msDS-parentdistname vs. parentGUID

Last week I wrote about mirroring an OU structure, from a source domain to a test domain, with the help of a couple of PowerShell scripts. The first script had to capture the distinguished name of the parent object of each OU found in the source domain. This would allow me to make sure that an equivalent parent object existed in the target domain before…


Use PowerShell and DSAMAIN.exe to Mount a Backup of NTDS.dit

A few weeks back I talked about using PowerShell to create a regular System State backup. Have a look here for more information. This week, I'd like to talk about using PowerShell and DSAMAIN.exe to have a look at the point-in-time state of the Active Directory data captured in a backup. This could help you ascertain if the System State…

3

One-Liner: My Take On Finding Stale User and Computer Accounts

Using PowerShell and information in Active Directory to identify 'stale' user or computer accounts is prone to inaccuracies. This is because there are many circumstances or technical nuances that can make the data unreliable. For example, think of a globe-trotting sales person, they (and their laptop) might not see the office for months, however, they both still remain company…

1

Security Focus: Find User Accounts Configured for DES Encryption

Once more, with feeling: extended support for Windows Server 2003 ends on July 14, 2015… Hopefully, you’ve already upgraded your domain controllers to at least Windows Server 2008 R2. If you haven’t, there are security enhancements to be aware of. Here’s more information: W2K3 to W2K8 and W2K8R2 Active Directory Upgrade Considerations   One of those enhancements is…

2

Active Directory Bulk User Modification

An old favourite! This is what automation is all about: making the tedious and the long-winded incredibly easy, and, dare I say, joyous! Your HR department gives you a dump of user names with email addresses and phone numbers to be updated in Active Directory. The dump is in the form of a CSV file and looks…

8