Scripting | Tidbits of Information from Virot

Reverting the AdminSDHolders changes

2016-07-26 by virot · Leave a Comment

So everyone knows what the AdminSDHolders does. Okey lets do a short version of that too.

The AdminSDHolder is what is that then.

Well windows has a few “protected” groups and users. If you are a member of one of these protected groups, Windows will do a few things every 60 minutes by default.

Set the AdminCount property of a user to 1
Disable inheritance on the user object
Set the rights on the user objects to a reduced set

This is an extremely simplified version. For more information please read in the Technet article AdminSDHolder.

Users and groups that by default are managed by the AdminSDHolder

Name	Type
Administrator	User
Account Operators	Group
Administrators	Group
Backup Operators	Group
Cert Publishers	Group
Domain Admins	Group
Domain Controllers	Group
Enterprise Admins	Group
Krbtgt	User
Print Operators	Group
Read-only Domain Controllers	Group
Replicator	User
Schema Admins	Group
Server Operators	Group

[Read more…]

Filed Under: Directory Services, Scripting · Tagged With: Active Directory, AD:DS, AdminSDHolder, FSMO, PDCEmulator, powershell

Remember who you are in a powershell window

2016-04-11 by virot · Leave a Comment

So sometimes you run the same command so many times that you want it run at every time you start a powershell windows.

There are several profiles that can be loaded depending on how powershell is started. And there are also global policies for all users of a computer.

Variable
$PROFILE.AllUsersAllHosts
$PROFILE.AllUsersCurrentHost
$PROFILE.CurrentUserAllHosts
$PROFILE.CurrentUserCurrentHost

AllHosts are run for all types of Powershell, both regular console and ISE sessions. CurrentHost runs just for that specific so you can have different settings for ISE and console sessions.

The basic structure for the profiles are:

Locations:
- Current user: “$([environment]::getfolderpath(“mydocuments”))\WindowsPowerShell”
- All users: “$($env:systemroot)\System32\WindowsPowerShell\v1.0\”
Filenames:
- All types: profile.ps1
- Console: PowerShell_profile.ps1
- ISE: PowerShellISE_profile.ps1

Since I am usually have more than one powershell at a time running with alternative credentials I had a hard time remember which windows was which. Of course I could have just run “whoami”, but that is also more work than needed. So I decided that placing the Username in the title was the way to go. This is also a good place to place other functions that you have written and you call all the time.

powershell with domain-username [Read more…]

Filed Under: Scripting · Tagged With: powershell

Remove old domain from Exchange objects

2016-03-07 by virot · Leave a Comment

Most companies have domains in their exchange that they aren’t actively using but keep for legacy reasons. One of my customers wanted to clear out an old domain from all objects since they started to get spam on those addresses. So there are to simple solutions:

Remove the domain from AcceptedDomains
Remove the domain from EmailAddressPolicy / All objects

They choose to go down road 2. They have very few EmailAddressPolicies we opted that they clean out the policies them self and I wrote a script to clean out the objects.

[Read more…]

Filed Under: Directory Services, Scripting · Tagged With: Exchange

Check state of CRL checking.

2015-11-03 by virot · Leave a Comment

Okey I had the need to check what values were set for the Software Publishing “State”. This is the registry value where Windows stores if it should do CRL revocation check or say all okey even if the CRL is unavailable. And some other stuff. I found all the values on the MSDN page WintrustGetRegPolicyFlags. So I wrote a small Powershell function to help decode it.

Example of running Get-WintrustGetRegPolicyFlags

And here is the function: [Read more…]

Filed Under: Scripting · Tagged With: Certificates, CRL, MSDN, QuickFix

An extra 100ns for free?

2015-10-26 by virot · Leave a Comment

So I was reading up on the AD Module filters. I found a thing, Microsoft usually says keep it simple. I found an over complex way of initializing a date variable. So what did the documentation suggest:

$date = new-object System.DateTime -ArgumentList @(2007,1,1,0,0,0)

1	$date = new-object System.DateTime -ArgumentList @(2007,1,1,0,0,0)

Whoa.. Yes you can use .NET but if possible use Powershell cmdlets. Do we have any cmdlet we can use? Get-Date. Get-Date can be initialized with year, month and day.

$date2=Get-Date -Year 2007 -Month 1 -Date 1

1	$date2=Get-Date -Year 2007 -Month 1 -Date 1

That looks easier to read so it is better. But are they the same. And they arent. So what is the difference? Let’s convert it to the FileTime structure.

PS C:\> $date -eq $date2
False
PS C:\> $date2.ToFileTime()
128120796000000001
PS C:\> $date.ToFileTime()
128120796000000000

PS C:\> $date -eq $date2

False

PS C:\> $date2.ToFileTime()

128120796000000001

PS C:\> $date.ToFileTime()

128120796000000000

Here we see that we get a 100-nanosecond difference. Im not really sure why. But now we know that if you want the real 12am you cant use Get-Date. As it will add a 100ns extra. Bonus link to MSDN article for DateTime Structure.

