Active Directory configuration snapshot

‘Sup PSHomies,

Back in the days I had some vbs scripts to make a quick assessment of whatever  Active Directory I was working on. Guess it’s time to upgrade to PowerShell! 😉

Ever since I read the book on Big Data: A Revolution That Will Transform How We Live, Work, and Think, I’ve started looking at my datasets differently. When gathering data, we usually assume that our dataset has a singular purpose to which its value is tied.

By not being overly occupied with filtering the dataset we can always revisit and probably gain more insight we hadn’t thought of at the time. (I’ll demonstrate later on). Let’s dive in!

	<#
	Author: I. Strachan
	Version:
	Version History:
	Purpose: Get ADConfiguration for current Domain
	#>
	[cmdletbinding()]
	Param()
	Import-Module ActiveDirectory -Verbose:$false
	#HashTable to save ADReport
	$ADSnapshot = @{}
	#region Main
	$ADSnapshot.RootDSE = $(Get-ADRootDSE)
	$ADSnapshot.ForestInformation = $(Get-ADForest)
	$ADSnapshot.DomainInformation = $(Get-ADDomain)
	$ADSnapshot.DomainControllers = $(Get-ADDomainController -Filter *)
	$ADSnapshot.DomainTrusts = (Get-ADTrust -Filter *)
	$ADSnapshot.DefaultPassWordPoLicy = $(Get-ADDefaultDomainPasswordPolicy)
	$ADSnapshot.AuthenticationPolicies = $(Get-ADAuthenticationPolicy -LDAPFilter '(name=AuthenticationPolicy*)')
	$ADSnapshot.AuthenticationPolicySilos = $(Get-ADAuthenticationPolicySilo -Filter 'Name -like "*AuthenticationPolicySilo*"')
	$ADSnapshot.CentralAccessPolicies = $(Get-ADCentralAccessPolicy -Filter *)
	$ADSnapshot.CentralAccessRules = $(Get-ADCentralAccessRule -Filter *)
	$ADSnapshot.ClaimTransformPolicies = $(Get-ADClaimTransformPolicy -Filter *)
	$ADSnapshot.ClaimTypes = $(Get-ADClaimType -Filter *)
	$ADSnapshot.DomainAdministrators =$( Get-ADGroup -Identity $('{0}-512' -f (Get-ADDomain).domainSID) | Get-ADGroupMember -Recursive)
	$ADSnapshot.OrganizationalUnits = $(Get-ADOrganizationalUnit -Filter *)
	$ADSnapshot.OptionalFeatures = $(Get-ADOptionalFeature -Filter *)
	$ADSnapshot.Sites = $(Get-ADReplicationSite -Filter *)
	$ADSnapshot.Subnets = $(Get-ADReplicationSubnet -Filter *)
	$ADSnapshot.SiteLinks = $(Get-ADReplicationSiteLink -Filter *)
	$ADSnapshot.ReplicationMetaData = $(Get-ADReplicationPartnerMetadata -Target (Get-ADDomain).DNSRoot -Scope Domain)
	#endregion
	#region Export to XML
	$exportDate = Get-Date -Format ddMMyyyy
	$ADSnapshot | Export-Clixml .\export\dsa\ADReport-$($exportDate).xml -Encoding UTF8
	#endregion
	#region AD Queries
	$ADSnapshot.DomainControllers | Format-Table Name,OperatingSystem,IPv4Address,Site
	$ADSnapshot.DomainAdministrators | Format-Table Name
	$ADSnapshot.ForestInformation.GlobalCatalogs
	$ADSnapshot.ForestInformation | Format-Table SchemaMaster,DomainNamingMaster
	$ADSnapshot.DomainInformation | Format-Table PDCEmulator,RIDMaster,InfrastructureMaster
	$ADSnapshot.OrganizationalUnits | Format-Table Name,DistinguishedName
	$ADSnapshot.Sites | Format-Table Name
	$ADSnapshot.Subnets | Format-Table Name
	$ADSnapshot.SiteLinks | Format-Table Name,Cost,ReplicationFrequencyInMinutes
	#endregion
	#region Compare Objects
	#Get previous ADReport
	$SavedADSnapshot = Import-Clixml .\export\dsa\ADReport-22032016.xml
	#Compare Forest FSMO roles
	Compare-Object $SavedADSnapshot.ForestInformation $ADSnapshot.ForestInformation -Property SchemaMaster,DomainNamingMaster -IncludeEqual
	#Compare Domain FSMO roles
	Compare-Object $SavedADSnapshot.DomainInformation $ADSnapshot.DomainInformation -Property PDCEmulator,RIDMaster,InfrastructureMaster -IncludeEqual
	#endregion

view raw

Get-ADConfiguration.ps1

hosted with ❤ by GitHub

I’ve create a hashtable to save all necessary bits for further processing. Noticed I didn’t filter just gathered all possible information (-Filter *)

