Managing and Automating Active Directory with PowerShell

Once you’ve got the forests created, we can now begin managing and automating the AD infrastructure. I’m defining AD infrastructure as any objects that’s at the forest or domain level like domain controllers, FSMO roles on domain controllers, sites, services, trusts and so on. This is basically the components that make up the AD foundation.

In this section, we’re going to focus on all of the AD infrastructure components you can think of. By the time you’re through with this section, you’ll be able to completely manage dozens of tasks in one or more forests completely with PowerShell!

For this first section, we’re essentially going to be doing two things with PowerShell. You’ll learn how to install Windows features using the Install-WindowsFeature command. This is the main command that gets all Windows features installed on local or remote computers. We’ll invoke this command using PowerShell Remoting. We’ll be using PowerShell Remoting a lot in this course so be sure you’re familiar with the concept. Finally, we’ll wrap these two concepts up to accomplish our task, creating an AD forest from scratch.

We’ll start from two workgroup VMs and come up with two separate AD forests on them. While we’re at it, we’ll go ahead and populate some users and groups into those forests too!

When you have a branch office where there a sufficient number of users to place a domain controller but physical security is a risk, it’s time to deploy a Read-Only Domain Controller (RODC) to that location. If your looking to save yourself a large number of mouse clicks, PowerShell can be used to efficiently deploy an RODC. This two-step process involves first installing the Directory Services role and then configuring the domain controller.

In this lecture, David will demonstrate how to easily add the domain controller role using Install-WindowsFeature cmdlet, and then configure the read-only domain controller using the Install-ADDSDomainController cmdlet.

Organizational Units or OUs are a fact of life in AD. I can’t tell you how screwed up I’ve seen some OU structures in my day. People have a way of organizing AD objects..and I’m using air quotes here...in some odd ways. Many people use GUI tools like AD users and computers or AD administrative center to do that but we’re not using no stinkin’ GUIs in this course. We’ll create, remove and change OUs with PowerShell!

The five Flexible Single Master Operation (FSMO) roles are important to the operation of your Active Directory infrastructure. Even though these roles are scattered across many domain controllers, we can hunt them down with PowerShell and a couple cmdlets as you'll soon see.

David Lamb demonstrates how easy it is to locate the five FSMO roles using the Get-ADForest and Get-ADDomain cmdlets.

One of the tasks you may need to perform with the Flexible Single Master Operation (FSMO) roles is the need to move them to another domain controller in your Active Directory environment. By using PowerShell, we can easily move one or all of these roles with a single, albeit very long command.

In this lecture, David will demonstrate the use of the Move-ADDirectoryServerOperationMasterRole cmdlet to move the FSMO roles to another server using both named roles and numbered roles.

There are times where one of your domain controllers may go offline, either temporarily or permanently. If it held one or more of the Flexible Single Master Operation (FSMO) roles in your Active Directory environment you will need to seize that role so that critical functions of Active Directory can continue. While you can use the graphical tools to seize any of the five roles, it would take three different utilities and the registration of the Schema Management DLL to perform this task. This is not something you want to be spending time on during an outage of this nature. PowerShell allows you to seize one or all of these roles with a single command.

In this lecture, David will demonstrate the use of the Move-ADDirectoryServerOperationMasterRole cmdlet to allow an operational domain controller to seize one or more of the FSMO roles.

Establishing and maintaining Active Directory trusts is a task that's not too common. Unless you're in a large enterprise, chances are, you're going to need to create one when your company acquires a new company or perhaps you decide to segment out your Active Directory forest. Regardless, it's possible to do with this PowerShell thus decreasing fat-finger syndrome and enabling automation.

In this lecture, Adam (that's me) goes through the entire life cycle of creating Active Directory forest trusts with PowerShell. I'll show you how to create forest trusts with PowerShell, remove them, test forest trusts with PowerShell to ensure they're working and finally end with a set of simple-to-use functions to ease this process in the future.

Sites are wonderful things in Active Directory because of how powerful being able to control AD traffic between subnets can be if you have remote sites or even just a lot of sites. being able to manage these sites using PowerShell makes them a whole lot better in my opinion.