Filed Under: Scripting · Tagged With: datetime, Get-Date, oneliner, powershell

Updating AD group membership if the user has a mobilenumber

2015-10-22 by virot · Leave a Comment

Background:

So I was at a customers location and well we got talking about scripts. They had the need for a script that populates a group if the user has a cellphone number configured and remove him the number is removed after.
They had already a script that did it. The script did what was needed but I felt there was room for improvement, so I got rid of a try catch where the catch was empty. That is just as bad as ON ERROR RESUME NEXT from the old VBScript days. Anyway I thought later there has got to be a better way of doing this.

The old way:

This is a compressed version written from memory.

Get-ADUSer -Filter {mobile -ne ''}|{Try{Add-AdgroupMember -Identity GroupA -Member $_}Catch{}}
Get-ADGroupMember GroupA|Get-ADUser -properties mobile|Where{$_.mobile -eq $Null}|ForEach{Remove-ADGroupMember -Identity GroupA -Members $_}

1 2	Get-ADUSer -Filter {mobile -ne ''}\|{Try{Add-AdgroupMember -Identity GroupA -Member $_}Catch{}} Get-ADGroupMember GroupA\|Get-ADUser -properties mobile\|Where{$_.mobile -eq $Null}\|ForEach{Remove-ADGroupMember -Identity GroupA -Members $_}

The improved way:

So why not just be happy. Well there is still performance improvements and let the DC do the heavy lifting. Lets start using LDAPFilter.

$GroupDN=Get-ADGroup GroupA|Select-Object -ExpandProperty DistinguishedName
#Start by adding all members that have a mobile number but not member of the group.
Add-ADGroupMember -Identity $GroupDN -Members (Get-ADUser -LDAPFilter "(&(mobile=*)(!(memberof=$GroupDN)))")
#Then remove all group members that dont have a mobile number.
Remove-ADGroupMember -Identity $GroupDN -Members (Get-ADUser -LDAPFilter "(&(!(mobile=*))(memberof=$GroupDN))") -Confirm:$False

$GroupDN=Get-ADGroup GroupA|Select-Object -ExpandProperty DistinguishedName

#Start by adding all members that have a mobile number but not member of the group.

Add-ADGroupMember -Identity $GroupDN -Members (Get-ADUser -LDAPFilter "(&(mobile=*)(!(memberof=$GroupDN)))")

#Then remove all group members that dont have a mobile number.

Remove-ADGroupMember -Identity $GroupDN -Members (Get-ADUser -LDAPFilter "(&(!(mobile=*))(memberof=$GroupDN))") -Confirm:$False

But I only want user from one part of my AD

Okay so now we got new requirements of course but that is really simple. Lets just instruct the Get-ADUser to search only in one part using SearchBase.

Get-ADUser -Searchbase 'OU=Company,DC=domain,DC=tld' -LDAPFilter .....

1	Get-ADUser -Searchbase 'OU=Company,DC=domain,DC=tld' -LDAPFilter .....

So just add the searchbase parameter and path.

Filed Under: Directory Services, Scripting · Tagged With: Active Directory, oneliner, powershell

GUID Endian Converter

2015-04-07 by virot · 1 Comment

What is a GUID

First lets check what Microsoft says about the GUID:

“GUIDs are the Microsoft implementation of the distributed computing environment (DCE) universally unique identifier (UUID)”

Well what is a UUID then? Lets check RFC4122:

This specification defines a Uniform Resource Name namespace for
UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally
Unique IDentifier). A UUID is 128 bits long, and can guarantee
uniqueness across space and time. UUIDs were originally used in the
Apollo Network Computing System and later in the Open Software
Foundation’s (OSF) Distributed Computing Environment (DCE), and then
in Microsoft Windows platforms.

So now we know that the GUID is a value which should be unique (there is not such thing as a guaranteed unique since there is no central authority). So lets check how the GUID is built and why this entry is needed.

Structure of a GUID

Lets look at a sample GUID ED7BA470-8E54-465E-825C-99712043E01C. Here there is a small difference between the UUID and the GUID specification, but it does not change anything. Both start using one 32bit Unsigned Integer followed by two 16bit Unsigned Integers. Then the UUID is specified as two 8bit Unsigned Integers followed by 6 bytes. Where as the GUID is specified as 8 bytes. But it does nothing to change the problem or the solution so lets leave it as 8 bytes.

