting used, but for me it’s definitely been worth the time spent. One thing that frustrates me a little is that the names… Read More: What’s in a name? »
The objectGUID attribute is a little tricky to work with, especially if you want to use it as part of an LDAP filter. This is because the value in stored within the directory as an octet string – essentially an array of one-byte characters. This syntax is not especially user-friendly, which is why it is… Read More: Powershell script to find objects using objectGUID value »
As promised, here are the Powershell data files from my Teched NZ 2011 demos. I’ve also included the FSMO role mover script. te_2011.zip Let me know if you have any questions. Enjoy!