In this video, Anthony will run you through the basics of managing Active Directory sites using PowerShell. You'll be shown how to create a site using New-ADReplicationSite, how to retrieve information about a site using Get-ADReplicationSite, how to set the properties of a site using Set-ADReplicationSite, and ultimately how to remove a site using Remove-ADReplicationSite.

In this lecture, Anthony will run you through adding subnets to Active Directory sites using PowerShell. He'll introduce you to retrieving a site's current subnets using Get-ADReplicationSubnet and then how to create a new one using the New-ADReplicationSubnet cmdlet. This will enable you to easily script imports of subnets from your network team, or even from your DHCP server if you need to.

Accounts are the most common type of objects you’ll work with in Active Directory. I’m not talking just about user accounts, but computer accounts, service accounts and virtual accounts too! We’re going to hit them all. While we’re at it, we’ll also go over manage service principal names too.

By the end of this section, you’ll know how to control every type of account in Active Directory using PowerShell and have the foundational knowledge to start building some cool automation tools later in the course.

Managing users in Active Directory using the GUI tools is so ho hum! Dragging your mouse miles across your desk does nothing more than make it shiny, unless you have a mousepad of course. The point being, that today is the time for you to learn how PowerShell can simplify your Active Directory user management style.

In this lecture, Anthony will walk you through the basics of managing user accounts in Active Directory using PowerShell. He'll demonstrate how you can create users using the New-ADUser cmdlet, retrieving users using the Get-ADUser comdlet focusing on the powerful filter parameter, modifying their attributes using the Set-ADUser cmdlet, and finally, removing them from Active Directory using the Remove-ADUser cmdlet.

When Managed Service Accounts (MSA) were first introduced with Windows Server 2008 R2, many server administrators were extremely excited. until they read the fine print. MSA's were only usable on a single server, meaning you'd have to create many for a single task across a farm, and they couldn't be used to run scheduled tasks.

Luckily their second iteration, Group Managed Service Accounts (gMSA) are much more usable AND useful! You can now create an appropriately privileged gMSA for a task and use it across an entire farm. You can now even use them to run scheduled tasks. That's awesome news, but how do you get started?

In this lecture, Josh will walk through the prerequisites for gMSA's and will then demonstrate creating, using and removing one!

Prerequisites include:

RSAT installed on the computer associated with the gMSA

A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.

In this lecture, we will go through how to manage SPNs with PowerShell. We will view the currently configured SPNs by querying the ServicePrincipalNames property and explore how to Add, Remove and Replace SPNs in the ServicePrincipalNames property. Finally we will go over how to clear all SPN values for an account.

Everything is an object in AD. Even printers! I’m sooo glad I don’t have to mess with printers anymore. Anyway, where was I? Oh yea! Computer accounts. These objects aren’t near as bad. Every machine that’s joined to a domain has a computer account and they can get unwieldy at times. I’m just glad we’ve got Anthony Howell on the case to show us how to wrangle these things in AD.

Adding computers to an Active Directory Domain is a very common task for an administrator. Most IT professionals will be intimately familiar with the “Computer Name/Domain Changes dialogue, but when using it you’d be forgiven for thinking that the process of renaming a computer and joining it to a domain takes two fill reboots. Which PowerShell you can do both not only with one reboot, but also a single command!

In this lecture, Josh will walk you through joining a computer to an Active Directory Domain with PowerShell using the Add-Computer cmdlet. This includes renaming and joining a single computer with one command, joining multiple remote computers at once, and specifying an organisational unit.

How hard is it to reset an Active Directory user’s password anyway? I mean..you just right-click on a user account in AD users and computers and click rest password, right? Well, yea, that works if you’re doing this for a single user but what if your organization acquires a new company and you need to provision hundreds or thousands of users or a big organizational changes happens and you’ve got to reset a ton of users at once? This is where PowerShell comes to the rescue. In the upcoming demo, you’ll see how Anthony Howell wields his PowerShell light saber to save the day.

