Move a List of PCs to a new OU

I needed to move 400 machine to a different OU and was provided a list.  So I spent 5 min and put this together.  Hope it helps someone.


Import-Csv "C:\temp\DistinguishedNames.csv" | ForEach-Object { Move-ADObject -Identity $_.DistinguishedName -TargetPath "OU=Computers,DC=YourDomain,DC=com" -Confirm:$false }

Get last boot time from a list

I was asked to reboot 60 some servers just because someone thought they hadn't rebooted in forever.  Being a skeptic I had to verify so I put this thing together from some googleing I did.

First line pulls in a list of machine names.  Second line makes the WMI call then the select.  Last line exports to a CSV.

$ComputerName = Get-Content -Path C:\temp\computers.txt

foreach ($Computer in $ComputerName) { Get-WmiObject win32_operatingsystem -ComputerName $Computer |

       select CSName, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime) } } |
   
              export-csv "C:\temp\Computers_LastBoot_Results.csv" -NoClobber -NoTypeInformation -Append

}

Find all accounts that have their password set to never expire

This guy was written to address accounts that are in violation of policy.  Password set to never expire is an easy dig on an audit for auditors.  I run this every 90 days and investigate where needed.  Once the investigation is complete and all exceptions are approved any object leftover gets its password set to (PasswordNeverExpires -eq $False).

Get-ADUser -filter { Enabled -eq $True -and PasswordNeverExpires -eq $True } –Properties * |Select-Object Name, SAMAccountName, Title, Enabled, WhenCreated, WhenChanged, PasswordNeverExpires, Description | Export-Csv 'C:\temp\Pass_Never_Expires.csv' -NoTypeInformation –NoClobber

You can always run this as a scheduled task and email it to yourself.  That info can be found here: http://mytechnicalsolution.blogspot.com/search/label/send-MailMessage

Ensure all accounts in the Disabled Accounts OU are Disabled

I noticed the help desk was enabling accounts and leaving them in the disabled accounts OU.  We have user based policies that get applied based on your departmental OU.  By not moving the account to the correct departmental OU these policies don’t get applied.  Causes user issues like drive mappings and printer mappings don’t get applied.  After talking with the manager of the help desk who discussed it with their team nothing changed.  This laziness caused un-necessary calls to the help desk where the help desk technician manually mapped drives and printers.  This extra work circumvented our standard process and needed to be fixed so I wrote this.

This script runs multiple times a day and disables every account in the disabled accounts OU.  Once I put this in place and communicated this was happening and should be zero impact to our customers as long as the help desk preformed their job correctly my standards were now being followed.

Start of script

###############################################################################

#  Script Name:   Disable_User_Accounts_in_Disabled_Accounts_OU.ps1

#  Created On:    02/26/2014

#  Author:        Joshua

#  Purpose:       Ensure all accounts in the Disabled Accounts OU are Disabled                                               

#  Last Modified: 04/28/2016

#  Last Modifier: Joshua

###############################################################################

Get-ADUser -Filter 'name -like "*"' -SearchBase "OU=Disabled Accounts,DC=YourDomain,DC=com" | Disable-ADAccount

End of script

Domain Replication Report

Years ago I would for a company that felt it needed a domain controller at every remote location against the advice of all of the employed SEs and SAs.  This caused some issues being that there were 90 domain controllers in the domain.  On an almost daily basis we had domain controllers go off line and start the 60 count down to tombstone.  So to make sure my co-workers were doing their job I wrote this to prevent a forced rip out of a tomb-stoned domain controller.  The original script was very simple only running RepAdmin.  Since then I have put in some additions like dcddiag.  It also will provide a list of machines that are currently in the computers container.  As you may know no group policies can be applied to these machines.  This was an addition so I could keep the helpdesk honest.  Hope this helps.

###############################################################################

#  Script Name:   Domain_Replication_Summary.ps1

#  Created On:    02/15/2009

#  Author:        Joshua & Matthew

#  Purpose:       Get Replication Summary and email to a group                                                     

#  Last Modified: 02/15/2016

#  Last Modifier: Joshua

###############################################################################

#Import-Modules

Import-Module ActiveDirectory

Add-PSSnapin Quest.ActiveRoles.ADManagement

#Variables

$date = Get-Date -Format yyyyMMdd

$aging = (Get-Date).adddays(-8).ToString("yyyyMMdd")

$aging2 = (Get-Date).adddays(-8).ToString("yyyyMMdd")

$log      = "C:\ST_Logs\Replication_Summary_Report_'$date'.txt"

$log2      = "C:\ST_Logs\DCDiag_Summary_Report_'$date'.txt"

$smtp = "YourSMTP.YourDomain.com"

$to = "Domain_Replication_Summary@ YourDomain.com "

$from = "DNR_Reports@ YourDomain.com "

$subject = "Domain Health Check $date"

$staging = dsquery computer "CN=Computers,DC=YourDomain,DC=com" -name *

$bodystart = "Please see attached logs.

Below computer accounts are in the Computers Container and need to be moved.
"

$body = $bodystart+$staging

# Run RepAdmin Commands

repadmin /replsummary | Out-File -FilePath $log

dcdiag /e /q /n:YourDomain.com | Out-File -FilePath $log2

# Remove all reports greater than 7 days old

Remove-Item "C:\PS_Scripts\Temp_Working\Replication_Summary_Reports\Replication_Summary_Report_'$aging'.txt" -recurse

Remove-Item "C:\PS_Scripts\Temp_Working\Replication_Summary_Reports\Replication_Summary_Report_'$aging2'.txt" -recurse

Remove-Item "C:\PS_Scripts\Temp_Working\Replication_Summary_Reports\DCDiag_Summary_Report_'$aging'.txt" -recurse

Remove-Item "C:\PS_Scripts\Temp_Working\Replication_Summary_Reports\DCDiag_Summary_Report_'$aging2'.txt" -recurse

#### Now send the email using \> Send-MailMessage

send-MailMessage -SmtpServer $smtp -To $to -From $from -Subject $subject -Body $body -BodyAsHtml -Priority normal -Attachments $log, $log2

Get a list of all domain controllers in the domain

With a geographically dispersed team I wanted to make sure our domain controller naming convention was consistent across the domain.  So I wrote this:

Start of script

Get-ADGroupMember 'Domain Controllers' | foreach { Get-ADComputer -identity $_.name -Properties * | Select-Object Name, IPv4Address, DNSHostName }

End of script

A few months later I was asked by an auditor to provide a list of al the domain controllers in my environment so I added this to the end of the script.

| export-CSV 'C:\temp\Domain_Controllers.csv' -NoTypeInformation -NoClobber

Document members of an AD group and when the account last logged in

I wanted a process to identify the members of our domain admins group and see if that account was being used.   This was to see if any admin accounts were being orphaned.  I also provide this list when auditors ask for all the domain admins group members, but in reality this script can be used to audit any AD group.

Start of script

Get-ADGroupMember -Identity 'Domain Admins' | foreach { Get-ADUser -identity $_.SAMAccountName -Properties * | Select-Object name, @{Name="Password Last Set"; Expression={[DateTime]::FromFileTime($_.pwdLastSet)}}, LastLogonDate, @{Name="Last Logon Time Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} }

End of script

If you want to export this to CSV add this to the end.

| Export-Csv 'C:\temp\Domain_Admin_Members_and_Last_Logon.csv' -NoClobber –NoTypeInformation

You can also use the Send-MailMessage command to email the csv as an attachment.  The command can be found here: http://mytechnicalsolution.blogspot.com/search/label/send-MailMessage