Windows Server 2012 R2 Preview - Schema Version

I previously posted  a "quick-hitter" blog about the schema version in Windows Server 2012. 

Windows Server 2012 R2  preview was released today! The current version is 69 

I once again used adfind to quickly find the schema version.

For those that prefer to use powershell; you can also find the object version that way. 

The current (as of 25 June 2013) Active Directory Schema version table is listed below.

Windows Server 2012 R2 Preview	69
Windows Server 2012	56
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

You can download an evaluation copy of Windows Server 2012 R2  and go start to learn and have fun.  Thanks to all the hard work put in by the many people at Microsoft that made today happen.

Windows 2012 AD Schema Version

I previously posted  "quick-hitter" blogs about the schema versions in   Windows 8 Developers Preview, Windows Server 8 Beta

Windows Server 2012 was released today!!   The schema version did not change from the RC version.  The final version is  56 

I once again used adfind to quickly find the schema version.

The final Active Directory Schema version table is listed below.

Windows Server 2012	56
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

MVP Brian Arkills posted a link to the changes made in adprep in Windows 2012 from version 48 to 56.  You can find that here

Windows Server 2012: Changes made by adprep.exe

You can download an evaluation copy of Windows Server 2012 and go start to learn and have fun.  This will be an OS that most of us will be using for the next 10+ years and it is an exciting day for those of us in the Windows Server world.   Thanks to all the hard work put in by the many people at Microsoft that made today happen.

Find Inactive Users using Powershell

This is a quick hitter that came about when I was chatting with a few friends online.   We were talking about finding inactive users using powershell.   We also wanted to output their userid(samaccountname) and their last logon time.

In this case the LastLogonTimeStamp attribute was good enough for this query.  Note that this attribute is replicated but it is 9-14 days behind the current date

For full disclosure this is something I'd usually use oldcmp for but in this case the customer wasn't allowing third party tools.

The main problem I was having was the output of LastLogonTimeStamp via powershell.  The date doesn't get automatically converted from its native 64 bit format.  Luckily the Microsoft team has included the LastLogonDate which is the conversion of the LastLogonTimestamp.  MVP Richard Mueller has a great explanation of the LastLogonDate attribute in Powershell    It is important to emphasize that LastLogonDate is not an actual Active Directory attribute.  LastLogonDate was key otherwise it makes this query more complex because we would have had to include a conversion into the command.

For the query I went with the search-adaccount cmdlet.  We were looking for accounts that had not been active within 90 days

search-adaccount -usersonly -accountinactive -timespan "76" | select-object samaccountname, lastlogondate

If you want to export that to a CSV then that command can be piped into export-csv

search-adaccount -usersonly -accountinactive -timespan "76" | select-object samaccountname, lastlogondate | export-csv Users.csv

Why did I choose 76 instead of 90?  That goes back to the DS blog about lastlogontimestamp being up to 14 days behind.

Active Directory Administrative Center also has some handy built-in searches that can help if you prefer a GUI

Update  Good friend and Microsoft PFE Eric J suggested that I add a screenshot with the Windows 2012 version of ADAC and the powershell history viewer output.  Great suggestion Eric!

The powershell command in the history viewer is interesting. I like the version above a lot better :)

Get-ADObject -LDAPFilter:"(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(|(lastLogonTimestamp<=129888720000000000)(!lastLogonTimestamp=*)))" -Properties:allowedChildClassesEffective,allowedChildClasses,lastKnownParent,sAMAccountType,systemFlags,userAccountControl,displayName,description,whenChanged,location,managedBy,memberOf,primaryGroupID,objectSid,msDS-User-Account-Control-Computed,sAMAccountName,lastLogonTimestamp,lastLogoff,mail,accountExpires,msDS-PhoneticCompanyName,msDS-PhoneticDepartment,msDS-PhoneticDisplayName,msDS-PhoneticFirstName,msDS-PhoneticLastName,pwdLastSet,operatingSystem,operatingSystemServicePack,operatingSystemVersion,telephoneNumber,physicalDeliveryOfficeName,department,company,manager,dNSHostName,groupType,c,l,employeeID,givenName,sn,title,st,postalCode,managedBy,userPrincipalName,isDeleted,msDS-PasswordSettingsPrecedence -ResultPageSize:"100" -ResultSetSize:"20201" -SearchBase:"DC=MK2012,DC=com" -SearchScope:"Subtree" -Server:"w2012DC1.MK2012.com"


The issue I have with the ADAC method is that it doesn't allow the user to export the findings and include the   LastLogonTimeStamp date in a converted form.