Everyday IT tasks like creating new Active Directory accounts or resetting account passwords require that a new password to be provided to complete the task. Using the same set of characters for these processes becomes a security concern, and thinking of a new set of characters each time can be come tedious and time consuming. Automating the process of generating a different random password for each of these tasks can be simplified greatly by PowerShell.

During this video we will explore an extremely simple way of generating random passwords using PowerShell and a .NET method, and how to take what we learn and turn it into a function that can be dot-sourced or used in other scripts or functions.

Users never lock out their account, right? Nooooo.... Worms never spread throughout a network trying random passwords on all kinds of user accounts and locking out accounts left and right. That’s in the other organization’s network. But, it’s always good to be prepared so let’s take a look how Anthony Howell unlocks user accounts with PowerShell anyway.

When creating users, you often find that you write in a lot of attributes that you already have set on other users. Wouldn't it just be lovely if you could copy them? Well, guess what, you can! Using the Active Directory module in PowerShell you can copy attributes from other users when creating a new user.

In this video, Anthony will walk you through how to copy a user in Active Directory using PowerShell. He'll show you how to create a user object using Get-ADUser and then use that object to create a new user using the New-ADUser cmdlet, focusing on the -Instance parameter.

Using PowerShell, we can set user pictures in Active Directory. We can download the pictures, resize them to the recommended 96x96px dimensions and then modify the attribute thumbnailPhoto to get the picture attached to any user account! Using just a PowerShell script, we can update the entire company's user photos if we choose to do so.

In this video, we'll go over how to perform all of the tasks necessary to get an image attached to the Active Directory user account.

Groups are our next Active Directory object to tackle. You’ll see that managing groups is probably one of the easiest tasks to do because they are pretty simple objects. After all, they’re just containers for other objects.

There is still some work to be done though and you will always have to work with them.  In this section, you’ll learn how to create, modify and remove groups and see how easy PowerShell makes working with groups.

Active Directory groups are a simple but very powerfully source of control for any Windows admin.  They make our life a lot easier as admins and are a great target for scripting and automation with PowerShell.

In this lecture, we look at what can be done with PowerShell to create, update and remove Active Directory groups.  We explore cmdlets like New-ADGroup for creating the group.  We look at cmdlets like Add-ADGroupMember and Remove-ADGroupMember for updating the membership of the group.  By the end we should have all we need to control and create Active Directory groups in PowerShell.

Prerequisites include:

The ActiveDirectory PowerShell module installed

When you were hired as an administrator to manage Active Directory, little did you know that you would also need to keep track of all of your group memberships! One of those menial tasks that fall under 'other duties as assigned'. But hey, never a better time to learn some PowerShell!

With PowerShell you can write a monitor that will track group memberships for any number of groups and then have it notify you when changes are made. Anthony will walk you through writing a script to retrieve group memberships using Get-ADGroupMember, compare it to a stored CSV you created using Export-CSV, and then ultimately sending a notification email using Send-MailMessage.

Have you ever dreamt of a time where you could delegate some of the mundane work you’re forced to do? If you’re forced to manage AD user accounts, you’re in for a treat. Using PowerShell, WPF and Anthony Howell, we’re able to build a graphical tool we can give to HR, helpdesk or anyone else to quickly and efficiently create and manage AD user accounts with no intervention from us!

If you’re not familiar with JEA or Just Enough Administration and are already building PowerShell tools for others, you’re either opening up too many permissions for users or you’re doing things the hard way. Watch as Matt McElreath dives in and shows you how to setup JEA to only give users the minimum amount of access they need.

Giving non-administrator users access to perform certain tasks in Active Directory can help free up administrators time, especially for tasks such as creating or modifying user accounts. You can’t just make a regular user a Domain Administrator though. That’s a bad idea. Instead, we can utilize PowerShell’s Just Enough Administration (JEA) to not only specify who has access to run these commands, but also specify which commands they are able to run. You can even go as far as to specify which parameters they are allowed to use and what values they can pass to those variables.

