Yearly Archives: 2012

New article on PowerShell Magazine: Working with a Uniform Resource Identifier (URI) in PowerShell

The article explains how the [System.Uri] .Net class can be used to manipulate URIs and to convert them into objects. For more information on this topic please have a look at the article that has been posted on PowerShell Magazine:

Code samples from my DuPSUG presentation

Last Friday we had a great day in Eindhoven, the first Dutch PowerShell User Group meeting. It was a day packed with presentations and a lot of talk about PowerShell. I would like to thank everyone involved for making this into a great day! It was great to see the enthusiasm of everyone there.

I have joined the DuPSUG team and I am excited to be involved with the planning and setting up of future events. If you have any suggestions in regards to future events, be sure to contact me or anyone of the team as we are currently gathering feedback for our next event. For more information about the Dutch PowerShell User Group have a look at our website:

The topic of my session was Splatting and [Adsisearcher], I have attached the code samples I used during the presentation to this post, this includes the samples I did not get around to showing:

And for those of you who just could not get enough of Splatting, I will be posting an article on splatting on my blog this week.

Update: Have a look at the Scripting Guy blog post, some photos of the event have been posted: Hey, Scripting Guy! Blog: The First-Ever Dutch PowerShell User Group

New article on PowerShell Magazine: Using UNC paths when working with PowerShell providers

The article explains two solutions to errors that you might run in to when utilizing UNC paths when working PowerShell providers. For example the execution of the following command will fail:

Set-Location HKLM:
Get-ChildItem | Export-Csv -Path \\localhost\c$\registry.csv

This can be solved by adding the specific provider, in this case the FileSystem PowerShell provider:

Get-ChildItem | Export-Csv -Path Microsoft.PowerShell.Core\FileSystem::\\localhost\c$\registry.csv

For more information on this topic head on over to PowerShell Magazine to have a look at the article:

New script: Set AD User/Group on as Local Administrator

I was recently asked to add a certain Active Directory group to a few dozen computers. Using Group Policy and Restricted Groups was not an option here, since there were already other users and groups in the Administrators group. That triggered me to write up a script in PowerShell which could do this for me.

The script is available here: Technet Gallery: Set-ADAccountasLocalAdministrator.ps1

To set an AD Group as a Local Administrator the script can be executed as follows:

.\Set-ADAccountasLocalAdministrator.ps1 -Computer 'Server01,Server02' -Trustee HRManagers

It is also possible to run this script with a plain text file containing a list of computer names:

.\Set-ADAccountasLocalAdministrator.ps1 -InputFile C:\ListofComputers.txt -Trustee User01

New script: Find Orphaned Home Folders

I recently uploaded a new script, Get-OrphanHomeFolder.ps1 to the TechNet Gallery. The script is designed to get a list of all folders in a path and for each of those folders it will query AD to verify if there is a matching Sam account. If this property is not found the script considers this to be an orphaned home folder. If the -FolderSize property is specified the script will retrieve the size of the orphaned folder and display the results as an array of objects.

The script is available here: Technet Gallery: Get-OrphanHomeFolder.ps1

This portion of the script will grab the folder name and query AD for a matching samaccountname, to do this I utilize the [adsisearcher] accelerator so there is no dependency on the AD Cmdlets in this script:

$CurrentPath = Split-Path $_ -Leaf
$ADResult = ([adsisearcher]"(samaccountname=$CurrentPath)").Findone()

If a matching account is not found the script will display the error, in this case the ‘Account does not exist and has a home folder‘ message and the full path to the folder. This information is stored in a hashtable. The code for that look like this:

$HashProps = @{
    'Error' = 'Account does not exist and has a home folder'
    'FullPath' = $_.FullName

The information gathered in this hash table is then used to build a custom PowerShell object with the hash table as its properties:

New-Object -TypeName PSCustomObject -Property $HashProps

For more information about this script or any of the other contributions, drop me a line and I will be happy to discuss this further.

