Archive for the ‘.net’ Category

Find Disabled and Inactive User and Computer Accounts using Powershell – Part II

Part I demonstrated how to find aged or inactive accounts, and in Part II we will look at another lingering account type: disabled accounts.

Like inactive accounts, Directory Searchers also come in handy for disabled accounts. We can also, however, read an Active Directory account’s status directly from a hidden attribute on the ADSI object. Let’s start with the Directory Searcher method. This entry also draws from Bahram’s Blog. The code:

$adobjroot = [adsi]''
$objdisabsearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)
$objdisabsearcher.filter = "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"
$resultdisabaccn = $objdisabsearcher.findall() | sort path

Read more…


Find Disabled and Inactive User and Computer Accounts using Powershell – Part I

We’ll start off with Inactive accounts first, and then work on the disabled accounts after that.

Active Directory in Server 2003 has a nice user/computer attribute called lastLogonTimeStamp that can help us keep track of inactive accounts. If you have ever tried to use that attribute, however, you might have come up with something like this…

Read more…

Bulk Rename Files with Sequential Index

I am pretty sure I’m not the only one who wants something more descriptive than DSC1900298.JPG to name my digital photos. And yes, I know that Windows Explorer allows you to rename pictures en masse, but I don’t like the convention they have chosen in that the first file is named [common name].JPG, then the subsequent files are named [common name] (2).JPG and so on and so forth.

I had a few requirements for how I wanted to go about this:

  1. Get rid of the parentheses. If I will be posting those pics online anywhere, I wanted to keep the names as free of special characters as I can.
  2. Number the first file. The Windows Explorer route does not number the first file when doing bulk renames. This is easy enough to do manually, but I just don’t want to bother.
  3. Keep a constant number of digits in the index number. I want the renaming process to take into account how many pictures there are and adjust the number of index digits accordingly. If there are fewer than 10 files/images, then only 1 digit is required (e.g. 1, 2, 3, 4…9). If there are between 10 and 99 files (inclusive), then two digits are required (01, 02, 03…10, 11, 12…99). I think you get the idea. Windows definitely doesn’t do that.

Read more…

Take ownership of files and folders through script

As part of our process to disable user accounts, we take ownership of the user’s server-stored documents such as roaming profiles and redirected My Documents directories. We then either keep access restricted to the domain admins group or grant access to a replacement user who should receive access to the departed user’s files.

With an upgrade to Exchange 2007, we have taken advantage of the Powershell access to Exchange objects, and have scripted the mailbox provisioning and account disable processes. One of the sticking points in getting the disable script wrapped up was seizing control of the user’s directories. Now, Powershell does have the ability to modify ACL’s through the New-Acl and Set-Acl cmdlets (links below), but the users have exclusive access to their server-side directories. It is easy enough to take ownership of a directory through the Windows Explorer Security dialog, but the Powershell methods all presented some form of error when trying to set permissions or change ownership on a file system object to which you do not already have access to.

Read more…

Resize VHD Files

This topic has been covered a bit (here, here, and here, for instance) but I have been working on a project that utilizes Virtual Server for testing, and it came up again. A consultant that was working on the VM’s in question apparently struggled for quite some time before he asked for help on it. So, I thought I would see if another post on this might help someone out.

If you run into a situation where you have existing Microsoft Virtual Server/PC VHD files, but the sizes you created them with initially simply don’t cut it anymore, there is hope!

What you will need:

  • Original VHD file (obviously)
  • VhdResize from vmtoolkit
  • Spare disk space
  • .Net 2.0 installed on the machine you will be using for the process

The beauty of the tool is that it can be without having to be installed (self-contained). Just extract the zip, double-click the VhdResize.exe executable, select your source file and destination VHD, and away you go! The VhdResize also allows you to convert from fixed-size VHD’s to dynamically-expanding VHD’s as well, and it is non-destructive on your source VHD.

Note that this only increases the size of the VHD, so that, effectively, your VM will see a larger physical hard disk present; it does not resize partitions on that drive. For that, you can either use Disk Management or diskpart in your guest VM, or mount the VHD using the vhdmount utility included in Virtual Server and use those disk utilities from your host OS (quick walkthrough here).

Let me know if that’s of use!

Modifying Group Memberships with Powershell, Part II

I had hoped to put this all in one post, but the thing would have gone on forever! Part I covered some basics in copying group memberships to an Active Directory user from another user, such as a template account, using Powershell. Part II will delve into my misadventures in gaining more control of user group memberships, including removing users from a group either by editing the group’s attributes or editing the user’s attributes. I was also looking for a way to change dial-in permissions on user accounts, and that will be covered by a similar strategy.

While these examples should be less dependent on the MS Exchange 2007 snap-in for Powershell and Powershell Community Extensions, please note that I have not checked through the code samples to confirm what is purely Powershell and what requires those snap-ins.

Read more…

Modifying Group Memberships with Powershell, Part I

I recently had to spend hours figuring out how to properly modify Active Directory group memberships using Powershell. Some of the .Net methods have not yet been implemented, so I had to get a bit tricky with it. I could find the various bits of information I needed in various places, so I hope that collecting them here in one place is of some use to others.

The scenario was that I needed to disable user accounts in a Windows Server 2003 Active Directory environment running with Exchange 2007. We have a fairly customized, hosted Exchange environment, and so disabling a user is not just a simple matter and right-clicking and disabling the account in Active Directory Users and Computers (ADUC); we have a 2-page doc for the process to catch everything from removing group memberships to setting up email forwarding or restrictions, changing dial-in permissions, changing NTFS permissions on profile directories, etc.

Read more…