The problem

RFC4122 specifies that the GUID must be precented as big endian but Intel processors are little endian. This is where the problem comes from. There are some applications that read the GUID in little endian format and store it as a string which does not do the little to big endian conversion by magic. In these cases you need to use a cmdlet as mine to convert between the endian formats. [Read more…]

Filed Under: Scripting · Tagged With: Active Directory, Globally unique identifier, powershell, UUID

Get the SID of all domains in a forest

2015-02-23 by virot · 1 Comment

I got a request from a system owner what was the SID of the domain since their license was bound to the domain SID. The Domain SID is not really that is going to change and its really unlikely that anyone will collide with yours, so not really a bad choice.

Anyways if you have the Active Directory Powershell module its really easy to do this. Without the AD Powershell module its not really that hard either, but Im lazy when the three latest published versions of Windows has the modules available I feel that I can skip doing it the long way.

Lets continue with the show:

PS C:\Users\virot> Import-Module ActiveDirectory
PS C:\Users\virot> (Get-ADForest).Domains| %{Get-ADDomain -Server $_}|select name, domainsid
name                                                                          domainsid
----                                                                          ---------
test                                                                          S-1-5-21-15748454-485475757-1574545454
subdomain                                                                     S-1-5-21-4545185484-4581287845-1575484548
another                                                                       S-1-5-21-1112151888-844548645-148348348

PS C:\Users\virot> Import-Module ActiveDirectory

PS C:\Users\virot> (Get-ADForest).Domains| %{Get-ADDomain -Server $_}|select name, domainsid

name domainsid

---- ---------

test S-1-5-21-15748454-485475757-1574545454

subdomain S-1-5-21-4545185484-4581287845-1575484548

another S-1-5-21-1112151888-844548645-148348348

And there we go, easy as 1-2-3

Filed Under: Directory Services, Scripting · Tagged With: Active Directory, powershell, Security Identifier

Managing tombstone lifetime with AD cmdlets

2015-02-17 by virot · Leave a Comment

So the first question might be why should I even care about this. I have heard things like “I am running Windows version xxx, so I have a tombstone life of 180 days.”. This might not be the case, the tombstone lifetime is set at the time of the promotion of the first domain controller in the forest. So okey if you have have an old forest running on a new Windows version you cant be sure that the tombstone life what you want. To make things a bit more silly, Microsoft decided during Windows 2003 to increase the value from the default of 60 days to 180 days. Jane Lewis wrote a Technet blog about this in 2006, but this is still an area where you can find forests which still run with a 60 day tombstone lifetime. Microsoft has a nice article about this, but I like powershell instead of dsquery.

How to read the current Tombstone lifetime

Import-Module ActiveDirectory
$ConfNameContext = Get-ADRootDSE | Select-Object -Expandproperty configurationNamingContext
Get-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,$ConfNameContext” -properties tombstonelifetime |Format-List

Import-Module ActiveDirectory

$ConfNameContext = Get-ADRootDSE | Select-Object -Expandproperty configurationNamingContext

Get-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,$ConfNameContext” -properties tombstonelifetime |Format-List

If no value..Note the value in the Value column. If the value is <not set>, the value is 60 days. [Read more…]

Filed Under: Directory Services, Scripting · Tagged With: Active Directory, powershell

Powershell and newlines

2015-02-12 by virot · Leave a Comment

So I was doing some scripting and and after a while the code got a bit bigger than just one line. So I decided it is time to bring out the big guns enter PowerShell Integrated Scripting Environment (ISE). So I copied the oneliner that was working perfectly into the ISE and noticed that it wasn’t working anymore. So what black magic was changing what I just had copied and pasting into the ISE.

$array = ('Row1
Row2
Row3').split()
$array.count

$array = ('Row1

Row2

Row3').split()

$array.count

So after a bit of research I found out the following logic.

When running by just inserting the text into a Powershell window everything is great. When I tried both just executing a ps1 file or from the ISE I got the following results:

[Read more…]

Filed Under: Scripting · Tagged With: ASCII, carriage return, line feed, powershell, powershell_ise, split

Reverting the AdminSDHolders changes

The AdminSDHolder is what is that then.

Users and groups that by default are managed by the AdminSDHolder

Remember who you are in a powershell window

Remove old domain from Exchange objects

Check state of CRL checking.

An extra 100ns for free?

Updating AD group membership if the user has a mobilenumber

Background:

The old way:

The improved way:

But I only want user from one part of my AD

GUID Endian Converter

What is a GUID

Structure of a GUID

The problem

Get the SID of all domains in a forest

Managing tombstone lifetime with AD cmdlets

How to read the current Tombstone lifetime

Powershell and newlines

Recent Posts

My other presence

Tools

archives

The AdminSDHolder is what is that then.

Users and groups that by default are managed by the AdminSDHolder

Background:

The old way:

The improved way:

But I only want user from one part of my AD

What is a GUID

Structure of a GUID

The problem

How to read the current Tombstone lifetime

Recent Posts

My other presence

Tools

archives

Tags