Group Policy Recommendations

From the mailbag.

Thiago sent me an email via the blog with a question about learning more about group policy. From Thiago's email

"...Im planning to buy in Amazon the Active Directory Book made by Brian Desmond MVP DS ( http://briandesmond.com/ad4/ ) But I would like to have your suggestion to a book that give me a inside about AD and Group Policy....because I don't wanna keep reading that basic concepts. Want more that "how to create GPO, how GPP works, how to map drives..."

Brian Desmond's book does have a group policy section in it and that is a good place to start. I highly recommend Brian's book to anyone that works with AD. All four books in my recommendation section are great. Brian, Laura, and Kouti's books will help everyone.

There are however some resources I'd recommend for group policy specifically because that is what Thiago asked about.

First thing I'd recommend is to have some sort of lab setup if you can. That can be as simple as a virtual DC and one workstation to start with. As you are reading and learning about group policy it helps to test and play and experiment.

BOOKS


There are a few group policy specific books and both are good. The first one I'd recomend is

Group Policy: Fundamentals, Security, and Troubleshooting by Group Policy MVP Jeremey Moskowitz

That is the 4th edition of Jermey's group policy book and at close to 800 pages you will learn about group policy.

The next book is Microsoft's Group Policy Resource Kit by Derek Melber

This one I use as a reference and it has a lot of great info too. If money is tight I'd go with Jeremy's book first.

Speaking of money being tight there are a lot of great free resources on the web that can be very helpful.

BLOGS




Microsoft's Official Group Policy Team Blog Great blog from the group policy team anyone wanting to learn group policy should have this in their RSS feeds.

The GPO Guy Blog Group Policy MVP Darren Mar-Elia's blog. Hands down Darren is one of the top group policy guru's on the planet and his blog is another must read. More to come from Darren later in this post.

Florian's Blog Florian is a Group Policy MVP from Germany and a friend. His blog deals with group policy and Active Directory. He often thinks of blog entries that no one else does. His Restricted Groups entry is the best blog on the subject on the net.

Group Policy Center Another great blog from Group Policy MVP Alan Burchill A lot of great information and his blogs contain a lot of screen shots and step by step which is very helpful when learning about group policy.

Other Great Free Resources


TechNet Virtual Labs Having a test lab is very important as I mentioned above, but if you don't have one yet there are a bunch of great group policy labs provided by Microsoft. The virtual labs are a great learning tool.

Darren Mar-Elia also has some great free Group Policy Training Videos on his site. Definitely worth checking those out.

Group Policy Mail List Run by Darren this is a list that anyone wanting to learn more about group policy should subscribe too. Some really smart group policy folks on that list. You will often see very hard problems being discussed on that list.

So that is my list, I know some may wonder where Jeremy Moskowitz's training classes are. You can find Jeremy's training info here I've seen good reviews of Jeremy's class but I've never taken it so I can't personally recommend it but if you or your company has training dollars to spend it is probably going to be worth your time and money.

So what did I miss? Any blaring omissions? Please let me know and I'm sure this will not only answer Thiago's question but it will help others.

Thanks

Mike

Find Enabled Users in the Domain Admin Group

Sorry I've been out for a while, I'm back now with a quick hitter and more entries coming...well at least I have them planned in my head :)

I often receive requests from the security group to send them all user accounts in the domain admin group. What I've found is that there are often both disabled and enabled accounts. All they want is enabled accounts.

For this quick hitter I'll use my favorite tool. ADFIND by top MVP Joe Richards

adfind -default -f "name= domain admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn



There are other ways to do that in adfind but I really love playing with adfind being piped into adfind (great feature by joe)

Can anyone see another quick hitter coming about from this...how do you do this in powershell?...what about nested groups (see previous blog entry)...more to come :)

Update from Shariq via comments

I won't be doing a quick hitter for Powershell...thanks for the assist Shariq

Get-QADgroupmember "domain admins" | Get-QADuser -enabled



I also highly recommend checking out Shariq's Blog

Thanks Shariq!!

I'm a Microsoft MVP now -- Thank You

I received an email earlier today telling me that I was awarded the MVP for directory services.

This is a really great honor and something I'm very proud of. I really enjoy working in the community and more importantly I enjoy learning from others too. I obviously didn't get to this point alone so I want to take some time to thank some key people that have helped me throughout my career.

Starting back in my Army days I can't say enough and thank those that serve. One of the best things I took away from my time in the Army was some of the good friends I made. So to Daryl, Will, and Todd thank you all. You all were like brothers during my time in and I'm proud to call you friends. Additonal thanks to Todd and all those currently serving during this time of war. Hoooaaaahhh!!

