BSonPosh

Phase 3 of S.DS.P “CSV Output” (as much as 21 sec faster!)

In the next phase I wanted to actually get some data back and display it. Because I just wanted to test performance I kept the test as close as possible. ADFind has the built in ability to output a csv file so I mimicked his output. I also added two properties to return name and sAMAccountName. For those interested, my next step will be to output objects instead of text (really the whole point.)

My expectation for this test was that ADFind would pull ahead due to the processing of each record, but I was pleasantly surprised when the script was actually faster in all environments except 700k Environment. I will let joe explain why his is slower.

Testing
- I ran each 10x in a Row (as joe Suggested) in its own environement
- ADFind I tested using CMD.exe and used ptime.exe for time measurements.
- Get-DSPObject I used Measure-Command and outputed only TotalSeconds

UPDATED!: I had several people suggest that I should have a consolidated view of the results. So here it is. I took the Average from each test and put into and Excel spreadsheet and then plotted on a chart.

Here is the screenshot (lower is better)
DSP vs ADFind Chart

400k objects in a Prod Quality VM running Win2008 RTM 64bit (local)
Average: ADFind = 90.45
Average: DSP = 68.79
Winner: DSP 21.66 secs faster

- Get-DSPObject -prop “name”,”sAMAccountName” -csv
Execution time: 70.455s
Execution time: 69.551s
Execution time: 68.466s
Execution time: 68.085s
Execution time: 68.611s
Execution time: 68.179s
Execution time: 68.837s
Execution time: 68.670s
Execution time: 69.105s
Execution time: 67.994s
- adfind -b “your dn here” -f “(objectclass=user)” name samaccountname -csv
Execution time: 100.538 s
Execution time: 109.511 s
Execution time: 92.499 s
Execution time: 96.063 s
Execution time: 91.601 s
Execution time: 80.693 s
Execution time: 81.551 s
Execution time: 81.044 s
Execution time: 90.945 s
Execution time: 80.143 s

400k objects in a Prod Quality VM running Win2008 RTM 64bit (remote)
Average: ADFind = 77.18
Average: DSP = 64.23
Winner: DSP 13 secs faster

- Get-DSPObject -prop “name”,”sAMAccountName” -csv
Execution time: 67.065 s
Execution time: 63.871 s
Execution time: 63.330 s
Execution time: 63.027 s
Execution time: 62.630 s
Execution time: 64.692 s
Execution time: 64.451 s
Execution time: 64.450 s
Execution time: 64.594 s
Execution time: 64.219 s
- adfind -b “your dn here” -f “(objectclass=user)” name samaccountname -csv
Execution time: 77.280 s
Execution time: 77.616 s
Execution time: 77.304 s
Execution time: 76.899 s
Execution time: 77.426 s
Execution time: 76.773 s
Execution time: 76.699 s
Execution time: 77.445 s
Execution time: 77.463 s
Execution time: 76.912 s

700k objects on a Physical machine Win2k3 x86
Average: ADFind = 101.383
Average: DSP = 109.600
Winner: ADFind 8.21 secs faster

- Get-DSPObject -prop “name”,”sAMAccountName” -csv
Execution time: 111.088s
Execution time: 109.962s
Execution time: 110.112s
Execution time: 110.832s
Execution time: 110.167s
Execution time: 109.853s
Execution time: 109.757s
Execution time: 110.387s
Execution time: 109.070s
Execution time: 109.065s
- adfind -b “your dn here” -f “(objectclass=user)” name samaccountname -csv
Execution time: 101.571 s
Execution time: 101.313 s
Execution time: 101.386 s
Execution time: 101.593 s
Execution time: 101.539 s
Execution time: 100.917 s
Execution time: 101.020 s
Execution time: 101.286 s
Execution time: 101.544 s
Execution time: 101.667 s

300k Objects on Physical Win2k3 x86 (Remote)
Average: ADFind = 49.90
Average: DSP = 44.44
Winner: DSP 5 secs Faster

- Get-DSPObject -prop “name”,”sAMAccountName” -csv
Execution time: 44.782 s
Execution time: 44.316 s
Execution time: 44.473 s
Execution time: 44.322 s
Execution time: 44.380 s
Execution time: 44.440 s
Execution time: 44.394 s
Execution time: 44.544 s
Execution time: 44.428 s
Execution time: 44.247 s
- adfind -b “your dn here” -f “(objectclass=user)” name samaccountname -csv
Execution time: 51.983 s
Execution time: 51.937 s
Execution time: 51.810 s
Execution time: 49.142 s
Execution time: 48.913 s
Execution time: 49.073 s
Execution time: 48.765 s
Execution time: 49.125 s
Execution time: 49.110 s
Execution time: 49.105 s

200k Objects on my Server at Home (Win2k8 x64)
Average: ADFind = 35.50
Average: DSP = 31.74
Winner: DSP 4 secs Faster

- Get-DSPObject -prop “name”,”sAMAccountName” -csv
Execution time: 31.887 s
Execution time: 31.888 s
Execution time: 31.044 s
Execution time: 30.746 s
Execution time: 31.549 s
Execution time: 31.601 s
Execution time: 31.168 s
Execution time: 31.528 s
Execution time: 31.481 s
Execution time: 31.269 s
- adfind -b “your dn here” -f “(objectclass=user)” name samaccountname -csv
Execution time: 37.305 s
Execution time: 34.815 s
Execution time: 34.275 s
Execution time: 34.193 s
Execution time: 39.116 s
Execution time: 34.634 s
Execution time: 39.265 s
Execution time: 33.686 s
Execution time: 33.793 s
Execution time: 33.917 s

