ZFESCHT weblog

check this tool! very nice and free!

http://www.codetwo.com/freeware/active-directory-photos/

1.  Create a Global Security Group, in your case, DesktopAdmins.  Add your users to this group

2.  Create a new GPO, “Computer Standards”.  Edit this GPO.

3.  Expand the Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups.

4.  Right Click Restricted Groups, click Add Group, Browse for your DesktopAdmins group, Click OK.

5.  On the Configure Membership for the DesktopAdmins you see 2 options:  Members of this group & This group is a member of:

Members of this group (top half) Defines the exact membership of this group.  So, for example, if you add your DesktopAdmins group in this area (to the Administrators group), it will define the Local Admin Group to contain ONLY the DesktopAdmins group.  Any other entries that are currently there (e.g. the local administrator), will be removed.  Again, this setting DEFINES the group.

This groups is a member of (bottom half) adds the group you selected (DesktopAdmins) to the group you select when you click this second Add button (Administrators).

6.  Click the Add Button and select the (local) Group you would like to modify the membership

http://blogs.technet.com/b/askcore/archive/2010/03/30/access-denied-error-0×80070005-message-when-initializing-tpm-for-bitlocker.aspx

Dieses Tool erleichtet das verwalten von Active Directory Gruppen. Man setzt auf der Gruppe “Managed by…” – diese Person kann anschliessen mit diesem Tool die Gruppen selber verwalten auf welchen er als Manager gesetzt ist. Er kann neue Benutzer hinzufügen resp. entfernen.

http://www.cjwdev.co.uk/Software/GroupMan/Info.html

http://www.socarenergy.ch

gpedit.msc /gpcomputer: Computername

hier noch eine Zeile PowerShell Script welche alle Shared Mailboxen und die entsprechenden Berechtigungen ausliest und in eine CVS-Datei abfüllt.

Gut wenn mal wieder jemand vom Management kommt und wissen will wer eigentlich alles auf die Shared Mailboxen Zugriff hat

Get-Mailbox | Get-MailboxPermission | where {$_.user.tostring() -ne “NT AUTHORITY\SELF” -and $_.IsInherited -eq $false} | Select Identity,User,@{Name=’Access Rights’;Expression={[string]::join(‘, ‘, $_.AccessRights)}} | Export-Csv -NoTypeInformation mailboxpermissions.csv

hier ein Powershell Script welches alle ‘leeren’ Active Directory Gruppen in eine neue OU verschiebt. Hilft ein bisschen beim aufräumen!

<#
Requires Active Directory Module from Microsoft
#>
$SearchOU = “OU=Scripting,OU=Groups,DC=lab,DC=lan”
$DestinationOU = “OU=Empty,OU=Groups,DC=lab,DC=lan”
$EmptyGroups = Get-ADGroup -filter * -Properties members,memberof -searchbase $SearchOU | where {!$_.members} | where {!$_.membersof}
foreach ($EmptyGroup in $EmptyGroups)
{
$DN = $EmptyGroup.DistinguishedName
Move-ADObject -Identity $DN -TargetPath $DestinationOU
}

=IF(E2>0;E2/(8.64*10^11) – 109205;”")

format cell -> custom -> TT.MM.JJJJ hh:mm

macht aus: 129911227599857000
folgendes: 03.09.2012 05:12

hier noch der command um die user aus dem active directory zu exportieren:
csvde -m -n -u -f C:\export.txt -r (objectClass=user) -d “OU=Users,DC=contoso,DC=com” -l “DN, cn, homeDirectory, profilePath, lastLogonTimestamp”

vbs script erstellen und per gpo – logon script an alle benutzer verteilen.
vorher noch “Authenticated Users” die Berechtigung geben um im Computer Objekt die Description abzufüllen.

vbs script:
On Error Resume Next

Set objSysInfo = CreateObject(“ADSystemInfo”) ‘Bind to AD
Set objNet = CreateObject(“WScript.Network”)

strCompDN = objSysInfo.ComputerName ‘DN for computer, e.g. “CN=VISTAWORKSTATION,OU=Child OU Name,OU=Parent OU Name,DC=domain,DC=com”
Set objComp = GetObject(“LDAP://” & strCompDN) ‘IADsComputer object

strUserDN = objSysInfo.UserName ‘DN for user, e.g. “CN=John Smith,OU=Child OU Name,OU=Parent OU Name,DC=domain,DC=com”
Set objUser = GetObject(“LDAP://” & strUserDN) ‘IADsUser object

strUsrLogin = LCase(objNet.UserName)

objComp.Description = strUsrLogin
objComp.Put “extensionAttribute1″, strUsrLogin

objComp.SetInfo

source:

http://serverfault.com/questions/276299/add-last-user-logged-in-into-ad-users-and-computers-description-field