Reset Password and Force Change at Logon for an Entire OU:
\ndsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsmod user -pwd Password1 -mustchpwd yes<\/p>\n
Change “company” AD attribute for all Users in an Entire OU:
\ndsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsmod user -company “rmohan”<\/p>\n
Return the DN of all users in an OU:
\ndsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com”<\/p>\n
“CN=User1,OU=Singapore,OU=Staff,DC=rmohan,DC=com”
\n“CN=User2,OU=Singapore,OU=Staff,DC=rmohan,DC=com”
\n“CN=User3,OU=Singapore,OU=Staff,DC=rmohan,DC=com”<\/p>\n
Return the DN of all users in an OU, then get all the groups the users are a member of:
\ndsquery user “OU=Singapore,OU=Groups,DC=rmohan,DC=com” | dsget user -memberof<\/p>\n
“CN=Group1,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group2,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group3,OU=Singapore,OU=Groups,DC=rmohan,DC=com”<\/p>\n
Return the DN of all users in an OU, then get all the groups the users are a member of and use recursion:
\ndsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsget user -memberof -expand<\/p>\n
“CN=Group1,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group2,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group3,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group4,OU=Singapore,OU=Groups,DC=rmohan,DC=com”
\n“CN=Group5,OU=Singapore,OU=Groups,DC=rmohan,DC=com”<\/p>\n
Return the DN of all users in an OU, then get all the groups the users are a member of and use recursion. Then return the name of all the groups:
\ndsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsget user -memberof -expand | dsget group -samid<\/p>\n
samid
\nGroup1
\nGroup2
\nGroup3
\nGroup4
\nGroup5<\/p>\n
Get all the groups a user is a member of and use recursion. Then return the name of all the groups:
\ndsquery user “CN=User3,OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsget user -memberof -expand | dsget group -samid<\/p>\n
samid
\nGroup1
\nGroup2<\/p>\n
Create an OU:
\ndsadd ou “ou=Singapore,dc=rmohan,dc=com”<\/p>\n
Create a Group:
\ndsadd group “cn=Singapore Users,ou=Singapore,dc=rmohan,dc=com”<\/p>\n
Create a User:
\ndsadd user “cn=JoeUser1,ou=Singapore,dc=rmohan,dc=com”<\/p>\n
Add a User to a Group:
\ndsmod group “cn=SingaporeUsers,ou=Singapore,dc=rmohan,dc=com” -addmbr “cn=JoeUser1,ou=Singapore,dc=rmohan,dc=com”<\/p>\n
Find User Beggining with “J” and Return Matching Users “samid” and “department” Attributes:
\ndsquery user rmohanroot -name J* | dsget user -samid -dept<\/p>\n
Move an OU:
\ndsmove “ou=LiverpoolStreetOffice,dc=rmohan,dc=com” -newparent “ou=Singapore,dc=rmohan,dc=com”<\/p>\n
Rename and OU:
\ndsmove “cn=SingaporeUsers,ou=Singapore,dc=rmohan,dc=com” -newname SingaporeStaff<\/p>\n
Remove an OU and all its Subtree Without Prompting:
\ndsrm -noprompt -subtree “ou=deleteme,dc=rmohan,dc=com”<\/p>\n
<\/p>\n
<\/p>\n
Command ——————————- Description
\nDsadd computer
\nDsadd contact
\nDsadd group …………………………Adds objects to the directory
\nDsadd ou
\nDsadd quota
\nDsadd user<\/p>\n
Dsget computer
\nDsget contact
\nDsget group
\nDsget ou
\nDsget partition
\nDsget quota ………………………… Displays properties of objects in the directory
\nDsget server
\nDsget site
\nDsget subnet
\nDsget user<\/p>\n
Dsmod computer
\nDsmod contact
\nDsmod group
\nDsmod ou ………………………… Modifies select attributes of an existing object in the directory
\nDsmod partition
\nDsmod quota
\nDsmod server
\nDsmod user<\/p>\n
Dsquery *
\nDsquery computer
\nDsquery contact
\nDsquery group
\nDsquery ou
\nDsquery partition
\nDsquery quota …………………………Finds objects in the directory that match a specified search criteria
\nDsquery server
\nDsquery site
\nDsquery subnet
\nDsquery user<\/p>\n
Dsmove …………………..Moves any object from its current location to a new parent location or renames any object without moving it<\/p>\n
Dsrm ………………….. Removes an object, the complete subtree under an object in the directory, or both<\/p>\n
****************************************************************************<\/p>\n
LDAP attribute tag —————— Description
\nCN= ………………………………………Common name
\n……………………………………………..The name given to the object at creation
\nOU=…………………………………………Organizational unit
\n…………………………………………….The name of the container
\nDC=…………………………………………Domain component
\n………………………………………………The name of the domain<\/p>\n
<\/p>\n
dsquery ou dc=mohan,dc=com
\nThis command will produce a listing of all OUs<\/p>\n
dsquery user cn=users,dc=mohan,dc.com
\nIt is going to show all the users in the users container.<\/p>\n
dsquery servers -hasfsmo schema or (rid, name, infr and pdc.)
\nIt is going to show which server(s) has the schema role<\/p>\n
*****************************************<\/p>\n
dsadd ou “ou=northwest, dc=mohan, dc=com”
\nThis command tells Active Directory to create an OU called northwest<\/p>\n
dsadd user “cn=calvin jay, ou=northwest, dc=mohan, dc=com”
\nThis command will create an user named calvin jay in northwest OU<\/p>\n
*****************************************<\/p>\n
dsquery server -domain mohan.com | dsget server -dnsname ??\u201csite
\nFinds all domain controllers for domain mohan.com and display their DNS host name and site name<\/p>\n
dsget user “CN=Mike Jay,CN=users,dc=mohan,dc=com”-memberof ??\u201cexpand
\nShows the list of groups, recursively expanded, to which a given user belongs<\/p>\n
*****************************************<\/p>\n
dsmod computer CN=Server1,CN=Computers,DC=mohan,DC=Com -disabled yes
\nTo disable computer account<\/p>\n
dsmod user “CN=Don Jay,CN=Users,DC=mohan,DC=Com” -pwd A1b2c3d4 -mustchpwd yes
\nTo reset password and force him to change his password the next time he logs on to the network<\/p>\n
*****************************************<\/p>\n
dsmove “CN=Kim love,OU=Sales,DC=mohan,DC=Com” -newname “Kim Falls”
\nRenames a user object from Kim Love to Kim Falls<\/p>\n
dsmove “CN=Kim Falls,OU=Sales,DC=mohan,DC=Com” -newparent OU=Marketing,DC=mohan,DC=Com
\nMoves Kim Falls from the Sales organization to the Marketing organization<\/p>\n
*****************************************<\/p>\n
dsrm -subtree -noprompt -c OU=Marketing,DC=mohan,DC=Com
\nRemoves an organizational unit called “Marketing” and all the objects under that organizational unit<\/p>\n
dsrm -subtree -exclude -noprompt -c “OU=Marketing,DC=mohan,DC=Com”
\nRemoves all objects under the organizational unit called “Marketing,” but leaves the organizational unit intact<\/p>\n
<\/p>\n
<\/p>\n
Dsquery<\/p>\n
Powerfull tools and derivates:<\/p>\n
Dsquery \u2013 Queries Active Directory according to specified criteria
\nDsadd \u2013 Adds objects to Active Directory
\nDsget \u2013 Gets information about the object and displays its properties
\nDsmove \u2013 Moves objects in Active Directory
\nDsmod \u2013 Modifies specific from objects in Active Directory
\nDsrm \u2013 Deletes objects or a portion of them in Active Directory<\/p>\n
computer Accounts<\/p>\n
The whole syntax is the same you will find in Windows Help, so it doesn\u2019t make sense for me to me to copy the syntax in this blog.<\/p>\n
Daily taks in workstations:<\/p>\n
a) Create a workstation account:<\/p>\n
dsadd computer “computername” -desc “description”<\/p>\n
Real case:
\ndsadd computer “CN=computer2,OU=TORONTO,DC=mohan,DC=com”
\n-desc “MktPC” -loc “5th Floor\u201d
\nb) Reset a computer account(reset workstation account):<\/p>\n
If the workstations loses the trust to the domain, reset the account, you\u2019ll see an entry in event viewer so you can proceed with this task surely.<\/p>\n
dsmod computer “computername” -reset<\/p>\n
Real case:<\/p>\n
dsmod computer “CN=computer2,OU=TORONTO,DC=mohan,DC=com” \u2013reset<\/p>\n
c) You can also test the workstation security channel to the domain controller with this syntax too:<\/p>\n
nltest.exe \/server:PcMarketing \/sc_query:mohan.com<\/p>\n
You will have a similar output like this, if the channel is ok:<\/p>\n
Flags: 30 HAS_IP HAS_TIMESERV
\nTrusted DC Name \\\\DomainController02.mohan.com
\nTrusted DC Connection Status Status = 0 0x0 NERR_Success
\nThe command completed successfully<\/p>\n
d) Move a workstation account:<\/p>\n
dsmove ” computername ” -newparent “NewParentDN”<\/p>\n
Real case:<\/p>\n
dsmove “CN=PCTEST, OU=LOSTPCs,DC=mohan,DC=com” -newparent “OU=SALES,OU=MKT,OU=BOSTON,DC=mohan,DC=com”<\/p>\n
e) Let\u2019s clean the Active Directory from inactive workstations:<\/p>\n
If you use:<\/p>\n
Dsquery computer \u2013inactive 180<\/p>\n
It will only run in Windows 2003 domain functional level and localizes inactive PCs in the last 180 days.<\/p>\n
If you use:<\/p>\n
Dsquery computer \u2013stalepwd 180<\/p>\n
You will have a listing of suspect workstations that did not renew their passwords in the last 180 days against the domain controller. It\u2019s true, it can find some PCs that because of an operating system error, did not renew their passwords, but in most cases these are really few. Once you have have the script, you can delete or disable these workstation accounts.<\/p>\n
If you want to list AND move rogue workstations, run this query:<\/p>\n
for \/F %a in (‘dsquery computer -stalepwd 60’) do @dsmove %a -newparent OU=PCs,OU=Disabled,DC=mohan,DC=com<\/p>\n
these query puts these accounts in the OU \u201cDisabled\u201d, next you can modify the script to disable or delete these accounts.
\nf) Identify PCs in the \u201ccomputers\u201d container:<\/p>\n
Sometimes you check that some PCs have GPO conflicts or problems to download the GPO, it happens oft when they are for the first time added to the domain and not moved to their containers. So, identify and move them !!<\/p>\n
dsquery computer cn=computers,DC=mohan,DC=com>c:\\PCsOUcomputers.txt<\/p>\n
the query puts the result to a txt file, so you can later import it to an Excel.<\/p>\n
Tip:
\nYou want to see who is logged on that PCs, so download the tool pslogged from: www.sysinternals.com,
\nCopy it in your system32 path and execute psloggedon \\\\PCName then run:<\/p>\n
dsquery user -samid username | dsget user -fn -ln -display -office \u2013desc<\/p>\n
you identify so the user, location and other useful information to move that PC to the respective OU.<\/p>\n
Note: Don\u00b4t forget that for most scripts deployed to the domain and PCs, you should have the necessary admin rights.<\/p>\n
g) Get a listing on the fly from the workstations in the domain:<\/p>\n
dsquery computer \u2013limit 600<\/p>\n
or the import to version:<\/p>\n
dsquery computer \u2013limit 600>c:\\domainPCs.txt<\/p>\n
Note: Limit 600 refers to the quantity of workstations in the domain.<\/p>\n
User Accounts<\/p>\n
<\/p>\n
Daily \u201cUser Tasks\u201d:<\/p>\n
a) Adding users as a batch creation:<\/p>\n
for \/L %d in (1,1,50) do dsadd user cn=user%d,ou=OUTEST,dc=mohan,dc=com -pwd 12345678910 -office “BOSTON” -title “Operator” -dept Ingen -mustchpwd yes -canchpwd yes -disabled yes<\/p>\n
you get 50 dummy users to work in mohan environments or modify them to production users.<\/p>\n
The individual creation is simpler, here you get the syntax plus a login script option:<\/p>\n
dsadd user cn=dummyuser,ou=OUTEST,dc=mohan,dc=com -display DUMMY -pwd mypassword -office “BOSTON” -title “Operator” -dept Ingen -loscr scriptlogin.vbs -mustchpwd yes -canchpwd yes -disabled yes
\nb) User queries in the Active Directory_<\/p>\n
dsquery user and dsget user are veru useful together:<\/p>\n
Check the SAM account name, irst and last name:<\/p>\n
dsquery user | dsget user \u2013samid \u2013fn \u2013ln<\/p>\n
The same query in a specific OU:<\/p>\n
dsquery user “OU=Users,OU=Consulting,OU=BOSTON,OU=USA,DC=mohan,DC=com” | dsget user -display \u2013samid<\/p>\n
Move a user from one OU to another:<\/p>\n
dsquery user -name “USER1” | dsmove \u2013newparent “OU=BOSTON,DC=mohan,DC=com”<\/p>\n
Check which user accounts expire soon:<\/p>\n
dsquery user OU=BOSTON,DC=mohan,DC=com | dsget user -samid -fn -ln -acctexpires<\/p>\n
with this you work in a proactive environment and don\u00b4t bother to receive calls over the weekend.<\/p>\n
With this you get inactive users or suspected from inactivity(output to txt).<\/p>\n
dsquery user -stalepwd 90 \u2013limit 1000>c:\\users.txt<\/p>\n
Note: 1000 is the object quantity and you can import the txt to Excel for better manipulation.<\/p>\n
Find the group membership of a user:<\/p>\n
dsquery user -samid John | dsget user -memberof \u2013expand<\/p>\n
or with a better output, in a double piping:<\/p>\n
dsquery user -samid John | dsget user -memberof -expand | dsget group -samid<\/p>\n
Reset the user password:<\/p>\n
dsquery user -samid Cocoliso | dsmod user -pwd nuevopassword<\/p>\n
Check which users don\u00b4t have a login script assigned:<\/p>\n
dsquery * domainroot -filter “(&(objectCategory=Person)(objectClass=User)(!scriptPath=*))” -limit 0 -attr sAMAccountName sn givenName pwdLast Set distinguishedName<\/p>\n
