Tag Info

Hot answers tagged

5

Enable Advanced auditing on the domain controllers for Account Management: Audit User Account Management Note that if you enable Advanced auditing, you must not use legacy auditing. Here are some of the events of interest: 4723: An attempt was made to change an account's password ...


5

I assume you're using DHCP, right? Use DHCP to specify the default gateway and DNS servers. You can even use DHCP on your DC and keep it all in one place. DNS should be provided by the domain controller(s). They can forward unknown requests to your ISP's DNS servers.


4

To retrieve only the members that are users, and not groups: foreach($group in $groups) { Get-ADGroupMember $group | Where-Object {$_.objectClass -eq "user"} } If you want users who are members of the groups indirectly (through nested group memberships), user the -Recursive switch parameter: foreach($group in $groups) { Get-ADGroupMember $group ...


3

Try this: foreach ($group in $groups) { Get-ADGroupMember $group | select Name } Get-ADUser is looking for an Active Directory User object, what you're essentially trying to do is use that cmdlet on an Active Directory Group object.


3

Basically, nevermind if your are using DHCP or not. Using a single DC in your domain, you have to make it a DNS Server also. Install and configure DNS role on your Domain Controller. Then configure your clients' DNS to point to the IP Address of your DC. The most important thing is that you have to setup your DNS Server to forward unknown names queries to ...


3

Unless you have your auditing policies set up to audit Success events in the User Account Management subcategory (or just Account Management events, if using legacy auditing) and you actually have Security Logs that has data stretching back far enough on your DC's, you won't be able to tell. You'll want to search for events with Event ID 4723 (Password ...


3

Try rename field in csv from mail to EmailAddress New-ADUser accepts a property of EmailAddress, but not mail. Some of these correspond to an AD attribute, but not all. New-ADUser https://technet.microsoft.com/en-us/library/ee617253.aspx


1

Here is list of all Get-aduser default and extended properties. http://social.technet.microsoft.com/wiki/contents/articles/12037.active-directory-get-aduser-default-and-extended-properties.aspx


1

Active Directory objects are stored in the NTDS database with many attributes, the name is just one of them. They are actually identified by a SID (security identifier), which is what AD uses to identify the object. The name, or any of a number of other attributes, can be changed, and AD will still recognise it as the same object. SIDs are generated ...


1

Generic solution: I think the Microsoft-centric solution to this is to license using volume keys, and then simply use your KMS server to report on license activation status. Windows 7 and above-solution If volume licensing is not an option, and all of your clients are Windows 7 or newer, you could just query the SoftwareLicensingProduct WMI class on each ...


1

You can deploy powershell profiles using group policy: 1. Prepare the profile.ps1 file 2. Copy it to a shared folder 3. then go to group policy --> User Configuration --> Preferences --> Windows Settings --> Files see this Technet Blog entry for more details


1

Why are you using deny ACEs? You should be doing something like this: Root of the share (Authenticated Users - Read - This Folder Only) | | ----Subfolder1 (Subfolder1 Users - Read/Write - This folder and Subfolders) | | ----Subfolder2 (Subfolder2 Users - Read/Write - This folder and Subfolders) And so on. You should not be using deny ACEs regularly. In ...



Only top voted, non community-wiki answers of a minimum length are eligible