Create and Manage AD Users and Computers Flashcards
ADUC
Active Directory Users and Computers
ADAC
Active Directory Administrative Center. Runs on top of Windows Power shell.
UPN Suffix
Method of Logging on with your domain name in the user prompt. For example, (DOMAIN\username or Username@domain)
Template User AD Account
Blank Password.
- User Cannot Change Password.
- Account disabled.
- Password Never Expires.
Profile Path:
\file1\share1\%username%
Last Logon date for Users (Old Way)
get-aduser -filter * -Properties lastlongondate | ft name, lastlogondate
Remove disabled accounts (Old Way)
get-aduser -filter {enable -ne $true}
Find Disabled accounts (New way)
Search-AdAccount -AccountDisabled -useronly | fl name
Find Inactive Accounts (new Way)
Search-ADAccount -accountinactive -timespan 30:00:00:00 | fl name
Find Passwords Expired on accounts (New Way)
Search-Adaccount -Passwordexpired
Find Passwords that never expire (new way)
Search-Adaccount -passswordneverexpires
Find Locked out AD accounts
Search-ADAccount -LockedOut
CSVDE
Uses CSV to perform bulk operations in AD. Default is to export information. i.e, csvde -f output.csv.
CSVDE filtering containers & objects
csvde -f output2.csv -d “cn=users, dc=company, dc=pri” -r “(objectclass=user)”
CSVDE Import File
csvde -i -f output2.csv
LDIFDE
creates, modifies, and deletes directory objects. You can extend the schema, export AD users and group information to other applications or services, and populate AD DS with data from other directory servers.
Requires admin cmd prompt, and AD DS or AD LDS roles.
output format is in ldif.
ldifde -f output3.ldf
Import CSV for AD account creation
Import-CSV .\newusers.csv | New-ADUser
Offline domain Join
djoin /provision /domain company.pri /machine server1 /savefile server1.txt (txt is the shared secret and keep them close at hand)
Offline domain Join desktop operation
admin cmd prompt.
djoin /requestodj /loadfile server1.txt /windowspath %systemroot% /localos
Then reboot
Create new OU with powershell
New-ADOrgnizationalUnit “Company Users”
Create a new AD Group with power shell
New-ADGroup -name “Extremely Untrusted Users” -GroupScope global -path “ou=company users, dc=company, dc=pri”
Add Users into group with Powershell
Add-AdGroupMember “Extremely Untrusted Users” jason, djones
Group Nesting
- Users go in Global Groups
- Global groups go in Domain Local groups.
- Assign permissions to Domain Local groups.
UGLA.
Global Group
can only include objects from the same domain.
Domain local
Can include objects from any domain in the forest.
Who is a group member in AD group (Powershell Command)
Get-AdGroupMember “Domain Admins” | ft name
Get memberships a user has (Powershell Command)
Get-ADPrincipleGroupMemberShip jason | ft name
Recursive Match for a group and trace users indirect membership (Powershell Command)
Get-ADUser -Filter ‘memberof -recrusivematch “cn=domain admins, cn=users, dc=company, dc=pri”’ | ft name
Domain Local Conversion
domain local groups and global groups can be converted to universal groups.
Universal group Conversion
Universal groups can be converted to domain local groups or global groups.
Domain Local Non-Conversion
Domain local groups cannot be converted to global groups.
Global Group Non-conversion
Global groups cannot be converted to domain local groups.
Powershell Group conversion
Get-ADGroup “My Universal Distribution group” | Set-ADGroup -groupScope Universal.
Get-ADGroup “My Universal Distribution group” | Set-ADGroup -groupcategory 0
Group Policy Management Console Shortcut
gpmc.msc
Delegate Control
Delegate control wizard. Right click on OU. I.E. give IT group access to perform various tasks.
Find Delegation Applied
Turn on advanced features. Security Settings on OU. Check Security, and you will find special permissions.
Manage Default Location for newly created computer objects
redircmp “ou=company computers,dc=company,dc=pri”
