Activedirectory - Revision history

Aleks: /* Active Directory */

2024-12-27T16:49:22Z

Active Directory

← Older revision		Revision as of 17:49, 27 December 2024
Line 9:		Line 9:
	*$pw = Read-Host "password" -AsSecureString		*$pw = Read-Host "password" -AsSecureString
	**Set-ADAccountPassword <username> -Reset -NewPassword $pw		**Set-ADAccountPassword <username> -Reset -NewPassword $pw
			<syntaxhighlight lang="powershell">
			Set-ADAccountPassword -Identity '<username>' -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "p@ssw0rd" -Force)
			</syntaxhighlight>
	----		----
	Unlock account		Unlock account

2024-04-05T11:02:37Z

← Older revision		Revision as of 12:02, 5 April 2024
Line 80:		Line 80:

	https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN		https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN

			== DHCP in active directory ==
			Get all DHCP servers registered to domain:<syntaxhighlight lang="powershell">
			Get-DhcpServerInDC
			</syntaxhighlight>

2023-11-15T20:30:46Z

14 revisions imported

← Older revision	Revision as of 21:30, 15 November 2023
(No difference)

2023-07-30T00:06:25Z

← Older revision		Revision as of 01:06, 30 July 2023
Line 42:		Line 42:
	Before creating the domain ensure that all time and date settings on the server to be the primary domain controller are correct.		Before creating the domain ensure that all time and date settings on the server to be the primary domain controller are correct.
	----		----
			==enable fix for hybrid AD password reset==
			[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-password-hash-synchronization#synchronizing-temporary-passwords-and-force-password-change-on-next-logon ms kb]

	== Re-sync AD Account with Azure AD account after deletion, restore or migration ==		== Re-sync AD Account with Azure AD account after deletion, restore or migration ==

2023-05-18T13:45:52Z

Ports for Domain / Active Directory

← Older revision		Revision as of 14:45, 18 May 2023
Line 76:		Line 76:
	•TCP & UDP 1025-5000		•TCP & UDP 1025-5000
	•TCP & UDP 49152-65535		•TCP & UDP 49152-65535


			https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN

2023-05-18T13:45:28Z

← Older revision		Revision as of 14:45, 18 May 2023
Line 60:		Line 60:

	Chek here for Ref: https://www.theictguy.co.uk/ad-connect-and-hard-matching-immutableid/		Chek here for Ref: https://www.theictguy.co.uk/ad-connect-and-hard-matching-immutableid/

			==Ports for Domain / Active Directory==

			UDP Port 88 for Kerberos authentication UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations.

			TCP Port 139 and UDP 138 for File Replication Service between domain controllers.

			UDP Port 389 for LDAP to handle normal queries from client computers to the domain controllers.

			TCP and UDP Port 445 for Replication, User and Computer Authentication, Group Policy, TCP and UDP Port 464 for Kerberos Password Change TCP Port 3268 and 3269 for Global Catalog from client to domain controller.

			TCP and UDP Port 53 for DNS from client to domain controller and domain controller to domain controller.

			The ephemeral ports are required:
			•TCP & UDP 1025-5000
			•TCP & UDP 49152-65535

2023-01-24T12:15:17Z

Active Directory

← Older revision		Revision as of 13:15, 24 January 2023
Line 26:		Line 26:
	See all properties for an active directory user account:		See all properties for an active directory user account:
	Get-ADuser -identity <user> -properties		Get-ADuser -identity <user> -properties
			----
			Get all groups an AD account is a member of:
			*Get-ADPrincipalGroupMembership <username> \| select Name
	----		----
	Find login scripts for all users and export to text file:		Find login scripts for all users and export to text file:
	Get-ADUser -filter -properties scriptpath, homedrive, homedirectory \| ft Name, scriptpath, homedrive, homedirectory \| out-file C:\temp\logonscriptoutput.txt		Get-ADUser -filter -properties scriptpath, homedrive, homedirectory \| ft Name, scriptpath, homedrive, homedirectory \| out-file C:\temp\logonscriptoutput.txt



	== Setting up Active directory ==		== Setting up Active directory ==

2022-09-29T14:29:34Z

← Older revision		Revision as of 15:29, 29 September 2022
Line 41:		Line 41:
	Before creating the domain ensure that all time and date settings on the server to be the primary domain controller are correct.		Before creating the domain ensure that all time and date settings on the server to be the primary domain controller are correct.
	----		----


			== Re-sync AD Account with Azure AD account after deletion, restore or migration ==

			Issues may occur when accounts have been created incorrectly or have been deleted and restored

			You may need to manually re-sync the AD objects between on prem AD and Azure AD

			This is done using the ImmutableID.

			First get the account in Active Directory and get the immutable ID then convert it to Base64 String:

			*Get-ADUser -Filter "name -eq '<username>'" -Properties objectGUID \| Select-Object UserPrincipalName, objectGUID, @{Name = ‘ImmutableID’; Expression = { [system.convert]::ToBase64String(([GUID]$_.objectGUID).ToByteArray()) } } \| Export-CSV users.csv

			Then set the Immutable ID obtained from the AD account on the Azure account:
			*Set-MsolUser -UserPrincipalName USER@DOMAIN.COM -ImmutableID “ABCdefGHIjklMNO==”

			Chek here for Ref: https://www.theictguy.co.uk/ad-connect-and-hard-matching-immutableid/

2022-07-31T10:40:46Z

Setting up Active directory

← Older revision		Revision as of 11:40, 31 July 2022
Line 37:		Line 37:

	https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx		https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx

			----
			Before creating the domain ensure that all time and date settings on the server to be the primary domain controller are correct.
			----

2022-07-31T10:21:47Z

← Older revision		Revision as of 11:21, 31 July 2022
Line 29:		Line 29:
	Find login scripts for all users and export to text file:		Find login scripts for all users and export to text file:
	Get-ADUser -filter -properties scriptpath, homedrive, homedirectory \| ft Name, scriptpath, homedrive, homedirectory \| out-file C:\temp\logonscriptoutput.txt		Get-ADUser -filter -properties scriptpath, homedrive, homedirectory \| ft Name, scriptpath, homedrive, homedirectory \| out-file C:\temp\logonscriptoutput.txt



			== Setting up Active directory ==

			Handy basic info for configuring an active directory domain:

			https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx