Category Archives: Active Directory

Reset User Account ACLs

The security for user account objects in an OU may drift over time. User accounts moved within the domain will retain delegations previously made, and user accounts created after schema extensions won’t have the same security as user accounts created … Continue reading

Posted in Active Directory, Alan's Favorites, My Best, PowerShell, Scripting, Security, Windows Administration | Tagged , , | Leave a comment

Report GPOs with Script References

How quickly can you answer this question:  Which Group Policies reference batch files, vbscripts, or PowerShells?  What is the best way to get the information and present it into a spreadsheet?  I did it by searching SysVol for the script.ini … Continue reading

Posted in Active Directory, Group Policy Objects, PowerShell, Scripting, Windows Administration | Tagged , | Leave a comment

Using Workflows to Multithread AD Queries

I am frequently called on for Active Directory reports for all domains in the forest.  This code shows you how to use a workflow to easily do this, adding the domain data into the results:

Posted in Active Directory, Functions, PowerShell, Scriptlets | Tagged , | Leave a comment

Launch the Group Policy Editor Outside the MMC

It is annoying that there isn’t a command line for the Group Policy Editor.  To edit a GPO you must 1) open the Group Policy Management Console, 2) Open the list of Group Policies, 3) select the GPO you want … Continue reading

Posted in Group Policy Objects, PowerShell, Scripting, Windows Administration | Tagged | Leave a comment

Getting GPO GUID, Name from Active Directory

You don’t have to rely on the Group Policy Module to resolve the display name of a GPO from the GUID, or the GUID from the display name.  Here are two short functions that will get that information from Active … Continue reading

Posted in Active Directory, Functions, Group Policy Objects, PowerShell, Scripting, Scriptlets | Tagged , , , | Leave a comment

Undelete-ADObject

Undelete-ADObject.ps1 is a GUI form based script for undeleting user, computer, group, print queue, and contacts from Active Directory.  You can display all of the objects of the selected type, or search by the name. I use this script frequently.  … Continue reading

Posted in Active Directory, Alan's Favorites, PowerShell, Scripting, Windows Administration | Tagged , | Leave a comment

Export and Import Delegated OU Permissions with PowerShell

There are some delegations of permissions within Active Directory which cannot be made without extra effort. Some properties are flagged as hidden in a file called Dssec.dat, in %windir%\System32 on computers with the Active Directory Users and Computers (ADUC) MMC. … Continue reading

Posted in Active Directory, Alan's Favorites, My Best, PowerShell, Scripting, Security, Windows Administration | Tagged , , , | Leave a comment

Clear GPO Cache on Remote Computer with PowerShell

Clearing the GPO cache on a computer may be the only way to fix a persistent problem.  Doing this involves deleting files, registry entries, and rebuilding the security database.  Clear-GPOCache.ps1 works by creating a custom batch file on the remote … Continue reading

Posted in Active Directory, Batch, Group Policy Objects, PowerShell, Scripting, Windows Administration | Tagged , | Leave a comment

Powershell Date LDAP filters

This snippet can be used for easier date formatting when using an LDAP date filter with PowerShell.  This demonstrates how to get users created within the previous 30 days using LDAP:

 

Posted in Active Directory, PowerShell, Scripting, Scriptlets | Tagged , | Leave a comment

OU of Current PC from anywhere in the Forest

There are a lot of ways to get the OU of the current computer, but most don’t work if you are outside your home domain. This code does, without requiring AD cmdlets:

Update: 9/23/2017: You can also get this … Continue reading

Posted in Active Directory, Scripting, Scriptlets | Tagged , | Leave a comment