Category: Active Directory

I've been working with PowerShell since the version 1.0 days and I'm still amazed that I find cmdlets that I didn't know existed. Back in 2003, I had written some PowerShell code to query group policy for the lockout policy of an Active Directory domain. It used code similar to what's shown in the following example which requires the GroupPolicy PowerShell module that installs as part of the RSAT (Remote Server Administration Tools). I recently discovered that Read more [...]

How do you control password resets in your environment? I've worked for numerous companies where their forgotten password reset process was all over the board. Hopefully you have a process in place that allows you to sleep at night. Even with the best policies and procedures in place, what happens when someone on your help desk staff resets a users password to some default password and forgets to set the account so the password has to be changed at next logon? Is the user still using that default Read more [...]

I recently responded to a post in a forum about adding Active Directory users to groups with PowerShell based on information contained in a CSV (Comma Separated Values file format). I thought I would not only share the scenario and solution that I came up with but also elaborate on adding additional functionality that may be desired. In this scenario, you’ve been provided with a CSV file that contains a list of Active Directory users and the groups that they should be a member of as shown in Read more [...]

This week I'm sharing a couple of PowerShell functions that are a work in progress to nag those users who seem to never want to change their passwords. I can't tell you how many times the help desk staff at one of the companies that I provide support for receives a call from a user who is unable to access email or other resources on the intranet. The problem? They have run their password down to the point where they arrive in the morning, log into their computer without issue, and during the day Read more [...]

I recently ran across something interesting that I thought I would share. The help for the FilterHashTable parameter of Get-WinEvent says that you can filter by UserID using an Active Directory user account's SID or domain account name: Notice that the help also says the data key can be used for unnamed fields in classic event logs. I often hear the question wanting to know what the valid key pairs are for the hash table. As you can see, they're listed in the Read more [...]

In this blog article, I'll use PowerShell to install Active Directory Certificate Services in my test environment. The domain controller that's being used is running Windows Server 2012 R2 Server Core Installation (no-GUI). The workstation that I'm using is running Windows 8.1 and it is a member of the same Active Directory domain. Many times when I'm prototyping something on a single remote server, I'll use one to one remoting so that it's an interactive session. The Enter-PSSession cmdlet is Read more [...]

I recently saw a post on Reddit where someone was trying to create a function that takes an Active Directory user name as input for a manager who has direct reports (subordinates) specified in Active Directory. They wanted to determine if the Active Directory group membership of any of those subordinates is different than the others. There are two different parts to this scenario. Returning a list of the manager's direct reports by querying that property from the manager's user account in Active Read more [...]

I recently saw an article on how to set a users Active Directory display name based on the values of their given name, initials, and surname. I came up with my own unique solution for this task and thought I would share it with you, the readers of my blog. As you can see in the following example, there are a mixture of users who need their display name corrected based on the requirement that their display name be listed as "Givenname Initials Surname": I Read more [...]