I'm looking forward to other suggestions comments on how to improve this powershell command.   Remember we are talking quick-hitter one liner here.

Is It a Domain Controller

I recently went into our test lab and there was a guy working in there and he asked me.

If I'm on a machine how do I know if it is a Domain Controller

These are often my favorite types of questions.  No time to check Bing/Google, no time to check a book.  Just a quick question that is answered in seconds.   By the way in those situations it is also ok to say "I don't know" or "I'll get back to you".  A lot of times you will see people blowing smoke and making stuff up.

The guy wasn't trying to be an ass but trying to learn AD and the lab is a perfect place for it.  We have a lot of VMs in our lab and I didn't know what box he was on when I walked in.

My initial thought was to tell him to look for admin tools etc but then after a second I realized not every box has the admin tools installed.  Then I thought look for the AD Domain Services and see if they are started.  That thought lasted for a half second.  We still have 2003 DCs too so if he was on one of those then no services.

The answer I gave him was to run:

net share 

If the sysvol share is present then it is a domain controller.

I started thinking of other ways and reached out to some friends and asked what they would have suggested for this quick question.


One suggestion by my friend Troy was to run


netdom query dc


I thought that was a good one and team that with hostname so that the person knows the name of the machine works great.

My buddy Eric had a good one, it is a bit more involved because it would require the person to know about AD ports...but if they are learning they should know some of these. Use netstat -ano and look for AD ports (88, 389, 3268, and others)

netstat -ano  or netstat -ano | findstr /i listening

There are a lot of ways to do this.  You could look for SRV records.  If ADUC was installed you could have them check there for the DC.

If you also look at the drop down when you login and it has no local server name then that is another good indication.  In this case he was already logged in.

So what answers would you have given?  Are there quicker easier ways that you would have told someone just starting out with AD to check if they are at a domain controller?

Update from Kurt (thanks for your service in the Army...in war zones).    I posed this question to a mid-level AD admin.  His response was "run dcpromo, it will tell you if it is a DC".   That is true and something I didn't think of in the 5 second response.  This is why I love AD...so many ways to do something and a lot of great solutions.

My only caveat about this method is that if someone was being careless didn't read and clicked next next and finished the wizard then they could also be demoting a DC....I'm hoping people using AD can read :)

In the example below the computer is obviously a DC.

Note: The dcpromo method won't work in Windows 2012...because they killed that off...more on that in future posts.   I'm guessing very few folks are currently running Windows 2012 in production.  Example of start > run > dcpromo on a Windows 2012 DC below.

Update 2: Krzystof  had a great suggestion in the comments and that was to use systeminfo 

systeminfo /i "os configruation"

Windows Server 8 Beta - Schema Version - Update

I previously posted a "quick-hitter" blog about the Active Directory Schema version in Windows 8 Developers Preview.

Windows Server 8 Beta has been out for over a week now and I have a domain controller in my lab for testing.  The schema version is now 52


I once again used adfind to quickly find the schema version.

I've updated the Active Directory Schema version table below.

Windows Server 8 Beta	52
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

Find Non Replicated Attributes in Active Directory

The quick hitter series is back and this entry was inspired by a colleague (thanks Funk!)

If you are querying AD you may get inaccurate results if you are querying an attribute that is not replicated between all domain controllers.   Two common attributes I see people having issues with are lastlogon and whenchanged.  The issue here is suppose you query for lastlogon and get a value.  That may not be accurate as there may be a newer value on another DC.  On a side note for that issue lastlogontimestamp is usually good enough for most folks...but I digress.