In this lecture, Matt will show you how to set up a PowerShell Module with a Role Capability File using New-PSRoleCapabilityFile. He will modify this Role Capability File to specify settings such as ModulesToImport and VisibleCmdlets. Once the role capabilities have been defined, Matt will walk through using New-PSSessionConfigurationFile to create a constrained (JEA) endpoint that will define which user(s) have access to connect to the endpoint and which role capabilities they will have access to using the RoleDefinitions setting.

GPOs can either be a lifesaver or a system administrator’s curse. Using PowerShell to build scripts to manage GPOs, you can turn this sometimes difficult-to-wrangle aspect of Active Directory into a huge time-saver to rolling out configuration changes in your environment.

In this section, we’ll take back control of GPOs. We’ll go over how to perform such as tasks as figuring out what objects are affected by GPOs, managing starter GPOs, comparing GPOs to detect changes and a whole lot more. And, of course, we’ll do it all with PowerShell giving you the ability to perform these tasks on one or GPOs at the same time.

Working with GPOs is typically done via the Group Policy Management Console but did you know you didn't need it? We can use PowerShell! It may be more difficult at first but by using the know-how covered in this video, you'll learn how to create GPOs with PowerShell, set the registry values that are modified with GPOs and remove GPOs as well.

Using commands like Get-GPO and Get-GPOReport to see what settings are inside a GPO, Get/Set-GPRegistryValue to find and modify what registry keys a GPO changes as well as using an awesome community module, we'll cover all the bases when it comes to working with GPOs. We won't ever leave the PowerShell console! Well...once but don't tell!

Have you ever wanted or needed to create a Group Policy Object to use as a baseline for users or computers in your Active Directory infrastructure? Do you just need to make things easier for a junior Sysadmin?

In this lecture, Bill will show you how to create a blank Starter Group Policy Object using the New-GPStarterGPO cmdlet in the PowerShell GroupPolicy module. We'll also briefly cover how to use the Get-GPStarterGPO cmdlet to enumerate starter GPOs as well.

GPOs can apply to one object or millions of objects at once. That’s the power of Active Directory but which ones, exactly? GpOs can overlap, be excluded and so on. It gets messy sometimes. Anthony Howell drops some useful ways we can use PowerShell to quickly determine everything that a particular GPO impacts.

Have you ever had a time when you sat down at a computer and wondering why a setting was being applied via GPO? After you’ve gotten over questioning your coworker’s motives at requiring locking down solitaire, you wonder where that setting is coming from. Look no further! Anthony Howell lets you track down all of the mischief your cohorts have been up to but showing you how to find all GPOs by their linked OU.

At the end of the day, the majority of what a GPO does is simply manipulate the right registry keys but which ones? If you look at a GPO, there’s no indication of what it’s actually changing on the targeted computers. I’m not about to fire up a registry monitoring tool while I’m logging on to see what a GPO is doing! Let’s do this an easier way and use PowerShell. Anthony Howell shows us how to parse GPOs using PowerShell to pull out all of the registry keys your GPOs are changing on your client computers.

GPOs have a done of settings. One of those is drive mappings. Using PowerShell, we can quickly pull out how drives are maps from one or hundreds of GPOs at once. Let’s see how Anthony Howell pulls this off.

Policies are another common item to manage in AD. I’m talking about everything from password policies, account lockout policies, fine-grained password policies and more. If you know how to manage these policies with PowerShell, you are well on your way to implementing any kind of policy management task in your automation scripts.

One of the steps you can take to secure your network from a breach is to configure a strong password policy. In Active Directory the default domain password policy is a good starting point, but not a great one. It will be up to each individual organization to decide on an appropriate password policy. Once you have decided on a password policy, you will need to implement it, and one of the more efficient means to implement your password policy is with Windows PowerShell.

In this lecture, David will demonstrate how to create, view, and manage your domain password policy using the Get-ADDefaultDomainPasswordPolicy and Set-ADDefaultDomainPasswordPolicy PowerShell cmdlets.

One of the steps you can take to secure your network from a breach is to configure a strong account lockout policy. In Active Directory the account lockout policy is not defined by default, so it will be up to you to decide on a policy for your organization. Once you have decided on an account lockout policy, you will need to implement it.

