PoShCrashCourse/02_ActiveDirectory/Crashkurs_AD.PS1 at master · scriptrunner/PoShCrashCourse · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# PowerShell Modul ActiveDirectory installieren


# Client Betriebssysteme Windows 7 .. 10

# Download remote server administration tools (Remoteserver-Verwaltungstools)

# Windows  7    https://www.microsoft.com/de-de/download/details.aspx?id=7887
# Windows  8    https://www.microsoft.com/de-de/download/details.aspx?id=28972
# Windows  8.1  https://www.microsoft.com/de-de/download/details.aspx?id=39296
# Windows 10    https://www.microsoft.com/de-DE/download/details.aspx?id=45520

# Installieren der Remoteserver-Verwaltungstools
# Systemsteuerung -> Programme und Features -> Windows Feature aktivieren
# -> Aktivieren des Remoteserver-Verwaltungstools -> Rollenverwaltungstools -> AD DS- und AD LDS-Tools -> Active Directory-Modul für Windows PowerShell


# Server Betriebssyteme Windows 2012 .. 2016

Get-WindowsFeature | where -Property Name -Value *AD* -like

Install-WindowsFeature -Name RSAT-AD-Powershell -Verbose

# Test if available
Get-Module -ListAvailable | Where-Object -Property Name -Value ActiveDirectory -EQ


Get-Command -Module ActiveDirectory


Get-ADDomain -Current LocalComputer
Get-ADDomain -Current LoggedOnUser


# Domain Controller abfragen
Get-ADDomainController
Get-ADDomainController -Discover -DomainName 'mydomain'
Get-ADDomainController -Discover -DomainName 'mydomain'


Get-ADUser -Filter '*' | Measure-Object

Get-ADComputer -Filter '*'

Get-ADGroup -Filter '*' | Measure-Object

Get-ADGroup -SearchBase 'OU=ETT,OU=DE,DC=xxx,DC=xxx,DC=com' -Filter '(CN -like *User*)'


# AD Filter HowTo
Update-Help

Get-Help about_ActiveDirectory_Filter


Get-ADObject -Filter 'CN -like "*admin*"'

Get-ADUser -Filter 'CN -like "*admin*"'

Get-ADGroup -Filter 'CN -like "*admin*"'

$adminGroup = Get-ADGroup -Filter 'CN -eq "TestGroup"'

Get-ADGroupMember -Identity $adminGroup -Recursive | measure

# Test AD Group Membership
Function Test-ADGroupMember
{

    [CmdletBinding()]
    Param (
        [parameter(Mandatory = $true)]
        [string]$User,
        [parameter(Mandatory = $true)]
        [string]$Group
    )

    Trap {Return "error"}

    if (
        Get-ADUser -Filter "memberOf -RecursiveMatch '$((Get-ADGroup -Identity $Group).DistinguishedName)'" -SearchBase $((Get-ADUser -Identity $User).DistinguishedName)

    ) {Return 'true'}

    else {Return 'false'}

}


Test-ADGroupMember -User 'testuser' -Group 'testGroup'


Function Unlock-MyADAccount
{
    Param
    (
        [parameter(Mandatory=$true)][string]$SAMAccount
    )


    $Testees = @(Search-ADAccount -LockedOut)
    foreach($Test in $Testees)
    {
        If ($Test.SamAccountName -eq $SAMAccount)
        {
            Write-Host "Account is locked, unlock ongoing"
            Unlock-ADAccount -Identity $SAMAccount
            $Test2 = Search-ADAccount -LockedOut
            If ($Test2.SamAccountName -eq $SAMAccount)
            {
                Write-Host "Account is still locked, something went wrong!"
            }
            else
            {
                Write-Host "Account unlock successfully."
            }
        }
    }
}


$Firstname = 'Hans'
$Lastname = 'Maier'

$City = 'Ettlingen'
$Company = 'AppSphere AG'
$Department = 'DevOps'
$StreetAddress = 'Ludwig-Erhard-Staße 1'
$maildomain = '@appsphere.com'

New-ADUser -Name "$Firstname $Lastname" -AccountPassword (ConvertTo-SecureString “1qay!QAY” -AsPlainText -Force) -AllowReversiblePasswordEncryption $FALSE -ChangePasswordAtLogon $TRUE -City $City -Company "$Company" -Department "$Department" -EmailAddress "$Firstname.$Lastname$maildomain" -Enabled $TRUE -GivenName "$Firstname" -PasswordNotRequired $FALSE -SamAccountName "$Firstname.$Lastname" -StreetAddress "$StreetAddress" -Surname "$Lastname" -userprincipalname (“$Firstname.$Lastname$userdomain")


$user = Get-ADUser -Filter 'CN -EQ "Hans Maier"'
Set-ADUser -Identity $user