Active Directory (PowerShell) - Revision history

Sstrutt: /* Computers */ Added "Remove-ADComputer"

2013-08-28T15:24:00Z

Computers: Added "Remove-ADComputer"

← Older revision		Revision as of 15:24, 28 August 2013
Line 149:		Line 149:

	== Computers ==		== Computers ==
			To disable a computer account, use <code>Disable-ADAccoun</code>
	=== <code>Get-ADComputer</code> examples ===		=== <code>Get-ADComputer</code> examples ===
	<source lang="powershell">		<source lang="powershell">
Line 154:		Line 155:
	</source>		</source>
	* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers		* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers

			=== <code>Remove-ADComputer</code> examples ===
			<source lang="powershell">
			Remove-ADComputer -Identity $computer -Confirm:$false
			</source>

	== Organisation Unit ==		== Organisation Unit ==

2013-08-28T15:20:29Z

Remove-ADUser examples: Added warning

← Older revision		Revision as of 15:20, 28 August 2013
Line 109:		Line 109:

	=== <code>Remove-ADUser</code> examples ===		=== <code>Remove-ADUser</code> examples ===
			It would normally be quite foolhardy to delete a user account that wasn't already disabled. Deletion removes group memberships, file-permissions etc etc. Whilst you can create a new account with the same name, it won't have the same [[Acronyms#S\|SID]] so '''it's not the same account'''.
	<source lang="powershell">		<source lang="powershell">
	Remove-ADUser -Identity $user -Confirm:$false # $user retrieved from Get-ADUser, -Confirm:$false prevents confirmation prompt		Remove-ADUser -Identity $user -Confirm:$false # $user retrieved from Get-ADUser, -Confirm:$false prevents confirmation prompt

2013-08-28T15:09:11Z

Users: Added "Remove-ADUser"

← Older revision		Revision as of 15:09, 28 August 2013
Line 106:		Line 106:
	# Make user account active		# Make user account active
	Set-ADUser $Usr -ChangePasswordAtLogon $true -Enabled $true		Set-ADUser $Usr -ChangePasswordAtLogon $true -Enabled $true
			</source>

			=== <code>Remove-ADUser</code> examples ===
			<source lang="powershell">
			Remove-ADUser -Identity $user -Confirm:$false # $user retrieved from Get-ADUser, -Confirm:$false prevents confirmation prompt
	</source>		</source>

2013-06-10T11:48:30Z

Get-ADUser examples: Added Distinguished Name

← Older revision		Revision as of 11:48, 10 June 2013
Line 83:		Line 83:
	</source>		</source>
	* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers		* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers

			==== Distinguished Name ====
			You can't filter using wildcards for the Distinguished Name filed (see http://social.technet.microsoft.com/Forums/en-US/ITCG/thread/e6f5a98d-62d1-4659-b328-ebab6f546cc4).

			As a workaround, do a generic export from AD and pipe it through a <code>Where-Object</code> CmdLet (not that if you have a large number of users in AD this isn't particularly efficient).

			<source lang="powershell">
			$users = Get-ADUser -Filter * \| Where-Object {$_.DistinguishedName -like ",CN=OuFolder,"}
			</source>

	=== <code>New-ADUser</code> examples ===		=== <code>New-ADUser</code> examples ===

2013-06-07T14:06:09Z

Groups: Added another Get-ADGroups examples

← Older revision		Revision as of 14:06, 7 June 2013
Line 103:		Line 103:
	<source lang="powershell">		<source lang="powershell">
	$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group		$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group
	$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security"' -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU		$groups = Get-ADGroup -Filter 'Name -like "Operations"' # Get all security groups with Operations in the title
			$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security"' -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU
	</source>		</source>

2013-05-29T10:05:35Z

Groups: Added "Copy Users From Existing Group"

← Older revision		Revision as of 10:05, 29 May 2013
Line 104:		Line 104:
	$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group		$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group
	$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security"' -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU		$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security"' -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU
			</source>

			=== Copy Users From Existing Group ===
			The script below copies users from an existing group and adds them to another group (existing users in the group are unaffected).
			<source lang="powershell">
			$Src_Group = "Source Group Name"
			$Dst_Group = "Destination Group Name"
			$Users = Get-ADGroupMember $Src_Group
			Add-ADGroupMember -Identity $Dst_Group -Members $Users -Credential (Get-Credential)
	</source>		</source>

2013-05-29T08:28:41Z

Getting Started: Added Credentials

@@ Line 12: / Line 12: @@
 Import-Module ActiveDirectory
 </source>
 === Group Policy ===

2013-05-28T21:49:59Z

New-ADUser examples: Typo fix

← Older revision		Revision as of 21:49, 28 May 2013
Line 81:		Line 81:
	# Make user account active		# Make user account active
	Set-ADUser $Usr -ChangePasswordAtLogon $true -Enabled $true		Set-ADUser $Usr -ChangePasswordAtLogon $true -Enabled $true
	</~~code~~>		</source>

	== Groups ==		== Groups ==

2013-05-28T21:49:14Z

Users: Added New-ADUser examples

@@ Line 26: / Line 26: @@
 == Users ==
 === AD Fields ===
 Field names don't necessarily match up between the PowerShell module, [[Acronyms#L|LDAP]], and what you see in the Users and Computers MMC GUI, see below for an in-exhaustive list...
@@ Line 67: / Line 51: @@
 | AccountPassword	|| 			|| 				|| If not set, new user account is disabled
 |}
 == Groups ==

2013-05-28T21:17:19Z

Get-ADGroups examples: Typo fix

← Older revision		Revision as of 21:17, 28 May 2013
Line 72:		Line 72:
	<source lang="powershell">		<source lang="powershell">
	$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group		$group = Get-ADGroup "Operations Supervisors" # Get the "Operations Supervisors" group
	$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security" -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU		$groups = Get-ADGroup -Filter 'GroupCategory -eq "Security"' -SearchBase "OU=Groups,DC=DOMAIN,DC=COM" # Get all security groups in the Groups OU
	</source>		</source>