Restoring an Object from the AD Recycle Bin

Using the Active Directory Recycle Bin I will demonstrate the consequences of deleting and restoring an Domain Administrator user account and display which properties are affected or changed.

First off we create a new user which we then add to the Domain Admins group with the following PowerShell commands:

New-ADUser -Name Admin_Jaap -SamAccountName Admin_Jaap -Enabled:$true `
-AccountPassword (ConvertTo-SecureString -AsPlainText 'Secret01' -Force)
Add-ADGroupMember -Identity 'Domain Admins' -Members Admin_Jaap

Then we capture output of Get-ADObject with all properties in a variable:

$BeforeDel = Get-ADObject -LDAPFilter "(samaccountname=Admin_Jaap)" -Properties *

The next step is to delete the user using Remove-ADUser:

Remove-ADUser -Identity Admin_Jaap -Confirm:$false

Now the account can be restored:

Restore-ADObject -Identity $BeforeDel.ObjectGUID -Confirm:$false

Now that the object has been restored, the password that we originally set has been recovered as well. This can be verified by running the following PowerShell command:

Invoke-Command -ScriptBlock {whoami} -Credential admin_jaap -ComputerName dc1

We capture the information stored in AD to the $AfterRes variable:

$AfterRes = Get-ADObject -LDAPFilter "(samaccountname=Admin_Jaap)" -Properties *

Now that we have captured both the account information when the account was just created and after the account was restored we can use this information to have a look at which attributes if any have changed. To make this comparison the Compare-Object Cmdlet can be used. To be able to compare these AD Object, the variable is first piped into Out-String and then split up into an array of strings.

Compare-Object -ReferenceObject (($BeforeDel|Out-String) -split '\n') `
-DifferenceObject (($AfterRes|Out-String) -split '\n') -IncludeEqual

The results show that most attributes are completely unchanged. Attributes containing information related to either replication, or when the object was last changed will be the only changed objects.

Continue reading

AD queries and the Active Directory Recycle Bin

Lately I have been playing around with the AD Recycle Bin on Windows Server 2012. It is a  useful feature that was introduced in Server 2008 R2 and has been improved in Server 2012. New features include:

  • AD Object restore from GUI
  • Password restore
  • Restore of a entire OU
To enable this feature using PowerShell the following line of code should be executed:
Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' `
-Scope 'ForestOrConfigurationSet' -Target '' -Confirm:$false

Note that this feature can never be disabled after it has been enabled. To test its functionality we will create a user:

New-ADUser -SamAccountName Jaap -Name Jaap -Enabled:$true `
-AccountPassword (ConvertTo-SecureString -AsPlainText '$ecret01' -Force)
This command creates a new account named Jaap with $ecret01 as the password. To be able to set a password this string is first converted into a SecureString. To verify that this account was created we can query it using Get-ADobject:
Get-ADobject -Filter 'samaccountname -eq "jaap"'
An alternative, and my personal preference is to utilize [adsisearcher] to query for AD object. It has the advantage that it is available natively in PowerShell, in any version. Here is the syntax to query for the account that was just created:
We have now established that the account can be found and, so let’s remove the account so it moves to the Active Directory Recycle Bin:
Remove-ADUser jaap
So now we can try the same query again:
Get-ADobject -Filter 'samaccountname -eq "jaap"'
Get-ADobject will return an error and [adsisearcher] will not return any results. This is because the user account is Tombstoned and placed in the Deleted objects container. To get the desired results, the -IncludeDeletedObjects switch should be used:
Get-ADobject -Filter 'samaccountname -eq "jaap"' -IncludeDeletedObjects
For [adsisearcher] a slightly different approach should be used, the following query will retrieve the deleted user account:
$Searcher = [adsisearcher]'(samaccountname=jaap)'
$Searcher.Tombstone = $true

And that how to query accounts have been deleted and stored in the AD Recycle Bin.