Tag Info

Hot answers tagged

7

You could do it like this (breaking it in to more statements helps readability): # Go to the directory and find the files Push-Location "C:\MDMarrasFiles\" $Files = Get-ChildItem -Recurse # Create an IdentityReference and a FullControl FileSystemAccessRule for said identity $Principal = New-Object System.Security.Principal.NTAccount("DOMAIN\user") ...


6

I'll presume your question lies in finding inactive accounts. I use JoeWare's Oldcmp tool. http://www.joeware.net/freetools/tools/oldcmp/index.htm still after all these years. It can find inactive AD accounts by looking at password age and specifically LLTS = lastLogonTimestamp It's simple enough to at least get you started and easier than powershell. ...


5

The data is in the SAM but it doesn't appear to be publicly documented by Microsoft and I'm not finding an official API to retrieve it. I can see, looking at the source code for the chntpw utility that the value is stored in the "F" registry key for each account. Quoth the source code: #define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F" struct ...


4

You are most correct in that you can: Enumerate the zones and look for the "Primary" ones Retrieve zone info for each zone I've previously written about parsing dnscmd output using PowerShell, and this should accomplish step 1: function Get-DNSZones { param( [String]$ComputerName = "." ) $enumZonesExpression = "dnscmd $ComputerName ...


4

Really? Honestly, this question is so lazy, I almost don't want to answer it... but I guess I dedicated 6 seconds on Google to finding the answer, so I may as well share it. To get OS Version: Get-ADComputer -Filter * -Property * | Format-Table Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion -Wrap –Auto Oh, and look, ...


3

Just to leave an alternative to Mathias's already great answer, here's a one-liner that works with any version of Powershell: PS C:\> Get-WmiObject MicrosoftDNS_Zone -Namespace Root\MicrosoftDNS ` -ComputerName DC01 | Where ZoneType -EQ 1 | ` Select ContainerName, SecondaryServers (ZoneType values for reference: ...


2

Deploy .NET and WMF via WSUS or SCCM. WMF 5 is still in preview, and would not work on 2008R2 or Win7 anyway, so no, don't worry about WMF 5. Deploy .NET first, as it is a prerequisite of WMF. Powershell Web Access is something you would set up on one server - your "gateway." Don't deploy Powershell Web Access on every server. ...


2

It all depends on how you deploy software period. I use sccm, but for the packaging I prefer SFX's where simple .msi's or similar cannot be done. If you don't have such a luxury, The .msu can be installed silently using the /quiet switch, I also prefer the /norestart switch to keep calls down from users.


2

XP (Lan Wired) Here, NetConnectionStatus=2 grabs the active (connected) network interface and 'more +1' skips the header line: C:\>wmic.exe nic where "NetConnectionStatus=2" get PNPDeviceID |more +1 PCI\VEN_10EC&DEV_8139&SUBSYS_813910EC&REV_10\4&1F7DBC9F&1&30F0 Then feeding the string (up to the first ampersand for short) to ...


2

I'm still running Exchange 2007, but I don't believe this part has changed... There are two different types of Distribution Groups in Exchange: "Standard" Distribution Groups Dynamic Distribution Groups A "Standard" Distribution Group is basically just a group where you've added either other groups (Dynamic or "Standard") or individual users (Mailboxes, ...


2

You can forward log events in Windows Server 2008 and Windows 7. This might be a better work around. You setup the machines to forward events to a central collector and then configure a central point to collect the event logs. A bit more info from MS is available here.. http://technet.microsoft.com/en-us/library/cc748890.aspx The good part about ...


2

You can do this with line breaks: gwmi win32_process | where ProcessName -Match "explorer" | foreach {$_.GetOwner().User | Out-String} Or without gwmi win32_process | where ProcessName -Match "explorer" | foreach {$_.GetOwner().User} Remember to wrap your foreach 'script' inside {}'s. For the sake of completeness I'll say this was done with Powershell ...


1

Are you sure about the permissions? Maybe you can try this one step by step? http://support.microsoft.com/kb/960147/en-us Cause In Exchange Server 2003, the database cleanup agent can be run by any regular Exchange Full Administrator. This behavior is changed in Exchange Server 2007. When you run the clean-mailboxdatabase cmdlet in Exchange Server 2007, ...


1

If you want to reference a configuration from another configuration that is not defined in the same file, you need to use the composite resource pattern. In a module, you'll create a DscResources folder. In that folder, you'll create a module to hold your composite configurations. The composite configuration will be defined in a file with the extension ...


1

New-ADServiceAccount The name provided is not a properly formed account name The SAM account name exceeds the 20 character limit. A $ is automatically appended when missing and counts towards this limit. Examples: New-ADServiceAccount abcdefghijklmno -SamAccountName abcdefghijklmnopqrst New-ADServiceAccount abcdefghijklmnopqrs -SamAccountName ...


1

You can tell an MSI not to create an ARP entry with the ARPSYSTEMCOMPONENT property. You could set this in the Property table or send the value on the command line. msiexec /i your.msi /qn ARPSYSTEMCOMPONENT=1


1

Have you tried running it as a scheduled task with a trigger of "user logon"? This might eliminate the need for a function like that. SCHTASKS /Create [/S system [/U username [/P [password]]]] [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day] [/M months] [/I idletime] /TN taskname /TR taskrun [/ST starttime] [/RI interval] [ ...


1

If you look at how MDT (http://technet.microsoft.com/en-us/windows/dn475741.aspx) does this, it places as shortcut in the user's "startup" folder. That way you're pretty much guaranteed that the script won't run until the user has logged on and the desktop is presented. If you dig a bit in the MDT scripts folder you'll find ready-made scripts for creating ...


1

The only way to actually know would be to have account management auditing enabled on the computer when the account was created. Then, you'd see EventID 4720 in the Event Log at the creation date. (The article says Active Directory, but the same applies to local accounts as well; I checked.) Without that, the closest you can come is by checking the ...


1

Not quite sure how this would be getting locals... unless the -match "EXP\\" is somehow not behaving as expected. Do the workstations contain "EXP" in the name? Is it possible these local accounts are used to make local logons and remain logged on for more than 14 days? Your 14 day window may be a little too aggressive. Your code is leveraging 2 different ...



Only top voted, non community-wiki answers of a minimum length are eligible