Active Directory – Page 3

List the Active Directory deleted objects

With the cmdlet Get-ADObject you will be able to list the deleted objects in your Active Directory domain Pre-requesite : import-module activedirectory Script : Get-ADObject -Filter ‘isdeleted -eq $TRUE -and name -ne “Deleted Objects”‘ -IncludeDeletedObjects -Properties * | ` Format-List

Dump the user object DACL permissions

You will find below two methods to dump the user object DACL permissions in an Active Directory domain. Script (with Microsoft Active Directory module loaded : import-module activedirectory) : import-module activedirectory $pw = read-host “Enter password” -AsSecureString $cred = New-Object

Get all DCs in a forest and resolve hostname to IP address

With this script, you will be able to get all DCs in a forest and resolve the hostnames to IP addresses. Update 11.22.2016 The DNS Shell cmdlet is not necessary in a Windows 2012R2 environment. We can use the cmdlet

Active Directory backup check

This script will allow you to check the Active Directory backup date on all the domains of your forest. Each domain is checked by selecting a domain controller that is running the service ADWS (Active Directory Web Services). You can

Search an object forest wide

This script will search an object forest wide. The search is based on a LDAP filter. In my script, the result show the mail user attributes like “toto”. Script : #Get Domain List $objForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() $DomainList = @($objForest.Domains |

Active Directory Password complexity checker

If you have enabled the password complexity in your Active Directory domain through GPO, you probably have received complaints from the users : “I cannot find a password. Every time I try to enter a new password, a message indicates

Add/remove specific user based on AD attributes to/from a group

I have written this simple script to show you how to : work with a user account found with a specific Active Directory attribute (in the example, the attribute employeeID is used) add the user account to the group with

Calculate Kerberos token size

The authentication protocol within a Microsoft infrastructure since the Windows 2000 time frame has been Kerberos. The Kerberos token leverages a predefined buffer to house authorization requests. This predefined Kerberos buffer size is set by the MaxTokenSize setting found in

Password complexity checker

If you have enabled in your domain group policy the password complexity (see below), users will probably have some troubles to find the right password that meet these requirements. The complexity requirements are explained in the “Explain” tab of the

Check and update your GPOs for MS16-072

Description Due to the update MS16-072, you will have to check and update your GPO permissions. Why The following article describes very well why this update have changed our policy processing : After MS16-072 is installed, user group policies are