Quick side step: I’ve exported the Object using Export-Clixml for future use, to be continued… 😉

The fun really begins when we run queries against $ADSnapshot

Let’s take $ADSnapshot.DomainControllers as an example

How many DomainControllers are there?

@($ADSnapshot.DomainControllers).Count

What are their names?

$ADSnapshot.DomainControllers | Format-Table Name,

Here’s where the added value comes in. If we had opted for a singular purpose dataset then that would have been all the data we could have extracted. Suppose I want to know which site the Domain Controller resides in?

$ADSnapshot.DomainControllers | Format-Table Name,Site

But there’s even more data you could extract. Have a look at the properties available:

$ADReport.DomainControllers | Get-Member -MemberType Property

Need the Partitions?

$ADReport.DomainControllers.Partitions

How about the ports available?

$ADSnapshot.DomainControllers | Format-Table *Port

I think you get the idea… 😉

There’s even an added bonus I hadn’t thought of… remember the export using Export-Clixml? Well we can use that to compare previous Snapshots

Did the FSMO Roles Change since last snapshot?

Compare-Object $SavedADSnapshot.DomainInformation $ADSnapshot.DomainInformation -Property PDCEmulator,RIDMaster,InfrastructureMaster -IncludeEqual

So there you have it, Active Directory configuration snapshot! By gathering all possible information first and processing later on, we can uncover additional information if needed… I’ve been in a situation where I had a limited window to gather Active Directory information… The pressure! If I missed any bit, then that was it, I didn’t get a second chance! Now I can gather all possible information and revisit the dataset on the off-chance I missed something the first time…

Next time I’ll show you how to create a HTML report using the saved $ADReport… 😉

Hope it’s worth something to you.

Ttyl,

Urv

Coding for speed

The results are in! Great summary about the Hadoop PowerShell Challenge by Stephen Owen! It was fun to see the different approaches. When it comes to speed you can’t beat native C# code! Great tips! Worth the read!

RoboCopy ExitCodes the PowerShell way

‘Sup PSHomies!

Boe Prox recently blogged about building a enum that supports bitfields in PowerShell, definitely worth the read!

The first thing I thought about was RoboCopy! As you may or may not know, I’m a huge fan (no pun intended) of RoboCopy! I know that RoboCopy returns exitcodes, I just  didn’t do anything with it. Instead of relying on the exitcode, I’ve created a Get-LogSummary script to give me an overview of what failed or succeeded. Now that I see how easy it can be, why not give it a try? 😉

I’m running Windows 10 so I went with the PowerShell 5.0 version

	[Flags()] Enum RoboCopyExitCodes{
	NoChange = 0
	OKCopy = 1
	ExtraFiles = 2
	MismatchedFilesFolders = 4
	FailedCopyAttempts = 8
	FatalError = 16
	}
	(0..16).ForEach{
	[PSCustomObject]@{
	Number = $_
	ExitCodes = [RoboCopyExitCodes]$_
	}
	}

view raw

RoboCopyExitCodes.ps1

hosted with ❤ by GitHub

So let’s give it a run!

#Start RoboCopy
$source  = '.\c#'     #Choose a source
$target  = '.\temp'   #Choose a target

robocopy $source $target /MIR

[RoboCopyExitCodes]$LASTEXITCODE

The target isn’t empty. I’m using /MIR to make a point. Be careful when choosing your target!

So the first run gave an exitcode of 3

Nice!

A second run gave an exitcode of 0

No change indeed!

As a first impression, could be useful… So there you have it! RoboCopy exitcodes the *ahem* PowerShell way! 😛

Hope it’s worth something to you

Ttyl,

Urv