I had a few internships that got me in the door but my first real job was supporting a medium size agency in DoD. I really cut my teeth there and have to single out some folks there too.

First and foremost Kevin Buckman for being a great government manager. No way I'd be where I am today without Kevin's support during those early days. Thank you Kevin!! Honorable mention to Terri C. and Jim R.

Richard Guidorizzi -- thank you Richard for the second half of my DoD career at that agency. You really helped me more than you know and always believed in me and I'll never forget what you did. Honorable mention to Leslie Butler, a great senior manager and owner of the company I worked for.


Mark, David R., Garret, and Richard(again) - the discussions that we still have to this day are really great and I learn from each and every one of you. Definitely all friends for life


A great list of admins and engineers that I worked with at DoD:

Mark, David, Garret, Larry, Greg, Lili, Cesar, Kyle, Louis, Brian T, Stuart, Steve Mc, Alex, Guy, Todd, Steve B, Matt, Jeff H, Kevin D. and last but not least Rusty. I know I missed a lot of people but thanks to everyone there. We made it through a lot there including 9/11. I can still vividly remember watching the Pentagon burn. We will always be bonded by that experience.

Thanks to Keith, TJ, Ryan, Ditter, and John at my next agency. Not the most high speed job but at least I made some good friends. Did we pause the DEN yet haha

At my current job at Unisys there are a few key people that I definitely need to thank. Mark and Eric Jansen are on the top of that list. Really enjoyed the projects I worked on with them. It is so great to work with others that are good and know their stuff. We learned from each other and I think we made a solid and real impact for the agency we supported.

Thanks to the "geek network" Florian, Eric, Mark, Rich, Dave, Brian, and Troy B. We have some good discussions and I've learned a lot from all of you guys.

Thanks to everyone at Experts-Exchange. I hang out in the Active Directory section there and I've learned a lot and hopefully helped a lot of people too. Have to give thanks to some of the other top people over there. Chris Dent, Americom, bluntTony, TigerMatt, Laura Hunter, Brandon Shell, and Brian Desmond.

Thanks to other MVPs that I have learned from for years and years. Top of that list is definitely Joe Richards. Joe is just cool as hell and knowledgeable beyond belief. His tools are a huge part of what I do. I remember the first time I emailed Joe offline and he responded with a very long and thoughtful answer. He didn't blow me off or treat me like I was a pee-on. Thank you Joe for all your work in the community. I really look forward to meeting you at the MVP summit next year.

Other great MVPs that I'd like to thank. I've met some of you in person. Others I only know via email but Thanks to: Joe, Brian Desmond, Laura Hunter, Florian F., Jorge, Mark Minasi, and Darren Mar-Elia.

Thanks to the Directory Services team at Microsoft. Ned, Rob, and everyone else that writes for the AskDS blog. Really great blogs and thanks for what you all do for the community.

Last but not least my brother Andy...thanks Andy I would not be here without you man.

I know I probably forgot people but again I didn't get here alone and I'll continue with help and support from great people.

Ok now this blog entry is starting to sound like one of those rambling Oscar speeches. The red light came on 5 minutes ago and now I'm getting the hook...I've overstayed my welcome :)


Thanks

Mike

Friday 6/26 BlogRoll

I'm starting a new weekly post called the Friday BlogRoll. This is going to be some of the entries from the blog world that I found useful. It will usually be tech blogs but like everyone else in the Tech world I read other blogs too. Remember part of my blog title is "...and everything else..."


MVP Florian Frommherz had a really good entry on PDC Chaining
Really good concise explanation of what PDC chaining is and how it works. I highly recommend subscribing to Florian's blog.

The Active Directory Documentation Team has released an updated document detailing Active Directory Port Requirements
It is definitely good to know what ports are needed for AD, especially in environments where there may be firewalls and port blockages that could hinder operations. This is also where network traces and tools like portqry come in handy.

The Windows Blog team posted a blog outlining the pricing and upgrade options for Windows 7
I would have personally liked to see the prices a little lower. I understand the pricing but in these tough economic times I wonder how many people will go out and buy Windows 7. I'm guessing many will wait for their next PC that comes with Windows 7 installed. I have a feeling Windows 7 will be around 10 years from now... it is a good solid OS.

Staying on the Windows 7 theme, Microsoft has a good Windows Client Feature Comparison PDF available for download.
This is something you can give to your manager or anyone that asks what the key differences are between Windows 7, Vista, and XP.

MVP Don Jones has an ongoing 26 part series on Powershell over at Concentrated Tech.
Don has been a leader in the scripting community for years now and this is another great example of why he is one of the best around. He along with MVP Greg Shields do a great job on the Concentrated Tech site.


