PowerShell/Active Directory - Retrieve Groups managed by a User

I recently had an interesting request at work:
Finding a way to list all the groups a specific user was managing.

If you look into the properties of an Active Directory group object, you will find under the tab "ManagedBy" the name of a user or group who is managing the group and possibly its members if the "Manager can update membership list" is checked.

Group object properties / Managed By tab

This is nice for one group.... what if the user manage tons of them ?

PowerShell - Get a list of my domain Organizational Units

Quick post, last week my coworker Andrey needed to list all the Organization Units in the domain by Canonical Name. I thought sharing the PowerShell One-Liner magic could save time to some people out there.

In the following examples two methods to retrieve the information using Active Directory and ADSI/NET.

Active Directory Module

I found two ways to get this information using this module

• Get-ADOrganizationUnit
• Get-ADObject

First we need to verify if the module is loaded and then search for Cmdlet that could meet our needs.

# Check if the ActiveDirectory module is Loaded
Get-Module -Name ActiveDirevtory

# Check if the ActiveDirectory module is available
Get-Module -Name ActiveDirectory -ListAvailable

# Import the ActiveDirectory module
Import-Module -Name ActiveDirectory

# Find Cmdlets in the ActiveDirectory related to OrganizationalUnit
Get-Command -Module ActiveDirectory -Name *OrganizationalUnit*

PowerShell - Find Inactive Computers in Active Directory with ADSI

Today I wanted to retrieve inactive computer accounts in the Active Directory without using the Quest Active Directory Snapin or the Active Directory Module. Yes... It happens that you work on a computer that don't have those tools once in a while, and I thought It would be fun to have a script without requirements...

Note: BTW, the following solution might not be the best or most efficient, so let me know if you know a faster/easier way to do this, I'm willing to learn more about querying AD.

Here are the key element of the script, I want:

• Computer Inactive for >=90 days
• Be able to specify a SearchRoot
• Filter on the Operating System if possible (I want only Windows Servers, without the Domain controllers for example)
• Return SamAccountName, Name, DN, Operating System, and Description
• Limit the number of object to return (can be useful for large environment)

PowerShell - Add AD Site Subnet

Last month I posted a script that report the Missing Subnets from the Active Directory. The script goes on each Domain Controllers and get the last x entries from the NETLOGON.log file.
Once this report is generated, you might want to check with your Telecom guy/team to get the correct network mask, correct site of each entries and fix this situation.

Reminder: Subnet objects (class subnet) define network subnets in Active Directory. A network subnet is a segment of a TCP/IP network to which a set of logical IP addresses is assigned. Subnets group computers in a way that identifies their physical proximity on the network. Subnet objects in Active Directory are used to map computers to sites.

Today I will show how to add those missing subnets in your Active Directory using PowerShell on Windows Server 2012 and Previous versions via ADSI.

PowerShell - Get-DomainComputer (ADSI)

The following function use ADSI to query Computer objects from the Active Directory. Optionally an alternate credentials and/or a different domain can be specified.

Once in a while, everyone "enjoy" doing Auditing at work...,ok maybe not everyone :-).... so last week, an colleague of mine needed to get the name of the Primary user of each workstations that connect to one of their critical application.

Lucky for me, first he had the list of workstations and second we have the name of the primary user information in the Active Directory located in the description property ! :-) (This is added when the computer is built and joined to the domain the first time).

So he asked me if I could help and get this information somehow. My answer was obviously ... PowerShell!
This could be done very easily using the ActiveDirectory Module but unfortunately RSAT (Remote Server Administrator Tools) feature was not installed on his computer. Why not use ADSI then ? :-)

PowerShell - Using ADSI with alternate Credentials

The following PowerShell code will show you how to run ADSI with alternate credentials to get information from the Active Directory.

I will query Group objects in this example, my filter is define by the following line: "(objectCategory=Group)"

PowerShell - Get-DomainUser

Today one of my IT coworkers, in another department, sent a couple of emails to the Ops to get the username (SamAccount) from a couple of Active Directory users accounts. This guy, which is not familiar with AD, had only the DisplayName properties information.

I wrote him back that he could just request RSAT(Remote Server Administration Tools) to be installed on his workstation or just use this small PowerShell that I just wrote in minutes. Since Active Directory does not require any specific permission to access this kind of information. Here is the code, nothing advanced, but it does the work ;-)

function Get-DomainUser {

    PARAM($DisplayName)

    $Search = [adsisearcher]"(&(objectCategory=person)(objectClass=User)(displayname=$DisplayName))"

    foreach ($user in $($Search.FindAll())){

        New-Object -TypeName PSObject -Property @{

            "DisplayName" = $user.properties.displayname

            "UserName"    = $user.properties.samaccountname

            "Description" = $user.properties.description}

    }

}

Result

PS C:\> Get-DomainUser -DisplayName "jonathan*" | Format-List

UserName    : {JonathanD}
Description : {Account of Jonathan Delpiero}
DisplayName : {Jonathan Delpiero}

UserName    : {DumoulinJ}
Description : {Account of Jonathan Dumoulin}
DisplayName : {Jonathan Dumoulin}

Scripting Games 2013 - Advanced Event 4 - An Auditing Adventure

This is my solution for the Advanced Event 4 of the Scripting Games 2013.
This event was a bit challenging for me... In the past, I played with Quest Active Directory snap-in to create a bunch of Monitoring tools and some other small automation tasks, but that's about it. (Example Monitor Active Directory Groups membership change).

Let's see how I solved it.