BSonPoSH

Last week I talked about how to "discover" information using the built in .NET classes for ActiveDirectory. This week I would like to show how you can do similar things with the ActiveDirectory cmdlets that ship with Win7 and R2.

The first task we discussed was getting Forest information like Domains, Sites, ForestMode, RootDomain, and Forest masters.

With .NET we do this

$Forest = [DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

With the cmdlets we do this

$Forest = Get-ADForest

Next we discussed getting Domain information like Domain Controllers, DomainMode, Domain Masters, and Forest Root.

$Domain = [DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

With the cmdlets we do this

$Domain = Get-ADDomain

Now the object we get back is slightly different so lets take a look

First lets look at what $Forest has to offer

PS C:UsersAdministrator> $Forest
 
ApplicationPartitions : {}
CrossForestReferences : {}
DomainNamingMaster    : Win2K8R2DC1.R2.Dev.Lab
Domains               : {R2.Dev.Lab}
ForestMode            : Windows2008R2Forest
GlobalCatalogs        : {Win2K8R2DC1.R2.Dev.Lab}
Name                  : R2.Dev.Lab
PartitionsContainer   : CN=Partitions,CN=Configuration,DC=R2,DC=Dev,DC=Lab
PSShowComputerName    : {}
RootDomain            : R2.Dev.Lab
SchemaMaster          : Win2K8R2DC1.R2.Dev.Lab
Sites                 : {Default-First-Site-Name}
SPNSuffixes           : {}
UPNSuffixes           : {}
WriteErrorStream      : {}

Finally, Lets look at $Domain

PS C:UsersAdministrator> $domain
 
AllowedDNSSuffixes                 : {}
ChildDomains                       : {}
ComputersContainer                 : CN=Computers,DC=R2,DC=Dev,DC=Lab
DeletedObjectsContainer            : CN=Deleted Objects,DC=R2,DC=Dev,DC=Lab
DistinguishedName                  : DC=R2,DC=Dev,DC=Lab
DNSRoot                            : R2.Dev.Lab
DomainControllersContainer         : OU=Domain Controllers,DC=R2,DC=Dev,DC=Lab
DomainMode                         : Windows2008R2Domain
DomainSID                          : S-1-5-21-4244231903-4101880959-1987002231
ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=R2,DC=Dev,DC=Lab
Forest                             : R2.Dev.Lab
InfrastructureMaster               : Win2K8R2DC1.R2.Dev.Lab
LastLogonReplicationInterval       :
LinkedGroupPolicyObjects           : {CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=R2,DC=Dev,DC=Lab}
LostAndFoundContainer              : CN=LostAndFound,DC=R2,DC=Dev,DC=Lab
ManagedBy                          :
Name                               : R2
NetBIOSName                        : R2
ObjectClass                        : domainDNS
ObjectGUID                         : c2d8e67d-2a49-4352-a795-de2b6508b1dc
ParentDomain                       :
PDCEmulator                        : Win2K8R2DC1.R2.Dev.Lab
QuotasContainer                    : CN=NTDS Quotas,DC=R2,DC=Dev,DC=Lab
ReadOnlyReplicaDirectoryServers    : {}
ReplicaDirectoryServers            : {Win2K8R2DC1.R2.Dev.Lab}
RIDMaster                          : Win2K8R2DC1.R2.Dev.Lab
SubordinateReferences              : {CN=Configuration,DC=R2,DC=Dev,DC=Lab}
SystemsContainer                   : CN=System,DC=R2,DC=Dev,DC=Lab
UsersContainer                     : CN=Users,DC=R2,DC=Dev,DC=Lab

Here are some more specific examples on how to use these variables:

To see the forest roles

$forest | select SchemaMaster,DomainNamingMaster

To see the domain roles

$domain | select PDCEmulator,RIDMaster,InfrastructureMaster

To see what application partitions your forest has

$forest.ApplicationPartitions

NOTE: you can use this command to see all the AD Cmdlets have to offer

get-command -Module ActiveDirectory

tshell :: Jun.22.2009 :: Active Directory, All :: No Comments »

When writing scripts I have always been a fan of making them as generic as possible. This may make the script a tad more complicated, but it allows it to be dynamic and also allows you to share these scripts between environments (i.e. Lab, QC, Production.) Basically we want to avoid hardcoding Domains, Domain Controllers, OUs, Containers, and site info.

