powershell & Active Directory: Find all users who have “Password Never Expires” enabled using Powershell.

Hi,

In domain controller environment we all have some password policies set. In some organizations the users password is expired in 60 days in some 90 or in 180 Days.

User’s password must expired in the defined period, changing password often is a good security policy.

But when we create a user account some time by mistakes we select  “Password Never Expires”.

if  the “Password never expires” checked users password never expired.

which is not good for user’s account security.

My todays task is to find all users , who have “Password Never Expire” checked. To archive this task we are going to use “Active Directory” module and “Get-Aduser” cmdlet with Filters

Get-ADUser -Filter  'PasswordNeverExpires -eq $true'  -Server localDC | select name

 

After Get-ADuser cmdlet we are using –Filter to show all those account whose “Password Never Expires value is equal to True” which means enabled,and in –server parameter i am defining my domain controller, and  we are piping the output to “Select-Object” cmdlet and selecting to show “Name” property of the output to show.

and the output is below  

Now I can show that list to my manager so that we can fix them later ..

Thanks for reading.

Thanks!

Aman Dhally

  

Powershell and Active Directory: Find Active Directory users in a particular Organizational Unit whose Script Path is not set or blank using Powershell.

 

Hi,

If we are using "Active Directory" then one this is sure that 98% we are using some login scripts. Sometime while creating users we forget to mentioned to specify the login script in account.

My task of today is to find all users accounts those have no login script defined in their accounts.

Let's Start.

 Make sure you have "RSAT" installed on you laptop.

Now Import the Active Directory module.

Import-Module ActiveDirectory

 

..

ok, Module is imported,

...

I want to search a particular organizational unit for users. I am not so good in LDAP so i always do a trick to find full path of OU.

Find OU.

I know a user name "Will smith" in located in that Organizational unit on whom i want to search users those have blank LOGIN SCRIPT field.

I run Get-ADUser cmdlet against Will.smith and i choose to show me of DistinguishedName the user. That DistinguishedName name contain full path of that OU

(Get-ADUser will.smith).DistinguishedName

Copy all fields expect CN and saved it to a variable.

 

$ou = "OU=testing,DC=localDC,DC=com"

We are using  Get-ADUser cmdlet , to the information about active Directory users, in -SearchBase we are telling it to search our  predefined Organizational Unit in $ou variable,   then -Filter * to search for all users , and then -Properties * to show all the properties of the user account , then we are piping the command to  where cmdlet and we are choosing to choose only those users whose SCRIPTPATH is equal to null or blank and after that we are selecting only names using select cmdlet.

Get-ADUser -SearchBase $ou -Filter * -Properties * | where { $_.ScriptPath -eq $null } | select Name

All Done...Job is secured | once again ...

Thanks!

Aman Dhally

   

Powershell and Active Directory: Find all Active Directory users whose CITY property field in blank.

 

Hi,

Me again , yes yes i know , now you are going to ask me ,,"Aman" what is your task for the day",, ok ok telling you..Today my manager told me to find all  active directory users which don't have the CITY field set or those users whose CITY field is blank in there user properties.

I know that Active Directory Module has a Cmdlet to find users which is : Get-ADUser

 

Let's Start.

 Make sure you have "RSAT" installed on you laptop.

Now Import the Active Directory module.

Import-Module ActiveDirectory

 

..

ok, Module is imported,

To find all users in AD we need to user -Filter * and to get there all properties we need to use -Properties * parameters.

Get-ADUser -Filter * -Properties *

but our target it to find CITY field which is blank., let's use Where-Object cmdlet to do this.

In this command we are asking powershell to Find all users with all of there properties and then then show is only those users whose CITY property is $null or blank.

Get-ADUser -Filter * -Properties * | Where-Object { $_.City -eq $null}

this is showing us huge amount of data.

Lets just select names of the users only.

Get-ADUser -Filter * -Properties * | Where-Object { $_.City -eq $null} | Select Name

 

Wow !! i have the names of all users whose City filed in blank.. i can export it to CSV files and sent to my Manager :)

Thanks for reading

Thanks!

Aman Dhally

   

Powershell and Active Directory: Find all organizational unit containers [OU] in Active Directory using Powershell.

 

Hi,

These days i think i am only and only working with Active Directory.  My Manager give me the task to show him the all Organizational Unit Container , so that we can re-arrange them and remove the OU those are not required any longer.

Seriously i don't know any way to do this. I never heard about it and never tried it before. Why ? my manager needs it ? that the first thought came in my mind, but buddy manager is a manager ;o) , i have to do it what he said.

The again i decide lets explore some Active Directory cmdlets and see if it have something.

In first attempt i found a single cmdlet which is able to do this. That is  Get-ADOrganizationalUnit

Let's Start.

 Make sure you have "RSAT" installed on you laptop.

Now Import the Active Directory module.

Import-Module ActiveDirectory

 

..

ok, Module is imported,

...

First run the to view all OUs run the single cmdlet with -Filter * parameters

Get-ADOrganizationalUnit -Filter *

It is showing us the details of all OUs.

But i am still not satisfy with the result. let it filter more ,,

Get-ADOrganizationalUnit -Filter * | Select Name

I tried to select Name but the output is not so good. Because we can see Name but for example in below screenshot i have multiple OU container named as Users

ok...still not happy.

let run another command

Get-ADOrganizationalUnit -Filter *  -properties * | Select CanonicalName

This command will show is a full path of our OUs.

All Done :)

My Target of the day i achieved. Now can do facebook ;o) ;o)

Thanks for reading

Thanks!

Aman Dhally

   

Powershell and Active Directory: Find inactive Computer Accounts in Active Directory using Powershell.

 

HI,

As you know my IT manager always keep me busy. These days we are cleaning our Active Directory. My Today's "Target of the Day" is to find all in-active computer accounts.

first i start thinking how to do it ? to use some filter in "Active Directory Computer and users" or i need to do something else. After few minutes of thinking i thoughts, why not try Powershell. :)

Let's Start.

 Make sure you have "RSAT" installed on you laptop.

Now Import the Active Directory module.

Import-Module ActiveDirectory

 

..

ok, Module is imported,

we are going to use the Active Directory module cmdlet "Get-ADComputer"

"Get-ADComputer" has a property of Enabled which either is "false" or "True", the true means computer account is "enabled" and false means "Computer account is "disabled"

To find all the properties of a single computer account , use the below command.

Get-ADComputer R92DA6V -Properties *

Ok..not lets find all disabled/in-active computer accounts.

we are going to -filter to to find all inactive account and in Filter we are defining that show all computer who has the value of $false in the property Enabled.

Get-ADComputer -Filter "Enabled -eq '$false'"

all done ..but lets filter the output to show  us only names.

Get-ADComputer -Filter "Enabled -eq '$false'" | Select Name

Ahh !! now it's look better...

Now i have the name of all inactive computer accounts in my AD.

Thanks for reading.

Thanks!

Aman Dhally