TechOnTip Weblog

Run book for Technocrats

Posts Tagged ‘ADUserManagement’

Stale Computer Accounts

Posted by Brajesh Panda on July 23, 2012

Below script will help us to determine if the computer account is a stale account. I have “Quest Active Roles Management Shell for Active Directory”.

I am importing computer names from computers.txt; Using Quest PowerShell cmdlet to select specific required attributes, calculating & sorting as per password. Lastly exporting to CSV file.

Get-Content .\computers.txt | ForEach {Get-QADComputer -IncludeAllProperties $_ | select name, pwdlastset, lastLogonTimestamp, @{n=”PWAge”;e={((get-date)- $_.pwdLastSet).days}}, whencreated, WhenChanged, operatingSystem, operatingSystemVersion, dNSHostName, distinguishedName, Guid, Sid} | sort PWAge -desc | Export-Csv cmp1.csv -NoTypeInformation –Force

Search Active Directory for stale computer accounts which didn’t report from last 90days;

$StaleAge = (Get-Date).AddDays(-90)
Get-QADComputer -IncludeAllProperties -SizeLimit 0 | where {$_.pwdLastSet -le $StaleAge -and $_.operatingSystem -notlike “*Server*”} |select name, AccountIsDisabled, pwdlastset, lastLogonTimeStamp, @{n=”PasswordAge”;e={((get-date)- $_.pwdLastSet).days}}, whencreated, WhenChanged, operatingSystem, operatingSystemVersion, dNSHostName, ParentContainer | sort ParentContainer -desc | Export-Csv -NoTypeInformation c:\StaleComputerAccounts.csv

“-notlike” filters server operating sytem computer accounts

“AccountIsDisabled” shows which computer accounts are already disabled.

If you have large number of computer accounts; it is going to take a while. So you may like to send the output using a mail script;  Make sure your mail server can relay mails from the machine where you are running/scheduling the script

Send-MailMessage –From “brajesh@contoso.com” –To “support@contoso.com” –Subject “Stale Computer Accounts (Workstations)” –Body “Find the attached stale computer accounts list. These computers were not reported to Contoso domain from last 90days or more. Please make sure your allocated Organizational Units & Default Computer container is cleaned.” -Attachments “c:\StaleComputerAccounts.csv” –SmtpServer smtp.contoso.com

Here is a nice article

Advertisements

Posted in Active Directory User Management | Tagged: | Leave a Comment »

Add Domain User to Local Administrators Group

Posted by Brajesh Panda on June 22, 2012

Here is a nice article which states about this process;

I was aware how to add a domain user to local administrators group using “net” command, like below;

NET LOCALGROUP “Administrators” domain\useraccount /ADD

But for a specific requirement I was wondering how I can execute this in remote servers without getting into scripting like mess! And that article pointed me to right direction… PSEXEC came to rescue me!!

If we want to execute in a single remote computer use “psexec \\computername <CommandTobeExecuted>’

If we want to execute in multiple computers use a text file with all computer names written in each row then use “psexec @FileName <CommandTobeExecuted>’

So here is the command how to add a specific domain account in Local Administrators group of multiple computers;

PSEXEC.EXE @computers.txt NET LOCALGROUP “Administrators” domain\useraccount /ADD

PsExec executes a program on a remote system, where remotely executed console applications execute interactively.

Usage: psexec [\\computer[,computer2[,…] | @file][-u user [-p psswd]][-n s][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,…] cmd [arguments]

-a Separate processors on which the application can run with commas where 1 is the lowest numbered CPU. For example, to run the application on CPU 2 and CPU 4, enter: “-a 2,4”

-c Copy the specified program to the remote system for execution. If you omit this option the application must be in the system path on the remote system.

-d Don’t wait for process to terminate (non-interactive).

-e Does not load the specified account’s profile.

-f Copy the specified program even if the file already exists on the remote system.

-i Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session.

-l Run process as limited user (strips the Administrators group and allows only privileges assigned to the Users group). On Windows Vista the process runs with Low Integrity.

-n Specifies timeout in seconds connecting to remote computers.

-p Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.

-s Run the remote process in the System account.

-u Specifies optional user name for login to remote computer.

-v Copy the specified file only if it has a higher version number or is newer on than the one on the remote system.

-w Set the working directory of the process (relative to remote computer).

-x Display the UI on the Winlogon secure desktop (local system only).

-priority Specifies -low, -belownormal, -abovenormal, -high or -realtime to run the process at a different priority. Use

-background to run at low memory and I/O priority on Vista.

computer Direct PsExec to run the application on the remote computer or computers specified. If you omit the computer name PsExec runs the application on the local system, and if you specify a wildcard (\\*), PsExec runs the

command on all computers in the current domain.

