http://www.open-a-socket.com Perspectives on Active Directory, Exchange and more Mon, 02 Jan 2012 21:42:48 +0000 http://backend.userland.com/rss092 en   I’ve been working with the Windows Server 2008 R2 Active Directory cmdlets quite a bit recently.  If you’ve come from a background of using ADFIND, the cmdlets take a bit of getting used, but for me it’s definitely been worth the time spent.  One thing that frustrates me ... http://www.open-a-socket.com/index.php/2012/01/02/whats-in-a-name/ I came across an anomaly with the Exchange 2007 Export-Mailbox cmdlet at a customer site recently.  It created a major inconvenience for some bulk mailbox exports, so I thought I would share it here.  Basically, I was able to generate two different search results depending on whether or not I ... http://www.open-a-socket.com/index.php/2011/12/31/search-result-differences-with-export-mailbox/ Good books continue to deliver value long after the publication date.  Here's an example of how they helped repair a broken bed support recently. (with apologies to Gil Kirkpatrick, whose Active Directory Programming book has been a huge help to me over the last 10 years). PS. Details of how exactly the bed ... http://www.open-a-socket.com/index.php/2011/10/20/the-books-that-keeps-on-giving/ The objectGUID attribute is a little tricky to work with, especially if you want to use it as part of an LDAP filter.  This is because the value in stored within the directory as an octet string - essentially an array of one-byte characters.  This syntax is not especially user-friendly, ... http://www.open-a-socket.com/index.php/2011/09/23/powershell-script-to-find-objects-using-objectguid-value/ As promised, here are the Powershell data files from my Teched NZ 2011 demos.  I've also included the FSMO role mover script. te_2011.zip Let me know if you have any questions. Enjoy! http://www.open-a-socket.com/index.php/2011/08/25/teched-2011-new-zealand-powershell-files/ When preparing for a migration of AD objects from one forest to another it is useful to know if any of the names are going to conflict.  There are, as you probably know, a number of different naming attributes in AD, but the one most likely to cause problems in the event ... http://www.open-a-socket.com/index.php/2011/07/31/how-to-find-duplicate-samaccountnames-between-two-forests/ Something I often recommend to my customers is keep the membership of the Enterprise Admins and Schema Admins groups empty and only populate them (temporarily) when required.  The privileges assigned to these groups are obviously high and removing the members reduces the potential for costly mistakes and/or compromise.  Here's a quick ... http://www.open-a-socket.com/index.php/2011/05/01/how-to-clear-group-membership-with-powershell/ Many organisations choose to rename the Built-in Administrator account for the domain for security reasons.  Whether or not renaming the account provides any real protection is the matter of some debate.  What is clear is that any hacker worth his or her salt is not going to be fooled by ... http://www.open-a-socket.com/index.php/2011/05/01/how-to-find-the-renamed-domain-built-in-administrator-account-with-powershell/ Here's a little WMI script I threw together the other day to help someone out.  The requirement was to set the display name (label) of a network adapter based on its hardware location. Let's say we have a NIC with the display name "Local Area Connection" and you want to change ... http://www.open-a-socket.com/index.php/2011/04/25/powershell-script-to-change-nic-label-based-on-location/ If you’re looking for a Global Address List synchronisation solution for Exchange that simply uses Powershell, look no further than this excellent script from fellow MVP Carol Wapshere. http://www.wapshere.com/missmiis/a-galsync-powershell-script The script doesn’t leverage the DirSync control (and hence doesn’t use deltas), which means that it isn’t perhaps as ... http://www.open-a-socket.com/index.php/2011/04/17/gal-sync-with-powershell/