Below I provide some simple examples of getting this information dynamically. This will allow you to discover the information instead of hardcoding it in the script.

To get forest information like Domains, Sites, ForestMode, RootDomain, and Forest masters you can use this:

$Forest = [DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

To get Domain information like Domain Controllers, DomainMode, Domain Masters, and Forest Root.

$Domain = [DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

To get the current Site information for the local machine like Subnets, Sitelinks, Location, Bridgehead Servers, and Domain Controllers.

$MySite = [DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite()

With these variables you can find all the Active Directory infrastructure information you could possibly want.

Here are some more specific examples on how to use these variables:

To find all your Global Catalogs in the forest

$Forest.GlobalCatalogs

To find all the Domain Controllers in the current domain

$Domain.DomainControllers

To see what application partitions your forest has

$forest.ApplicationPartitions

To see the forest roles

$forest | select SchemaRoleOwner,NamingRoleOwner

To see the domain roles

$domain | select PDCRoleOwner,RidRoleOwner,InfrastructureRoleOwner

To see the subnets in the current site

$MySite.subnets

To see the bridgehead Servers

$MySite.BridgeheadServers

tshell :: Jun.14.2009 :: Active Directory, All :: No Comments »

As you may or may not know the AD cmdlets that ship with Win7 and Windows 2008 R2 use the ADWS (Active Directory Web Service) but fear not! MS release ADMG (Active Directory Management Gateway) that allows you to use the AD cmdlets and ADAC (Active Directory Administrative Center)

Download here: http://support.microsoft.com/default.aspx?scid=kb;en-us;969041&sd=rss&spid=12925

For more information about Active Directory Web Services: http://technet.microsoft.com/en-us/library/dd391908.aspx

For more information about the Active Directory Module for Windows PowerShell: http://technet.microsoft.com/en-us/library/dd378937.aspx

tshell :: Jun.12.2009 :: All :: 1 Comment »

I often to get asked what I mean by "Select-Object changes the object type." I believe this one of those things that is easier to illustrate than just explain. First let me show the object type Change

PS> ($dir = Get-item C:\temp).Gettype()
 
IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     DirectoryInfo                            System.IO.FileSystemInfo
 
PS> ($dir = Get-item C:\temp | select-Object Fullname,Name,Parent).Gettype()
 
IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     False    PSCustomObject                           System.Object
 
Even if you specifiy PSBASE you have new object type.
 
PS> ($dir = Get-item C:\temp).psbase.Gettype()
 
IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     DirectoryInfo                            System.IO.FileSystemInfo
 
PS> ($dir = Get-item C:\temp | select-Object Fullname,Name,Parent).psbase.Gettype()
 
IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     False    PSCustomObject                           System.Object

Now look at what you lose using this method.

First you will notice you have 21 items returned from Get-Member (I only included Properties for simplicity, but methods work the same way.)

PS> get-item C:\temp | Get-Member -MemberType Properties | ft Name
 
Name
----
PSChildName
PSDrive
PSIsContainer
PSParentPath
PSPath
PSProvider
Attributes
CreationTime
CreationTimeUtc
Exists
Extension
FullName
LastAccessTime
LastAccessTimeUtc
LastWriteTime
LastWriteTimeUtc
Name
Parent
Root
Mode
ReparsePoint
 
## After piping to Select-Object you now only have 3
 
PS> Get-Item C:\temp | Select-Object Name,Fullname,Parent | Get-Member -MemberType Properties | ft name
 
Name
----
FullName
Name
Parent
 
## Now.. methods before "Conversion"
 
PS>  Get-item C:\temp | Get-Member -MemberType Methods | ft name
 
Name
----
Create
CreateObjRef
CreateSubdirectory
Delete
Equals
GetAccessControl
GetDirectories
GetFiles
GetFileSystemInfos
GetHashCode
GetLifetimeService
GetObjectData
GetType
get_Attributes
get_CreationTime
get_CreationTimeUtc
get_Exists
get_Extension
get_FullName
get_LastAccessTime
get_LastAccessTimeUtc
get_LastWriteTime
get_LastWriteTimeUtc
get_Name
get_Parent
get_Root
InitializeLifetimeService
MoveTo
Refresh
SetAccessControl
set_Attributes
set_CreationTime
set_CreationTimeUtc
set_LastAccessTime
set_LastAccessTimeUtc
set_LastWriteTime
set_LastWriteTimeUtc
ToString
 
