Tuesday, May 26, 2015

Active Directory automation : copy users from a group to another and modify attributes

I didn't know Powershell and someone asked me to copy users from a group to another. We are talking of about 300 users.......Impossible to do it manually.
They asked also to modify (I remember this was the wrong day for me), for those users, the "Dial-in tab" in Active Directory (for Radius authentication).
After some search I found dsmod, dsget and an interesting VBScript that I've adapted to my environment.
This is what I've done :

Exchange 2003 & mailbox queries.....no powershell

We needed to query AD from Exchange 2003. We know that this version is not fully "queriable" by powershell.
I'd to understand how to retrieve some important information. We had for example an archiving system that use the group membership to "understand" if your mailbox is "storable" or not.
I took the opportunity also to grab other useful info .....let's see
Why don't use AD query tool ?

So let's do some queries to understand the structure.

Powershell associate users to pcs for the entire domain

Let's start saying that when I write a script I try not only to achieve the goal but I also try  to test some specific cmdlets, even if in this specific script use this cmdlet is not the best way to do a task.
So for sure the series "Complex, improvable, optimizable"  doesn't want to be the BEST SCRIPT ever written for the purpose, but something to do a task and, for sure, improvable.
This was a sort of introduction....let's go ahead with it.

We didn't have a software that make this association....I mean a software with an agent that communicates periodically all info about every single pc on the status, software or accounts.
We need to know, more or less, in real time which user is logged on a pc.
This is a time expensive operation to do with Powershell : for each single pc we need to wait for the WMI connection. Let's imagine for hundreds of them.
So since the users don't change pc every day (this could be a real hell) I decided to create an excel file that could periodically be refreshed, but till the refresh it will be available to be queried.

So the script asks you if you want to refresh the file. Obviously if the file doesn't exist you have to reply YES to create it the first time.
This is the long part of the task : the script will search in the entire directory and "scan" every single pc to retrieve computername and username.

If you don't want to scan and refresh the script asks you another question : if you want to search on the local file or a targeted search. The targeted search was something that I wrote because the Sites in our AD corresponds to a dedicated OU. So I can launch a search in a restricted environment and abbreviate the response time (and additionally make the search in "live mode" instead of query the "static" file)

Monday, May 25, 2015

Powershell discover who's connected to a specific pc

Hi mate,
several times I needed to associate a username to a pc because having this info, in special in a little company, you can understand/remind the specific needs of this user and act consequently.
Here you have a quick response to your needs

Powershell search and unlock AD accounts

Hello,
sometimes during the week-end, in the factory, a user can be locked out. Maybe this is a big problem because they have to go ahead fastly  (i.e. trucks are waiting for a document and they cannot print it due to this situation).
You are in the middle of the mountain without your mobile phone or maybe you are sleeping because last night ....... anyway I had the need to unlock the account automatically and take track of this.