One of the more efficient means to implement your account lockout policy is to use Windows PowerShell. In this lecture, David will demonstrate how to create, view, and manage your account lockout policy using the Get-ADDefaultDomainPasswordPolicy and Set-ADDefaultDomainPasswordPolicy PowerShell cmdlets.

Why should everyone in a domain have the same password policy? It doesn’t really make sense when you think about it. Luckily, David Lamb schools us on working with fine-grained password policies. We can now mess with our coworkers by making them use some insane passwords but...oh yea...it’s also good for “real work”, I guess too.

Once you have placed a Read-Only Domain Controller (RODC) in a branch office, you will need to configure the Password Replication Policy (PRP) for that RODC. This is where you decide which user accounts are allowed to cache their passwords locally on the RODC, and which ones aren’t.

In this video, David will demonstrate how to work with password replication policies using various password replication policy PowerShell cmdlets available in the ActiveDirectory PowerShell module.

It’s finally time to get down to automating tasks. The previous sections of this course all were around “managing” AD objects or simply working with AD via the command line. Now, we uncover the true potential of PowerShell and begin automating AD tasks.

For our first foray, we’ll dive into the most common automation task category; account management. We’ll cover creating user provisioning scripts, syncing AD with outside sources, how to bulk-edit AD objects and a lot more. This section is where we really start to open up the true potential of interacting with AD using PowerShell.

Creating Active Directory users is one of the most common tasks we do. Why are you still doing into AD users and computers and clicking around? There’s a MUCH easier way using PowerShell. In this lesson, Anthony walks us through how we can build a tool in PowerShell that will allow us to create new users on the fly with a single script and just a few input parameters.

Ever wonder when your users are logging in? If you’ve ever tried to create a report like this, you’d know you’re going to be parsing a lot of domain controller event logs even with some regular expressions thrown in. It can be extremely tedious but using PowerShell and some knowledge Anthony Howell is about to drop on you, you can too keep tabs on users in Active Directory.

It's not uncommon for Human Resources to pass on lists of new staff, or changes to existing staff, in the form of a spreadsheet. You could go through these spreadsheets line by line and manually update Active Directory. This may work for small domain, but even then you are human and humans make mistakes. When mistakes do happen, was it because of the data from HR or because you misread it?

Get ready to operate at scale, and reduce the risk of human error, by learning how to synchronize Active Directory user with a spreadsheet using PowerShell.

In this lecture, Josh will walk you through how to create, and update, users based on information from a spreadsheet. We'll be using Doug Finke's ImportExcel PowerShell module to read our spreadsheet and the New-ADUser and Set-ADUser cmdlets from the Active Directory module.

When using Fine-grained Password Policies in Active Directory you may need to look up which of those policies is affecting a given user or group, or what the specific password settings are for a given user. While you can use the Active Directory Administrative Center (ADAC) to perform these tasks, it can be tedious if you have multiple users to look up. PowerShell makes this lookup task really simple.

In this lecture, David will demonstrate how to use PowerShell to view which Password Settings Object (PSO) applies to a particular user or group, and how to view the resultant password settings for a specific user.

Creating various Active Directory objects like users, groups and organizational units via the GUI is OK if you're creating a few here and there. If you've got a lot to create, however, it's time to use PowerShell!

By using PowerShell, we can create a script that reads from a CSV file and automagically creates new users, groups, OUs and add users to their respective groups all without lifting a mouse finger! This lecture will show you it's possible to create some handy tools to sync all kinds of AD objects from a CSV with PowerShell.

One of the most powerful features of PowerShell is it’s ability to change thousands of a thing just like a single thing with no extra effort. With AD, it’s no different. AD environments have thousands, some even millions of different objects. Editing them by hand is simply out of the question maybe not though if you’re getting paid by the hour. For those of us that hate repeating ourselves like I have to with my 9 year old daughter, we have PowerShell though. Anthony Howell takes us through using PowerShell to edit AD objects in bulk in this lesson.