## After
 
PS>  Get-item C:\temp | select-object FullName,Name,Parent | Get-Member -MemberType Methods | ft name
 
Name
----
Equals
GetHashCode
GetType
ToString

As you can see... Effectively they are all gone on the new object. When I first experienced this.. I thought maybe the methods were just hidden... but try to access them

PS> $dir = Get-Item C:\temp
PS> $dir.GetDirectories()
 
Mode           LastWriteTime       Length Name
----           -------------       ------ ----
d----     5/22/2007  1:58 PM              Console
d----     5/10/2007  4:36 PM              test32
 
PS> $dir = Get-Item C:\temp | Select-Object FullName,Name,Parent
PS>  $dir.GetDirectories()
Method invocation failed because [System.Management.Automation.PSCustomObject] doesn't contain a method named 'GetDirectories'.
At line:1 char:20

I want to be clear... This is not a bug. Its not even a bad idea. I find it useful, but I think it confuses a lot of people. Like most people I didn't read the help before I used it or I would have seen this excerpt from get-help Select-Object:

If you use Select-Object to select specified properties, it copies the values of those properties from the input objects and creates new objects that have the specified properties and copied values.

So, the moral of the story is don't be shocked when your object changes after using Select-Object. Embrace the change :)

tshell :: Jun.10.2009 :: Active Directory, All :: No Comments »

XENAPP SNEAK PEEK – PowerShell Commands for XenApp Tech Preview

tshell :: Jun.08.2009 :: All :: No Comments »

Once you grab a hold of the "Object" concept in Powershell it brings a whole new light to scripting. The power that is at your finger tips is basically limitless, but to harness this power you not only need to know how to use objects but also create them as well.

Here is my way of creating objects.

$myobj = ""| select-Object Server,Result

IMO this is the simplest way to create custom objects.

Effectively what happens is you set your $myobj to a empty string and pipe to select-object. While this may seem odd, its actually quite useful because what select-object returns is a PSCustomObject with the properties that you specify. This allows you to create you object with defined properties that you can fill out later in one line.

The "proper" way to create a custom object is to do this.

$myobj = new-object System.Object
$myobj | add-member -membertype noteproperty -name Server -value $sname
$myobj | add-member -membertype noteproperty -name Result -value $sResult

While this isn't that much more work... I think its harder to read (and more typing) so I go with this shortcut

$myobj = "" | select-Object Server,Result
$myobj.Server = $sname
$myobj.Result = $sResult

I will give you one warning about select-object (not related, but while I'm on this subject.) select-object does Change the object type and therefore you lose methods and properties you may expect to be there. I have seen numerous post on the news groups that have this exact problem.

If you pipe Get-ChildItem to Get-member you get tons of methods and properties for both System.IO.FileInfo and System.IO.DirectoryInfo

PS> get-childitem | gm

Now pipe it to select-object and do a Get-Member

PS> (get-childitem | select-object Fullname,length) | gm
 
TypeName: System.Management.Automation.PSCustomObject
 
Name MemberType Definition
---- ---------- ----------
Equals Method System.Boolean Equals(Object obj)
GetHashCode Method System.Int32 GetHashCode()
GetType Method System.Type GetType()
ToString Method System.String ToString()
FullName NoteProperty System.String FullName=C:WindowsSystem32409
length NoteProperty length=null

Just be careful to remember this. I actually avoid using select-object to filter objects simply because of this. Instead... I just use the properties.

tshell :: Jun.04.2009 :: Active Directory, All :: No Comments »

It appears #Win7 to be in consumers hands by OCT 22… Click Here.

Perhaps even RTM as early as next month.

tshell :: Jun.02.2009 :: All :: No Comments »