Is there a way to find what attributes are not replicated between DCs?  The answer to that is yes and there are various methods to find this information.  I once again go to the great ADFIND tool from MVP Joe Richards   Joe was recently awarded the MVP for the 10th straight year and that is well deserved.

Adfind has a ton of great shortcuts and one of them is to find non-replicated attributes.

adfind -sc norepl cn -nodn

I only outputted the cn of the object and didn't need the distinguished name so left that off with -nodn

You can see part of the output below.  Notice the whenchanged attribute that was mentioned earlier.

systemFlags contains a flag that defines if an attribute is replicated.  As you can see in the link if the value 1 is applied to an attribute it will not be replicated.  So you could also get fancy with adfind and do something like

adfind -schema -bit -f  "&(objectclass=attributeschema)(systemflags:AND:=1)" cn -nodn

That should give you the exact same result as the previous command.  I'd personally always go with the shortcuts...they are there to make things easier...thanks Joe :)

Windows Server 8 - Schema Version Quick Hitter

THERE IS AN UPDATE TO THIS BLOG ENTRY 


After being put on ice the quick hitter series is back.

I downloaded one of my favorite active directory tools called ADFIND from MVP Joe Richards

So far adfind seems to work great with Windows Server 8. I have not tested every switch but so far so good.

I really like the adfind shortucts and it is a great way to do things like quickly find the schema verision. adfind -sc schver

As you can see the schema version in Windows Server 8 Developers Preview is 51

There are other ways to find the schema version if you don't have adfind installed. Santhosh has a good blog entry where he outlines other methods such as adsiedit and dsquery.

If you are keeping track or are asked in a trivia/interview situation here are the AD schema versions throughout the OS Versions

Windows Server 8 Developers Preview	51
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

Find Enabled Users in the Domain Admin Group

Sorry I've been out for a while, I'm back now with a quick hitter and more entries coming...well at least I have them planned in my head :)

I often receive requests from the security group to send them all user accounts in the domain admin group. What I've found is that there are often both disabled and enabled accounts. All they want is enabled accounts.

For this quick hitter I'll use my favorite tool. ADFIND by top MVP Joe Richards

adfind -default -f "name= domain admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn



There are other ways to do that in adfind but I really love playing with adfind being piped into adfind (great feature by joe)

Can anyone see another quick hitter coming about from this...how do you do this in powershell?...what about nested groups (see previous blog entry)...more to come :)

Update from Shariq via comments

I won't be doing a quick hitter for Powershell...thanks for the assist Shariq

Get-QADgroupmember "domain admins" | Get-QADuser -enabled



I also highly recommend checking out Shariq's Blog

Thanks Shariq!!

Find Nested Group Members

I've run into a few questions recently where someone wanted to find the members of a security group. That in itself is fairly straight forward.

However what if your security group has nested groups and users. Then those nested groups may also have additional nested groups and users. What does that query look like? How do you find all the members?

Suppose I have the following Example

• TopLevelGroup -- Global Security Group
  
  
  
  • TopLevel -- User
    
  • TopLevel2 - User2
    
  • Nested1 - Global Security Group
    
    Nested1 Members
    
    • Nested User
      
    • Nested User 2
      
    • InsideNested - Global Security Group
      
      InsideNested Members
      
      • InsideNested1
        
      
      
    
    
  
  

There are several ways to do this, I'm not saying these are the only methods but these are three examples that work.

The first method is to use the PowerShell. For this example you will need the Quest AD Cmdlets. Thanks to MVP Dmitry Sotnikov for the Quest cmdlets.

Get-QADGroupMember "Group Name" -indirect



The second method is using ADFIND by MVP Joe Richards

adfind -default -bit -f "memberof:1.2.840.113556.1.4.1941:=DN of Group" samaccountname -nodn





More on that query here

Big Thanks to Chris Dent for that part. He was also involved in the questions. Chris was an MVP and should be an MVP again. One of the best and most knowledgeable guys around.


