I’ve had the script shown below for quite a while, but as I recently tested it successfully against Windows Server 2012 AD (Release Candidate), I thought I would share it with the community. Note that I have only tested it with single domain forests. Import-Module activedirectory [string] $menu = @’ Active Directory FSMO Role Holder… Read More »
If you are in a cross-forest mailbox migration scenario and use Exchange message classifications, this script might be useful to you. If you plan to have the same message classifications in the target Exchange Organisation then you will want the classification IDs to match. Without this, there is potential for the classification on migrated mail… Read More »
Here’s a handy Powershell script to check for duplicate attribute values on AD objects. Why is this useful? Well, you might have provisioning systems that assign unique values (e.g. employeeID) to AD objects. Things can start to go wrong if it turns out that more than one object has been assigned the same attribute value. … Read More »
Here’s a Powershell script I wrote to delegate permissions to a service account to manage user objects within a number of OUs. The script takes as input a file containing the distinguished names (DNs) of the OUs. The approach should be reasonably obvious from the comments in the script. The only complexity comes from having… Read More »
The other day I was doing some troubleshooting on a DAG member in a remote site. I needed to get a picture of the copy and replay queues for the server over a period of time. To do this I wrote a small script to poll the queues at 60 second intervals over a 24 hour period. … Read More »
The objectGUID attribute is a little tricky to work with, especially if you want to use it as part of an LDAP filter. This is because the value in stored within the directory as an octet string – essentially an array of one-byte characters. This syntax is not especially user-friendly, which is why it is… Read More »
As promised, here are the Powershell data files from my Teched NZ 2011 demos. I’ve also included the FSMO role mover script. te_2011.zip Let me know if you have any questions. Enjoy!
When preparing for a migration of AD objects from one forest to another it is useful to know if any of the names are going to conflict. There are, as you probably know, a number of different naming attributes in AD, but the one most likely to cause problems in the event of a conflict is sAMAccountName. … Read More »
Something I often recommend to my customers is keep the membership of the Enterprise Admins and Schema Admins groups empty and only populate them (temporarily) when required. The privileges assigned to these groups are obviously high and removing the members reduces the potential for costly mistakes and/or compromise. Here’s a quick Powershell snippet that will… Read More »
Many organisations choose to rename the Built-in Administrator account for the domain for security reasons. Whether or not renaming the account provides any real protection is the matter of some debate. What is clear is that any hacker worth his or her salt is not going to be fooled by the rename, because the account… Read More »