Active Directory (PowerShell): Difference between revisions

From vwiki
Jump to navigation Jump to search
m (→‎Get-Users examples: Added further example)
m (STILL DRAFT: Minor update)
Line 40: Line 40:
$users | Select-Object Name, Enabled, CanonicalName, Country, Created, LastLogonDate, mail | export-csv -Path users.csv
$users | Select-Object Name, Enabled, CanonicalName, Country, Created, LastLogonDate, mail | export-csv -Path users.csv
</source>
</source>
* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers
== Computers ==
=== <code>Get-ADComputer</code> examples ===
<source lang="powershell">
$devices = Get-ADComputer -Filter * -SearchBase "DC=domain,DC=com" -Properties IPv4Address, OperatingSystem,  Created, LastLogonDate
</source>
* '''LastLogonDate''' - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers


== Errors ==
== Errors ==

Revision as of 21:26, 1 May 2013

Getting Started

You need to have RSAT (Remote Server Administration Tools) installed For Windows 7 see - http://www.microsoft.com/en-gb/download/details.aspx?id=7887. This enables your local machine to remotely manage Windows Servers and Services via the usual MMC GUI's (eg AD Users and Computers) and (most importantly) includes PowerShell modules in order to be able to do so as well.

Be aware that PowerShell DFS management is currently poor, its only possible from Windows 8 and 2012 machines, and even then its very limited.

Once installed go to Control Panel | Programs | Turn Windows features on or off and enable the PowerShell module, full path as follows...

  • Remote Server Administration Tools | Role Administration Tools | Active Directory Module for Windows PowerShell

In order to be able access the PowerShell Active Directory CmdLets, import the AD module into your PowerShell session...

Import-Module ActiveDirectory

Group Policy

The PowerShell GPO module is installed with

In order to be able access the PowerShell GPO CmdLets, import the GPO module into your PowerShell session...

Import-Module GroupPolicy

Users

Get-ADUser examples

$users = Get-ADUser -Filter * -SearchBase "DC=domain,DC=com"                           # Get all users in domain.com
$user = Get-ADUser -Filter {SamAccountName -eq "username"}                             # Get user by logon/SAM account name
$user = Get-ADUser -Filter {SamAccountName -eq "username"} -Properties *               # Get all properties for user
$user = Get-ADUser -Filter {{Surname -eq "last" -and GivenName -eq "first"}}           # Get user by first and last names
$users = Get-ADUser -Filter * -SearchBase "OU=London,OU=Users,DC=EU,DC=domain,DC=com"  # Get users in London OU

To create a CSV export of fields from AD...

$users = Get-ADUser -Filter * -SearchBase "DC=DOMAIN,DC=COM" -Properties Enabled, CanonicalName, Country, Created, LastLogonDate, mail
$users | Select-Object Name, Enabled, CanonicalName, Country, Created, LastLogonDate, mail | export-csv -Path users.csv
  • LastLogonDate - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers

Computers

Get-ADComputer examples

$devices = Get-ADComputer -Filter * -SearchBase "DC=domain,DC=com" -Properties IPv4Address, OperatingSystem,  Created, LastLogonDate
  • LastLogonDate - Be aware that the last logon date field typically has an accuracy/tolerance of 14 days, AD intentionally doesn't update the field at every logon from the user/device object so as to reduce the amount of data replication between domain controllers

Errors

Command Examples

Managing Multiple Domains

Unless you've specified otherwise, commands will be handled by the domain identified by ...?

Use -Server and -Credentials options, available for all PowerShell AD commands, to specify the DC and credentials required to service the commands.