@file PsExec will execute the command on each of the computers listed in the file.

program Name of application to execute.

arguments Arguments to pass (note that file paths must be absolute paths on the target system).

You can enclose applications that have spaces in their name with quotation marks e.g. psexec \\marklap “c:\long name app.exe”. Input is only passed to the remote system when you press the enter key,

and typing Ctrl-C terminates the remote process. If you omit a user name the process will run in the context of your account on the remote system, but will not have access to network resources

(because it is impersonating). Specify a valid user name in the Domain\User syntax if the remote process requires access to network resources or to run in a different account. Note that the password is

transmitted in clear text to the remote system. Error codes returned by PsExec are specific to the applications you execute, not PsExec.

Posted in Active Directory User Management | Tagged: | 6 Comments »

BackupExec 2010 R2: Active Directory Backup Procedure

Posted by Brajesh Panda on November 17, 2010

Service Account Requirement

1. Normal AD backup (This way we will not able to restore individual AD Objects)

* Below Permissions are required to be configured on “Default Domain Controllers Group Policy”. In Windows 2008 R2 Domain Controller you will find this GPO by opening GPMC.MSC -> Domain -> Domain Controllers -> Right click “Default Domain Controllers Policy & Edit * Act as part of the operating system
* Create a token object (which can be used to access any local resources) * Log on as service
* Log on as a batch job (allows a user to be logged on by means of a batch-queue facility)
* Backup files and directories (provides rights to backup files and directories)
* Restore files and directories (provides rights to restore files and directories) * Manage auditing and security log
* Official Reference: http://www.symantec.com/business/support/index?page=content&id=TECH136148

2. Backup Exec 2010 R2 software GRT (Granular Recovery Technology) based backup features. GRT feature enables us to restore single objects, even single attributes of a user object. * Domain Admin privilege
* Official Reference: http://www.symantec.com/business/support/index?page=content&id=TECH130255

Agent Installation

3. If you are going to use native domain DC, in which Backup server is member off, You can push/install the BackupExec agent from the console itself.

4. If you are going to use a different domain DC in the same/other forest, in which Backup server is member off, follow below steps to perform the installation. Else you will receive remote registry error.

* Add the service account to the local administrator of Backup Server
* Logon to Backup Server using the same service account & push backup exec agents to the concern domain controller
* After installation make sure you configure the BackupExec client with Backup server’s FQDN & IP Address. Else you will not able to see the server name in backup servers selection list panel.

[cid:image002.png@01CB8655.0F9423E0]

Create Selection List & Backup Jobs

5. If you are backing a Different Domain DC in the same/other forest.

* Register the “Network Logon” Account at BackupExec Console -> Network Menu -> Logon Accounts

6. Create a selection list & use the above account as logon account for the same

7. Connect the selection list to right backup policy

Posted in Uncategorized | Tagged: , | 4 Comments »

How to change Active Directory User Display Name format to “LastName, FirstName”?

Posted by Brajesh Panda on November 12, 2010

Change Active Directory User Display Name format to “LastName, FirstName”

è Open ADSIEDI.MSC -> Connect to required Domain -> Configuration Partion -> CN=DisplaySpecifiers -> CN=409 -> CN=user-Display -> Go to Properties -> Change the value to %, % %

[cid:image001.png@01CB826F.B38771D0]

Posted in Uncategorized | Tagged: , , | 2 Comments »

Read Only domain controller & Password caching

Posted by Brajesh Panda on September 29, 2010

Woo… I overlooked this Advance Tab! Because I never used this feature!

Posted in Uncategorized | Tagged: , , | Leave a Comment »

Sending Active Directory Domain Password Expiration Notification to End Users

Posted by Brajesh Panda on December 27, 2009

Did you ever noticed some users always called you up that they can’t access Corporate Applications using their AD User Account? Probably their account may be get locked down or got expired!

If account was locked out we can see from ADUC console. But if it was expired no way you come to know that password has been expired! Microsoft has some interesting tool kit for this kind of troubleshooting i.e. Account Lockout Management Tools. Refer to next posting about this.

If account was expired we used to reset their password. Sometime after investigation we usually came to know these users are not logging into corporate domain. So they didn’t receive any kind of notification that their password is going to expire in so many days. By the way there is no in built notification facility available in Windows Infrastructure for this kind of users.

So now we have the requirement; we can achieve this using a customized VB Script which will scan remaining days for password expiration & will send out a sweet message(mail) to these users. For troubleshooting purpose we have to generate some kind of logs that to which users our application is sending notification.
Read the rest of this entry »

Posted in VBScripting | Tagged: , , , | 12 Comments »

 
%d bloggers like this: