In-Production Active Directory Password Expiration Notification

It's been about a year now that we have used this powershell script in-production to email-notify users of their soon-to-expire or already-expired Active Directory passwords.

Maybe it's not perfect, but it works very well! (You have to schedule it to run daily.) Enjoy.


Please consider crypto tipping:
  

Concise ShadowGroup Powershell Scripts

The definition of a shadowgroup is simply the synchronization of members in an Active Directory OU to the memberships of an Active Directory Group.

Thanks goes to David K. Sutton for his post at ravingroo.com.

One caveat of his concise script was that Get-ADGroupMember, by default, has a limit of 5000 objects returned. Other internet sources reported an easy workaround by using the member property of the get-adgroup cmdlet.

So I present to you modified versions of a concise ShadowGroup powershell script. One no-frills version, and another with email support.

~~~
  

GPO Map Drive Login Script not working

Problem: Active Directory Group Policy Logon Script to Map Drive fails to execute when applied to specified A.D. Group.

Likely Cause: The GPO “Security Filtering” must also include computers, not just the Groups.

Solution: Set the “Security Filtering” to include “Domain Computers” as well as the desired user groups.

  

PowerShell list users with Expired Passwords

Get-ADUser -filter {Enabled -eq $True -and PasswordExpired -eq $True} -Properties "DisplayName"


Please see this for automated expiration emails: https://steronius.blogspot.com/2018/04/in-production-active-directory-password.html


  

Different password policies for different OU's don't work

Problem: Different password policies for different OU’s don’t work.

Reason: Password Policy is a domain-policy and may only be applied at the top domain-level.
Solution: Enable FGPP (Fine Grain Password Policy) via ADSI (Active Directory Services Interface) Editor and Apply a new PSO (Password Settings Object) against a Security Group. Optionally, such a group can be made to sync memberships with members of an OU with the concept called “Shadow Group[ing]” which will require custom scripting to do so.

Awesome Resources to solve your problem:

Initial answer to why cannot use multiple GPO’s:
http://windowsitpro.com/security/q-can-i-apply-different-password-policy-two-different-active-directory-ad-organizational-un
FGPP – Fine Grain password Policy:
http://www.grouppolicy.biz/2011/08/tutorial-how-to-setup-default-and-fine-grain-password-policy/
LockoutDuration value = “(never)” for permanent lock.
PSO value documentation: https://technet.microsoft.com/en-us/library/cc754461(v=ws.10).aspx
FGPP Documentation https://technet.microsoft.com/en-us/library/cc754544(v=ws.10).aspx
FGPP on Win12 or PowerShell: http://www.brandonlawson.com/active-directory/creating-fine-grained-password-policies/
Shadow Group:
*** CONCISE PowerShell ShadowGroup Script: http://ravingroo.com/458/active-directory-shadow-group-automatically-add-ou-users-membership/     Modified with email https://gist.github.com/meoso/301f2e94306dcf2d3714c26ca5518932
http://www.adaxes.com/tutorials_AutomatingDailyTasks_AutomaticallyChangeGroupMembershipUsingScripts.htm
http://ahultgren.blogspot.com/2011/07/shadow-groups-in-active-directory.html
http://tookitaway.co.uk/ad-shadow-groups-with-windows-powershell-an-update/
https://github.com/davegreen/shadowGroupSync
Δ http://myitforum.com/myitforumwp/2012/05/08/creating-and-managing-shadow-groups/
See your created PSO via commandline:
dsquery * "CN=Password Settings Container,CN=System,DC=NICHOLLS,DC=EDU" -attr *
See the effective PSO of a user:
dsget user <userDN> -effectivepso

Please consider crypto tipping:
  

PBISOpen Error: ERROR_FILE_NOT_FOUND (2)

TL;DR :

• Error: ERROR_FILE_NOT_FOUND (2)
• $ sudo apt-get install samba-client
• sudo nano /etc/nsswitch.com #edit to contain "hosts: files dns [...]"

--------------------

PBISOpen (Power Broker Identity Services Opensource edition) is a Active Directory authentication system for *nix.  Read as: "Join Domain" for *nix.

I repeatedly failed to install this on a new Debian Jessie (Testing) machine with the " Error: ERROR_FILE_NOT_FOUND (2)" as the result.

It turned out I had to install "samba-client" and it was important to follow the details in this link especially regarding /etc/nsswitch.conf to contain "hosts: files dns [whatever-else-exists]" where dns is second and before any other entries.

so instead of:

Importing registry...

Error: /opt/pbis/bin/lwsm shutdown returned 1 (aborting this script)
Error: ERROR_FILE_NOT_FOUND (2)

dpkg: error processing package pbis-open (--install):
subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
pbis-open
Error installing /home/user/Dropbox/NSU/PBISOpen/pbis-open-8.0.1.2029.linux.x86_64.deb/./packages/pbis-open_8.0.1.2029_amd64.deb
user@skynet:~/Dropbox/NSU/PBISOpen/pbis-open-8.0.1.2029.linux.x86_64.deb $ sudo /opt/pbis/bin/lwsm shutdown
Error: ERROR_FILE_NOT_FOUND (2)


i saw:

Importing registry...

Selecting previously unselected package pbis-open-gui.
(Reading database ... 162521 files and directories currently installed.)
Preparing to unpack .../pbis-open-gui_8.0.1.2029_amd64.deb ...
Unpacking pbis-open-gui (8.0.1.2029) ...
Setting up pbis-open-gui (8.0.1.2029) ...
Installing Packages was successful

New libraries and configurations have been installed for PAM and NSS.
Please reboot so that all processes pick up the new versions.

As root, run domainjoin-gui or domainjoin-cli to join a domain so you can log on
with Active Directory credentials. Example:
domainjoin-cli join MYDOMAIN.COM MyJoinAccount


good luck.

Please consider crypto tipping:
  

Disk Cleanup utility (CleanMgr) on Windows 2008 R2 Active Directory

Do you need 4GB+ cleaned from a Windows 2008 R2 Active Directory Domain Controller?

In the past, Windows 2008 servers infamously stored obsolete program/update backups in C:\Windows\winsxs\ and there was no safe/supported way to cleanup.  A May 2014 update now allows cleanup.  Reference: http://blogs.technet.com/b/askpfeplat/archive/2014/05/13/how-to-clean-up-the-winsxs-directory-and-free-up-disk-space-on-windows-server-2008-r2-with-new-update.aspx

The cleanup utility can be installed as per the reference: https://support.appliedi.net/index.php?/Knowledgebase/Article/View/992/0/how-to-enable-the-disk-cleanup-tool-on-windows-server-2008-r2

To simplify this, here are the commands (specific to Windows 2008 R2 64bit):

copy %systemroot%\winsxs\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_c9392808773cd7da\cleanmgr.exe %systemroot%\System32\

copy %systemroot%\winsxs\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9cb6194b257cc63\cleanmgr.exe.mui %systemroot%\System32\en-US\

cleanmgr.exe

Select your OS Drive, then Check-mark the Service Pack Backup Files, and continue.

You should regain 4+GB on a Domain Controller (at least that is my experience).

When run on non-domain server, the I've found the Service Pack Backup Files was always 0 bytes.  Unsure why, but your mileage may vary.

If you have a non-R2 or non-64bit, follow the 2nd link referenced (Follow option 2).

Good luck.

----------

Please consider crypto tipping:
  

Batch file: For each live computer in a domain, do something

Need a batch file to perform an action, executable, or script for online domain members only?

Here, for simplicity, our do-something is "echo computer-name is online":

Save the following to a batch file: (two % signs are needed in batch files, one % if at the command-prompt)


@echo off

dsquery * domainroot -filter "(&(objectCategory=Computer))" -limit 0 -attr cn > computers.txt

for /f %%i in (computers.txt) do (
   ping -n 1 -w 500 %%i | find "Lost = 0">NUL && echo %%i is online || echo %%i is offline
)

del computers.txt


This can easily be changed to work on a specific OU and skip sub-OU's (-scope onelevel):

dsquery * "OU=EXAMPLE_OU,DC=EXAMPLE,DC=COM" -filter "(&(objectCategory=Computer))" -limit 0 -attr cn -scope onelevel > computers.txt

So your do-something could be powerful when combined with commands like:
psexec.exe \\%%i some-command
or
START /B some-batch-calling-psexec.bat

You could get fancy and do multiple things by enclosing them in ( ) but separating them with &:
( echo %%i online & script.bat %%i)


So here is an example batch file that runs "gpudate /target:computer /force" on the Computers OU and it's sub OU's (This assumes you are logged in with administrative privileges):

@echo off
setlocal enableextensions enabledelayedexpansion

dsquery * "OU=Computers,DC=EXAMPLE,DC=COM" -filter "(&(objectCategory=Computer))" -limit 0 -attr cn > computers.txt

for /f %%i in (computers.txt) do (
ping -n 1 -w 500 %%i | find "Lost = 0">NUL && ( echo !time! %%i ONline, Launching... & START /B psexec.exe \\%%i -e -d -s -low gpupdate /target:computer /force ) || echo !time! %%i OFFline
)

del computers.txt
echo.


--------------

Please consider crypto tipping:
  

run commands against AD domain members via flexcommand.hta

Execute commands against AD Domain Members via web-interface.

Thanks to the article How to Force Remote Group Policy Processing, I found "flexcommand.hta" compliments of Mr. Jakob H. Heidelberg of Copenhagen, Denmark.

First, I've repaired the original for use on Windows7 and 2008 as per Mr. Eirik Andreassen's comment.

I've also edited the original to allow for larger fields including the OU dropdown box and enabled the "sub-OU's" and "alive-only" options by default. 

Download the full flexcommand.hta here or the diff patch to compare.  It has to be run with domain admin privileges and without UAC.

Here are some useful example psexec commands:

psexec.exe \\{C} -e -h -d gpupdate.exe /force

psexec.exe \\{C} -e -h -d wuauclt.exe /reportnow

psexec.exe \\{C} -e -h -d \\example.com\netlogon\WUInstall.exe /install /criteria "IsHidden=0 and IsInstalled=0 and IsAssigned=1"
(depends on WUInstall on accessible share)

Enjoy.
-----------------

Please consider crypto tipping: