Active Directory Administration (cmdlets)

1. Active Directory Administration (cmdlets) Microsoft Confidential

2. AD (cmdlets) • AD PowerShell Module named ActiveDirectory • Self-contained package • Consolidates a group of cmdlets • Cmdlets used to manage one or multiple AD forests and domains • AD Module | Overview Microsoft Confidential

3. AD (cmdlets) • Account • User • Computer • Group • OU • Password Policy • Default domain password policy • Fine-grained password policy • Forest & Domain • DC & FSMO • Optional Features • AD Module | Purpose Microsoft Confidential

4. AD (cmdlets) • Cmdlets Microsoft Confidential

5. AD (cmdlets) • At least one 2008 R2 DC in the targeted domain OR • A 2003 or 2008 DC running the Active Directory Management Gateway Service • Client: Windows 7 or Windows Server 2008 R2 • Windows 7: Remote Server Administration Tools + AD Module Feature • Windows 2008 R2: AD Module via Add Features Wizard • Import and use the AD module in a PowerShell session via the Import-Module cmdlet • AD Module Prerequisites Microsoft Confidential

6. AD (cmdlets) • Active Directory Web Services Windows 2008 R2 ADWS Windows 7 RSAT AD Module Microsoft Confidential

7. AD (cmdlets) • Binding to AD DN is required to work with AD objects • Cmdlets connect to local domain using current user credentials by default • All 76 cmdlets have credential & server parameters • To target other domains & specific servers • Global Catalog connection possible using Port # • Connecting To AD Get-ADUser –filter * -server contoso.com:3268 TIP: Do not hardcode DC names in scripts! (Use Domain FQDN to discover DC) Microsoft Confidential

8. AD (cmdlets) • User Account Management | AD Cmdlets Create User New-ADUser –name benp -SamAccountName “benp" -GivenName “ben" -Surname “Pearce" -DisplayName “Ben Pearce" Enumerate User Get-ADUser -Filter * -Properties * Get-ADUser -Filter * ` -Properties *,msDS-ReplAttributeMetaData Set-ADUser -Identity “benp" –Title “Engineer" Modify User Target Single AD Object Only! Delete User Remove-ADUserbenp Microsoft Confidential

9. AD (cmdlets) • Computer Account Management | AD Cmdlets Computer Information Get-ADComputer -Filter * ` -property name,OperatingSystem,` OperatingSystemServicePack,OperatingSystemVersion ` | Out-GridView Find Stale Computer Accounts $OneYearAgo = (Get-Date).AddYears(-1) Get-ADComputer -Filter {LastLogonTimeStamp –lt` $OneYearAgo} | Disable-ADAccount Microsoft Confidential

10. AD (cmdlets) • Group Management | AD Cmdlets Enumerate Group Nested group membership Get-ADGroupMember IT -Recursive Create Group New-ADGroup –name “Sales” ` -Path “OU=Groups,DC=Contoso,DC=com” ` -GroupScope “Global” ` -GroupCategory “Security” To return group object $newGroup = New-ADGroup -name "IT" ` -Path "OU=Groups,DC=Contoso,DC=com" ` -GroupScope "Global" –passthru $ITUsers = Get-ADUser -filter {Department -eq "IT"} Add-ADGroupMember -Identity $newGroup -Members $ITUsers OR $ITUsers | Add-ADPrincipalGroupMembership -MemberOf "IT" Populate Group Microsoft Confidential

11. DEMO