Christos Polydorou

A few days ago, I published an article on how to use the "Get-ActiveDirectoryGroupMember" function to get all the objects that are members of a group recursively. With this article, I'm going to show you how to use the "Get-ActiveDirectoryMembership" function in order to get all the groups that an object is a member of  recursively. As always, my user account will be the test subject! When I get the groups that I am a member of, the list contains only the groups that I am a direct member. PS C:\> $user = Get-ADUser cpolydorou PS C:\> Get-ActiveDirectoryGroupMembership -Identity $user.DistinguishedName Name                    DistinguishedName ----                    ...

A very common scenario when assigning permissions is having nested security groups. Although this is an easier way to manage the permission delegation, is adds complexity when there's the need to determine whether a principal is granted the permission or getting a list with all the principles involved. The CPolydorou.ActiveDirectory module now includes a function that is the solution to the problem. The Get-ActiveDirectoryGroupMember function will return all the objects that are members of a specified Active Directory group. The "-Recurse" parameter will query Active Directory and return all the members of the group recursively. This way, we are able to get a list of all the objects that are granted a permission without having to consider the nested groups. Let's take a quick look at an example. We have a group named "NestedGroup" that the user CPolydorou is a member of. This group is also a member of another group named "Group". PS C:...

Welcome to the third and final article of the Restoring Active Directory Attributes with PowerShell. Today we are going to create a scheduled task in order to execute a PowerShell script that will manage our Active Directory snapshots. First, we are going to create the script that will manage the snapshots but in order to do that we have to decide on how often and how many snapshots we want to have. Personally, I go for two snapshots per day for a period of three days, nut I have these snapshots spread across multiple Domain Controllers. The following script will create an Active Directory snapshot and then remove all the older snapshots keeping a total of 3. That way, when it is executed on a daily basis, you will have three snapshots for the last 3 three days. # Create the new Active Directory snapshot New-ActiveDirectorySnapshot # Get the current date $now = [DateTime] :: Now # Remove snapshots older than three days from now Get-ActiveDirectorySnapshot |...

On the first article of the series, we used the ntdsutil tool to create, mount, dismount and remove Active Directory snapshots and load the Active Directory database using the dsamain tool. Today, we are going to use a set of PowerShell functions I've created for this purpose. These functions are included in my Active Directory module since version 1.4.1 . Let's start by creating an Active Directory snapshot and then mount it on port 33389: After taking the snapshot, I updated the first name, last name and proxy addresses attributes on my user in order to compare and later on restore them. Using the "Get-ADUser" cmdlet we can get current the values for those attributes and as well as the values from the snapshot: As you may notice, a proxy address is missing, the first name has been updated to "Christos 1" and the last name have been updated to "Polydorou 2". This is how easy it is to restore the attributes! First we save the produ...

When dealing with Exchange, most of the object Identities are in the form of CanonicalName which makes searching Active Directory difficult since Canonical Name is a calculated attribute and cannot be used in a query. For example, the identity of a mailbox is the cn of the user: [PS] C:\Windows\system32>$cn = (get-mailbox cpolydorou).Identity.ToString() [PS] C:\Windows\system32>$cn LAB.local/LAB/Users/Christos Polydorou The newly released version of my Active Directory module ( 1.3.0 ) contains the cmdlet "Convert-ActiveDirectoryNaming" that will help with converting between the different Active Directory naming formats. The following example illustrates the usage of the cmdlet. First, let's get the user from Active Directory in order to have the DistinguishedName, SamAccountName, CanonicalName and UserPrincipalName values. PS C:\> $user = Get-ADUser cpolydorou -Properties DistinguishedName, SamAccountName, CanonicalName, UserPrincipalName P...

I:ve recently published another of my Poweshell modules to the Powershell Gallery. This time it's the CPolydorou.ActiveDirectory module. This module contains functions that can help with Active Directory tasks. Let's go through the functions and see where they can help. Test-ActiveDirectoryGroupMembership This function will test if an object is member of a group. It also includes a recursive switch. Test-ActiveDirectoryIsDomainAdmin Test if a user is member of the domain admins group. Get-ActiveDirectoryUserGroupMembershipHistory Check when a user was added to a group by examining the Active Directory replication metadata. More functions are going to be added to this module in the near future so make sure you have the latest version installed!