Joe in HR keeps getting locked out of his account. After repeated conversations with Joe asking if he’s logged in anywhere else and with a frustrated ”no” answer every time, you finally believe him and start investigating to find the task isn’t as easy as you’d might expect. I’m so glad we’ve got Anthony Howell here to help us query event logs and finally track down that source of bad password attempts to Joe can finally get back to work. Sorry, Joe. I’ll believe you next time.

Active Directory is great until you’ve got dozens of people with their fingers in it with no real direction! AD soon becomes a huge mess with GPOs linked to who knows where, user accounts that no one knows what they are anymore and domain controllers that have long since been turned off.

This is the section of the course where we build automation scripts to clean all of this crud up. We’ll build scripts to ensure there are no unused user accounts, decommissioned domain controllers lying around, useless GPOs and more!

Just like stale bread, no one wants stale Active Directory user accounts sitting around. Users that haven’t logged in in a long time, accounts that are disabled, and those that haven’t reset their password recently are all candidates for being stale. In this lesson, Josh King walks us through how we can pinpoint each of these types of users and clean them up to keep our AD environment squeaky clean.

Another common problem when your GPOs go nuts over time is GPOs linked to nothing. A GPO that is linked to an OU isn’t doing anything at all and leaves you wondering why this was even put into place 10 years ago. Now with Anthony Howell’s help, you can easily track down all of these GPOs, disable them and even delete them if you’re feeling risky and then see who comes complaining weeks later.

Have you ever heard of VM sprawl? It’s when an organization, one day, suddenly realized they’ve got way too many VMs to manage. The same can be said for GPOs. GPOs are easy to create and assign to users and computers but unless there’s a proper management protocol in place, they can get out of hand. One way to pick out GPOs that aren’t used anymore is to figure out which ones aren’t linked to any OUs. In this video, Anthony Howell takes us through just how to do that with PowerShell.

Performing an offline Active Directory database can be a scary thing if you're forced to remember each of the steps and do it manually. If you can wrap all of these actions up in a PowerShell script, this alleviates fat-finger syndrome and will ensure you get it right the first time, every time.

In this lecture, we'll still be using the ntdsutil utility but we'll wrap it in a PowerShell tool to do all of the steps for us. We'll ensure all services are stopped beforehand, started afterward and even do some log file cleanup all with a single PowerShell function.

Demoting a domain controller with dcpromo used to be all the rage but now it can be done with PowerShell and the Uninstall-ADDSDomainController command. In this lecture, we'll go over how to demote an online domain controller using PowerShell.

We'll cover demoting the DC with PowerShell as well as cleaning up any remnants of the AD-Domain-Services Windows feature for good measure.

Backups are an unfortunate requirement in any organization and AD is no exception. The AD database is replicated across each domain controller but this is not a good backup strategy. In this section, we’ll cover topics like backing up GPOs to files, restore objects from AD before we need to track down backups using the AD recycle bin and cover creating Active Directory snapshots with PowerShell.

Even though GPOs are replicated as part of the SYSVOL share on domain controllers doesn’t mean they shouldn’t be backed up. Even if not for recovery purposes, perhaps you’d like to share GPOs with someone else or simply want to build your own GPO repository somewhere, you’ll need a way to pull these GPOs out of AD. Using Matt Browne’s approach in this demonstration, you’ll be able to do just that.

Backups aren’t too useful if you can’t restore them. The same can be said with the AD recycle bin. Imagine if your manager accidentally removes an important object and you proudly tell him you’ve got this thinking that the AD recycle bin has already been enabled and restoring it will be a breeze? Come to find out, it was never enabled. Oops. Don’t get stuck in this position and enable it now using Josh King’s approach and getting this done with PowerShell.

I wish I never needed to undo anything but I’m human and I make mistakes. There’s always that one object in AD that I delete because I think “nah, that’s not needed anymore” to find out days later that I just removed the CEO’s important account. Oh well, no problem. I can use the AD Recycle Bin to bring it back. All I have to do now is apologize profusely. Here’s hoping I still have a job.