Check which user names begin with z:<\/p>\n
dsquery user -name z*<\/p>\n
GROUPS<\/p>\n
For the next scripts, please refer to the Microsoft Help if you have doubts in terms of groups in Active Directory:
\nLet\u2019s practice some more and see more examples:<\/p>\n
a) Creating groups:<\/p>\n
Creating a security group with domain local scope:<\/p>\n
dsadd group “cn=DL_ING, ou=ULM, dc=mohan, dc=com” -secgrp yes -scope L<\/p>\n
Creating a security group with universal scope:<\/p>\n
dsadd group “CN=INGES,OU=Caracas,DC=mohan,DC=com” -samid “ING” -secgrp no -scope u<\/p>\n
b) Group membership<\/p>\n
Check which users belong to the Consulting Group:<\/p>\n
dsquery group -name Consulting | dsget group \u2013members
\nCheck which groups begin with g_, which scope they have and if they are security groups:<\/p>\n
dsquery group -name g_* | dsget group -dn -scope \u2013secgrp<\/p>\n
Or check the membership of a group itself:<\/p>\n
dsquery group -name G_Internet | dsget group -memberof
\nc) Changing Group membership<\/p>\n
Change the group membership from the domain users group to a specific group, G_DomainUsers:<\/p>\n
dsquery user -name * | dsmod group “CN=G_DomainUsers,CN=Users,DC=seattle,DC=cpandl,DC=com” – chmbr<\/p>\n
d) Move the members of a group to another group:<\/p>\n
dsget group “CN=GG_SALES,OU=OFC,DC=mohan,DC=com” -members | dsmod group “CN=G_INGES,OU=La Habana,DC=mohan,DC=com” -addmbr<\/p>\n
e) Mantaining Groups:<\/p>\n
Check the groups withouth members:<\/p>\n
dsquery * -filter “&(objectCategory=group)(!member=*)” -limit 0 -attr whenCreated whenChanged groupType sAMAccountName distinguishedName memberOf
\nCheck which users don\u00b4t belong to any group:<\/p>\n
dsquery * domainroot -filter “(&(objectcategory=person)(Objectclass=user)(!memberof=*))”
\nSERVERS<\/p>\n
Dsquery server<\/p>\n
To find all domain controllers in the domain mohan.com that are global catalog servers:
\ndsquery server \u2013domain mohan.com -isgc<\/p>\n
Finds all DCs and display their relative distinguished names, type:<\/p>\n
dsquery server -o rdn -forest<\/p>\n
Finds all DCs in the site BOLIVIA and display their relative distinguished names, type:<\/p>\n
dsquery server -o rdn -site BOLIVIA<\/p>\n
Finds the DC in the forest that holds the schema operations master role:<\/p>\n
dsquery server \u2013forest \u2013hasfsmo schema<\/p>\n
Finds all DCS for mohan.com and display their DNS host name and site name<\/p>\n
dsquery server -domain mohan.com | dsget server -dnsname \u2013site<\/p>\n","protected":false},"excerpt":{"rendered":"
Reset Password and Force Change at Logon for an Entire OU: dsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsmod user -pwd Password1 -mustchpwd yes<\/p>\n
Change “company” AD attribute for all Users in an Entire OU: dsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com” | dsmod user -company “rmohan”<\/p>\n
Return the DN of all users in an OU: dsquery user “OU=Singapore,OU=Staff,DC=rmohan,DC=com”<\/p>\n
“CN=User1,OU=Singapore,OU=Staff,DC=rmohan,DC=com” “CN=User2,OU=Singapore,OU=Staff,DC=rmohan,DC=com” “CN=User3,OU=Singapore,OU=Staff,DC=rmohan,DC=com”<\/p>\n
[…]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2848"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2848"}],"version-history":[{"count":3,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2848\/revisions"}],"predecessor-version":[{"id":2851,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2848\/revisions\/2851"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}