Now on to method three. Some people (especially in classified networks) can't install the Quest cmdlets or adfind (or any third party tool)

The Microsoft DStools can be used. For this example I'll use dsquery and dsget

dsquery group -samid "group name" | dsget group -members -expand



I hope that helps someone out there. Please let me know via comments if there are any questions.

Thanks

Mike

Find Users Who are Not in Specific Groups

I know everyone has been wondering what happened to the quick hitter series...well it is back :)

This question has come up twice over the last few weeks on the AD section at Experts Exchange so that means time for an entry.

The question is suppose I have some groups and I want to find out if users are not members of any of the groups.

Example:

GroupA, GroupB, GroupC, GroupD - So how do I find out what users are not members of those groups?



Two quick ways that I like to use are ADFIND and Powershell. I know there are other methods.

The first is to use ADFIND by MVP Joe Richards

adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of groupA)(!memberof=DN of groupB)(!memberof= DN of group C)(!memberof= DN of groupD)" samaccountname memberof -nodn




The other method is to use PowerShell. For this example you will need the Quest AD cmdlets. Thanks to Dmitry Sotnikov for those

get-qaduser -sizelimit 0 -notmemberof groupa, groupb, groupc, groupd | ft -wrap samaccountname, memberof




In my examples I've outputted the memberof field just so you can verify the commands do what you want and don't have users that are members of those groups, you can take that out if you want.

UPDATE: Joe Richards wrote a great blog entry about DN Formats in AD

As you can see from Joe's post you can also use the GUID of the group instead of the DN in the adfind/LDAP query.

Want to quickly find the GUID of your group...ADFIND once again :)

adfind -sc g:GroupName objectGUID

Thanks

Mike

Force Certain Users to change passwords via Command Line

There was a question that recently came up where the poster wanted to force some of his users whose login name started with B to change their passwords. He wanted to do this using the command line.

This Friday quick hitter post will show two ways to do this (there are other ways also)

What I like for this sort of task are adfind and admod by Joe Richards

The command I used was:

adfind -default -f "&(objectcategory=person)(objectclass=user)(samaccountname=b*)" -dsq | admod pwdLastSet::0



That will set "User must change password at next logon" for logon names that begin with B.

Some notes about this command:

• Joe puts a lot of safety nets in his tools (good thing).
  
• You can use the -unsafe switch with admod if you don't want a safety or you can use the -safety switch and specify how many objects you want to modify (by default the safety kicks in at 10)
  
• You can also specify -upto xx if you want it to do xx object mods and then stop...thanks Joe for that one :)
  

Brandon Shell also came in with a powershell command to do this. If you don't know Brandon check out his blog . Brandon is very knowledgeable but also a really cool guy who is always willing to help and a huge asset to the community.

The powershell command takes advantage of Quest's Active Directory cmdlets. Big thanks to Dmitry Sotnikov and everyone at Quest for those.

The command is

Get-QADUser -SamAccountName b* | Set-QADUser -UserMustChangePassword $true



As you can see both commands worked and met the requirements. I hope you can also see how you can manipulate these commands to set other attributes for example. Comment or contact me for more info.

For those that are more comfortable with the GUI you can run the same LDAP query I used in adfind in Active Directory Users and Computers and find them and highlight them all at once and check the box to force them to change their password.

Hope everyone has a great weekend, spring is finally here on the East Coast of the USA so it should be nice.

When were my domains created - quick-hitters

This will be the first post in what I'll call "quick-hitters". Short to the point posts to accomplish a specific task.

So you want to find a quick way to know when the domains in your forest were created.

This is where I really like a tool called ADFIND by Active Directory MVP Joe Richards. Joe is one of my favorite people in the AD world. Really smart but also a cool guy that is always willing to help.

The command is

adfind -gcb -f objectcategory=domain name whencreated -tdcgt



In my example screen shot I only have one domain in that forest in my lab but it works across your forest becasue of the -gcb switch. If you only want to search your domain you can replace -gcb with -default.



Thanks

Mike