Reset User Account ACLs

The security for user account objects in an OU may drift over time. User accounts moved within the domain will retain delegations previously made, and user accounts created after schema extensions won’t have the same security as user accounts created earlier in time. Reset-UserAccountACLs.ps1 resets the security (ACLs) for user accounts within an OU to the defaults for a new user in that OU. It works by creating a temporary user object, copying the permissions, and applying those permissions to existing users withing the OU.

You choose the domain and OU from a GUI. I use a RemoteAD drive to get and set ACLs in remote domains. Test mode will create a report with no changes made.

Script Text
Posted in Active Directory, Alan's Favorites, My Best, PowerShell, Scripting, Security, Windows Administration | Tagged , , | Leave a comment

Report GPOs with Script References

How quickly can you answer this question:  Which Group Policies reference batch files, vbscripts, or PowerShells?  What is the best way to get the information and present it into a spreadsheet?  I did it by searching SysVol for the script.ini and psscript.ini files, then reading the contents for the script path, command line and parameters.  If you have to answer this question for an auditor or your boss, then Get-GPOScriptList.ps1 is what you need.

Note that the output CSV file is Unicode.  With this bit of code,  $paramVal.Replace('"','').Replace('-',[char]0x2013) , I replace dashes in parameters with the unicode em dash. This ensures that Excel doesn’t try to interpret the text line as a negative number. The spreadsheet contains the following columns: Domain, GPOName, Type, FilesInSysVol (are they present), LogonCmdLine, LogonParams, LogoffCmdLine, LogoffParams, StartUpCmdLine, StartUpParams,ShutdownCmdLine, ShutdownParams, GPOGUID, ScriptFolder, Remarks, and Errors.

Script Text
Posted in Active Directory, Group Policy Objects, PowerShell, Scripting, Windows Administration | Tagged , | Leave a comment

Using Workflows to Multithread AD Queries

I am frequently called on for Active Directory reports for all domains in the forest.  This code shows you how to use a workflow to easily do this, adding the domain data into the results:

Posted in Active Directory, Functions, PowerShell, Scriptlets | Tagged , | Leave a comment

Launch the Group Policy Editor Outside the MMC

It is annoying that there isn’t a command line for the Group Policy Editor.  To edit a GPO you must 1) open the Group Policy Management Console, 2) Open the list of Group Policies, 3) select the GPO you want to edit then 4) launch the editor – I right click and select ‘edit’.

A quick Google search led me to an article, with an interesting way to launch the editor discovered by looking at the command line of the task manager.  My script, Edit-GPO.ps1, opens an input box to specify the GPO.  The box accepts the GUID or the DisplayName.  You can type ‘list’ go open a list of all available GPOs in Out-Gridview.  Naturally, this PowerShell script requires the GroupPolicy module.

Script Text
Posted in Group Policy Objects, PowerShell, Scripting, Windows Administration | Tagged | Leave a comment

Delete User Profiles Interactively with PowerShell

Last week, one of my administrators was complaining at how involved it was to remove a profile on a remote user’s computer. A little over two years ago, I wrote Delete Inactive Profiles, as a substitute for DelProf for post Windows XP OS.  That script is an advanced function, and was designed to remove stale profiles from shared, common computers running periodically as a task, or with SCCM.  But this script really isn’t a good way to selectively delete remove user profiles.

Sometimes “blowing away” the user’s profile is a quick way to fix quirky problems from corrupted settings. Delete-UserProfiles.ps1 was written based on the code of the previous script.  It prompts you for the FQDN of the remote computer, then lists the user profiles on the remote computer with inactivity days in Out-Gridview, where you can choose which to delete.  The user name is resolved using the [adsi] accelerator and the SID LDAP binding syntax.  You are reminded that you need to be an administrator on the remote computer if you aren’t an administrator on the machine you are running the script from.  The profile is deleted using the delete function of WMI win32_userprofile.

No profiles are deleted without a confirmation.

Script Text
Posted in PowerShell, Scripting, Windows 10, Windows 7, Windows 8, Windows Administration, WMI | Tagged , | Leave a comment

Getting GPO GUID, Name from Active Directory

You don’t have to rely on the Group Policy Module to resolve the display name of a GPO from the GUID, or the GUID from the display name.  Here are two short functions that will get that information from Active Directory. The first will return the GPO displayname attribute from a GUID. The GUID (sometimes called the ID), can be entered with or without the surrounding curly brackets.

The second function does the reverse, returning the GUID from the DisplayName:

The domain parameter should be the DNS Domain root, not the NetBIOS or short name.

Posted in Active Directory, Functions, Group Policy Objects, PowerShell, Scripting, Scriptlets | Tagged , , , | Leave a comment


Undelete-ADObject.ps1 is a GUI form based script for undeleting user, computer, group, print queue, and contacts from Active Directory.  You can display all of the objects of the selected type, or search by the name. I use this script frequently.  It has a test mode, plus logging.

Script Text
Posted in Active Directory, Alan's Favorites, PowerShell, Scripting, Windows Administration | Tagged , | Leave a comment

Sort Clipboard Text with PowerShell

Sort-ClipText.ps1 reads the text in your clipboard, sorts it, and creates a new sorted item in your clipboard.  Note that the split statement is a regular expression.  The pipe character represents the logical OR.  I also used splitstringoptions to remove the empty lines after sorting.

Script Text

Posted in PowerShell, Scripting | Tagged | Leave a comment

Export to Textbox with Out-TextBox

Out-TextBox.ps1 is an advanced function which outputs object to a resizable text box for display.  Not much more I can say about it, except that you can copy the text in the box.

Script Text
Posted in Functions, PowerShell | Tagged | Leave a comment

Get-ADSystemInfo – Wrapping the ADSystemInfo ComObject

When I was writing in vbscript, I often used the ADSystemInfo ComObject.  It is a quick and easy way to get these properties:  Current user’s distinguished name, Current computer’s distinguished name, the site name, the Domain short (NetBIOS) Name,  the domain DNSName,  the forest DNSName,  the PDC Role Owner,  the Schema Role Owner, and whether the domain is running in Native Mode.  The script on TechNet doesn’t “marshall” (cleanup) after the Com object is used.  My version, Get-ADSystemInfo.ps1, makes this an advanced function with the proper cleanup.

Script Text
Posted in Functions, PowerShell, Scripting | Tagged , , | Leave a comment