My brother Andy recently posted a video on YouTube about his thoughts on Twitter
Good response from the crowd at the Washington DC Improv, I could never get up and do stand up. Leave him a comment if you like the material and tell him I sent you :).

Find Nested Group Members

I've run into a few questions recently where someone wanted to find the members of a security group. That in itself is fairly straight forward.

However what if your security group has nested groups and users. Then those nested groups may also have additional nested groups and users. What does that query look like? How do you find all the members?

Suppose I have the following Example

• TopLevelGroup -- Global Security Group
  
  
  
  • TopLevel -- User
    
  • TopLevel2 - User2
    
  • Nested1 - Global Security Group
    
    Nested1 Members
    
    • Nested User
      
    • Nested User 2
      
    • InsideNested - Global Security Group
      
      InsideNested Members
      
      • InsideNested1
        
      
      
    
    
  
  

There are several ways to do this, I'm not saying these are the only methods but these are three examples that work.

The first method is to use the PowerShell. For this example you will need the Quest AD Cmdlets. Thanks to MVP Dmitry Sotnikov for the Quest cmdlets.

Get-QADGroupMember "Group Name" -indirect



The second method is using ADFIND by MVP Joe Richards

adfind -default -bit -f "memberof:1.2.840.113556.1.4.1941:=DN of Group" samaccountname -nodn





More on that query here

Big Thanks to Chris Dent for that part. He was also involved in the questions. Chris was an MVP and should be an MVP again. One of the best and most knowledgeable guys around.


Now on to method three. Some people (especially in classified networks) can't install the Quest cmdlets or adfind (or any third party tool)

The Microsoft DStools can be used. For this example I'll use dsquery and dsget

dsquery group -samid "group name" | dsget group -members -expand



I hope that helps someone out there. Please let me know via comments if there are any questions.

Thanks

Mike

CodePlex, a Site every AD admin should know

CodePlex is an open source project hosting website run by Microsoft. It allows shared development of open source software.

CodePlex is similar to SourceForge

There are a few key projects for the AD admin that I'd like to highlight. In future posts I'll write reviews of these products/tools. Will there be another 4/4 OU Award? :)

• ADModify.NET
  
• Performance Analysis of Logs (PAL) Tool
  
• Active Directory Utils
  

ADModify.NET

ADModify was created to make it easier to modify / import / export objects in Active Directory in bulk. ADModify also has a very nice undo feature if you need to back out of changes

PAL Tool

PAL is a tool that reads in a performance monitor counter log (any known format) and analyzes it using complex, but known thresholds (provided). The tool generates an HTML based report which graphically charts important performance counters and throws alerts when thresholds are exceeded. The thresholds are originally based on thresholds defined by the Microsoft product teams and members of Microsoft support, but continue to be expanded by this ongoing project.

AD Utils

AD Utils are utilities that are primarily focused on administration and operations of Active Directory.

The AD Utils include

• CheckDSAcls
  
• ReplDiag
  
• TrustCheck
  
• FindGuidInAD
  
• SearchForDuplicateAttributeData
  

There are many other tools and utilities on CodePlex. Please leave comments about some other good/useful tools you use for your AD and Server Administration duties from the site.

I'll be posting more information and reviews of the utilites in the future.

Find Users Who are Not in Specific Groups

I know everyone has been wondering what happened to the quick hitter series...well it is back :)

This question has come up twice over the last few weeks on the AD section at Experts Exchange so that means time for an entry.

The question is suppose I have some groups and I want to find out if users are not members of any of the groups.

Example:

GroupA, GroupB, GroupC, GroupD - So how do I find out what users are not members of those groups?



Two quick ways that I like to use are ADFIND and Powershell. I know there are other methods.

The first is to use ADFIND by MVP Joe Richards

adfind -default -f "&(objectcategory=person)(objectclass=user)(!memberof=DN of groupA)(!memberof=DN of groupB)(!memberof= DN of group C)(!memberof= DN of groupD)" samaccountname memberof -nodn




The other method is to use PowerShell. For this example you will need the Quest AD cmdlets. Thanks to Dmitry Sotnikov for those

get-qaduser -sizelimit 0 -notmemberof groupa, groupb, groupc, groupd | ft -wrap samaccountname, memberof




In my examples I've outputted the memberof field just so you can verify the commands do what you want and don't have users that are members of those groups, you can take that out if you want.

UPDATE: Joe Richards wrote a great blog entry about DN Formats in AD

As you can see from Joe's post you can also use the GUID of the group instead of the DN in the adfind/LDAP query.

Want to quickly find the GUID of your group...ADFIND once again :)

adfind -sc g:GroupName objectGUID

Thanks

Mike