Is there a way to find list of PC's under Specific AD site? We previously used to have different OU's created for each site which would make easier to track PC's. Now we only have one OU, so the only feasible way to find PC's on each site would be to get the list of PC's via AD sites. any help in this regard will be greatly appreciated and / or if there is a better way?
4 Answers
Out of the box, computer/site information is not stored in AD. BUT, there is nothing stopping you from putting it there. You can deploy a computer startup script or scheduled task to your domain computers so that each computer writes it's currently assigned site value to an attribute on its own AD computer object. Just give the 'SELF' security principal permission to modify whatever unused attribute you decide to use on descendant computer objects. This information can then easily be queried to determine which clients are associated with which site. Make sure your script accounts for un-associated clients.
Here is a sample PowerShell script that can run from a domain joined windows client and does not require importing any additional PowerShell modules. This will write the current AD site value to the 'extensionattribute8' attribute of the computer object in AD:
$obj = new-object -com ADSystemInfo
$type = $obj.gettype()
$adsite = $type.InvokeMember("sitename","GetProperty",$null,$obj,$null)
if($adsite -eq $null){$adsite = "UNKNOWN"}
$root = [ADSI]"LDAP://DC=Contoso,DC=com"
$search = [adsisearcher]$root
$name = $ENV:COMPUTERNAME
$Search.Filter = "(&(SamAccountName=$name$))"
$computer = $Search.FindOne() | foreach{$cproperties=$_.GetDirectoryEntry()}
$adsiteinad = $cproperties.extensionattribute8
if($adsiteinad -eq $adsite){}else{
$cproperties.extensionattribute8 = [string]$adsite
$cproperties.SetInfo()
}
Just replace DC=Contoso,DC=com with your domain's distinguished name and replace 'extensionattribute8' with any unused single valued attribute you have available. Then give the 'SELF' security principal read/write permission to the attribute targeting descendant computer objects. Run the script as a SYSTEM scheduled task or in a PowerShell computer startup script and it will populate the attribute on the domain computer object. The script compares the current attribute value with the site name and only attempts to write to AD if they do not match. This is to prevent unnecessary writes to AD. Obviously you should test this before applying it to a large number of computers.
You can then query your domain for all computers assigned to a specific site by using this PowerShell command:
Get-ADComputer -Filter 'extensionAttribute8 -eq "SITENAME"'
You can't, actually. Machines don't get associated with Sites in AD (as such.)
Subnets get associated with Sites, so at any one time, you could do an NMap scan of the subnet or subnets associated with a Site, to get a list of IPs, which you could then correlate to a list of machine names. Only valid at that point in time though.
Scenario: Laura in Sales is often in Denver, but today she's visiting the Atlanta office. Different site, but no change in AD was made by anyone, either an administrator or even behind the scenes. Her laptop knows what Site it's in at the moment because that governs things about the login process, etc.
So let me ask - what problem are you trying to solve? What end-state do you want? You need to track machines by site? Get an inventory solution.
-
yes you are right, I need to track machines by site, either via sccm or AD whichever is feasible– BrownJul 2, 2017 at 4:24
-
AD will not do it. SCCM might. If you need to find out where equipment is "assigned" as opposed to "where it actually is", you need an actual inventory solution. Could be as simple as Excel, might need to be more complicated. How many machines? If you have (and buy) a lot, your vendor/VAR/reseller might have a solution you could use.– mfinniJul 3, 2017 at 18:32
This information isn't stored or maintained in AD.
A client stores it's site information in the registry.
It is possible to gather the client's site information remotely using the command:
nltest /server:computername /dsgetsite
This is not a direct answer for your question, but an alternative. Since Active directory does not store the information that you are looking for, and manual scans or running a script to loop through all computers can be very time consuming.
Since the Site is based from the subnet that the computer is in, a inventory software would give you a good way to find all machines in one or more subnets.
For our domains, we us PDQ Inventory. It allows scanning automatically in the background, and dynamic collections that list all computers with specified parameters. You could make a collection for each of your sites, and they would all dynamically update. Their prices are fairly reasonable, especially if you start to use more of their features.
-
-
Because I don't have system center, and I am suggesting what I know. Your question also does list that you have it either. Jul 2, 2017 at 14:03