Here is the script I used for the DSP Tests

function Get-DSPObject {

Param(

$filter = "(objectclass=user)",

$base = ([ADSI]"").distinguishedName,

$Server,

[int]$pageSize = 1000,

[string[]]$props = @("1.1"),

[switch]$noHeader,

[switch]$csv,

[switch]$count

)

[VOID][System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols")

[int]$pageCount = 0

[int]$objcount = 0

if(!$server){$server = ([ADSI]"").distinguishedName -replace ",","." -replace "dc=","" }

$connection = New-Object System.DirectoryServices.Protocols.LdapConnection($Server)

$subtree = [System.DirectoryServices.Protocols.SearchScope]"Subtree"

$searchRequest = New-Object System.DirectoryServices.Protocols.SearchRequest($base,$filter,$subtree,$props)

$pagedRequest = New-Object System.DirectoryServices.Protocols.PageResultRequestControl($pageSize)

$searchOptions = New-Object System.DirectoryServices.Protocols.SearchOptionsControl([System.DirectoryServices.Protocols.SearchOption]::DomainScope)

$searchRequest.Controls.add($pagedRequest) | out-null

$searchRequest.Controls.Add($searchOptions) | out-null

# Output Prep

if($props -notcontains "1.1")

{

$MyProps = @()

foreach($prop in $props){$MyProps += $prop.ToLower()}

if($csv)

{

if(!$noHeader)

{

$header = "distinguishedName"

foreach($prop in $props){$header += ",$prop"}

$header

}

}

else

{

$MyUserObj = New-Object System.Object

$MyUserObj | Add-Member -name distinguishedName -MemberType "NoteProperty" -value $null

foreach($prop in $props){$MyUserObj | Add-Member -name $prop -MemberType "NoteProperty" -value $null}

}

}

# Process Pages

while ($True)

{

# Increment the pageCount by 1

$pageCount++

# Cast the directory response into a SearchResponse object

$searchResponse = $connection.SendRequest($searchRequest)

# Display the retrieved page number and the number of directory entries in the retrieved page

# "Page:{0} Contains {1} response entries" -f $pageCount,$searchResponse.entries.count

$objcount += ($searchResponse.entries).count

# Display the entries within this page

if(!$count)

{

if($props -notcontains "1.1")

{

foreach($entry in $searchResponse.Entries)

{

if($csv)

{

$results = "`"{0}`"" -f $entry.distinguishedName

foreach($prop in $MyProps)

{

$results += ",`"{0}`"" -f ($entry.Attributes[$prop][0])

}

$results

}

else

{

$MyUserObj.distinguishedName = $entry.distinguishedName

foreach($prop in $MyProps)

{

$MyUserObj."$prop" = $null

$MyUserObj."$prop" = $entry.Attributes[$prop][0]

}

$MyUserObj

}

}

}

else{$searchResponse.Entries | select distinguishedName}

}

# if this is true, there are no more pages to request

if ($searchResponse.Controls[0].Cookie.Length -eq 0){if($count){$objcount};break}

# Set the cookie of the pageRequest equal to the cookie of the pageResponse to request the next

# page of data in the send request and cast the directory control into a PageResultResponseControl object

$pagedRequest.Cookie = $searchResponse.Controls[0].Cookie

}

}

foreach($i in (1..10))

{

$time = Measure-Command { Get-DSPObject -prop "name","sAMAccountName" -csv }

"Execution time: {0:n3} s" -f $time.TotalSeconds

}

tshell :: Jun.12.2008 :: All :: No Comments »

My First Venture into S.DS.P and Powershell

There has be much debate and agony on the the slowness of System.DirectoryServices.DirectorySearcher Class. This has lead me down the path of playing with System.DirectoryServices.Protocols (aka s.ds.p.)

By far the best tool out there right now is ADFind by joe Richards. So I used this for my target (although I didnt expect to get close.)

Here is the Guide I used in my Journey:
Introduction to System.DirectoryServices.Protocols (S.DS.P)

I started by writing the script you will find below and tested in a domain with well over 700k users and one with 200K. I did the test three different times in each Domain changing the order so cache hits wouldn’t be an issue. I also use objectclass on all three so index wouldn’t be a factor. I should NOTE that my script ONLY returns the count ATM. I am going to add properties next.

As you will see by the test results below… I got pretty darn close to adfind.exe in regards to perf. I was quite impressed with S.DS.P. Now to be fair, this was just counting objects. I am sure adfind.exe will start sneaking ahead abit further when we start processing properties and such. Can’t wait to see! Understand these test were just to see what tests I should focus on. I will posting another entry on more extensive count test with just DSP Using 1.1 and Adfind.

Test 1 700K Users done Remote

DirectorySearcher : 125.9123257
ADFind : 46.3763349
DSP Using DN : 69.5628776
DSP Using 1.1 : 49.4458161

Test 2 700K Users done Remote

DirectorySearcher : 125.0230257
ADFind : 46.4486472
DSP Using DN : 68.9255288
DSP Using 1.1 : 49.0780736

Test 3 700K Users done Remote

DirectorySearcher : 125.0230257
ADFind : 47.9162918
DSP Using DN : 79.6885386
DSP Using 1.1 : 54.152966

Test 1 200K done Local

DirectorySearcher : 121.1063569
ADFind : 55.2775406
DSP Using DN : 67.897922
DSP Using 1.1 : 28.5441615

Test 2 200K done Local

DirectorySearcher : 80.0894455
ADFind : 23.558696
DSP Using DN : 54.3111576
DSP Using 1.1 : 42.3485998

Test 3 200K done Local

DirectorySearcher : 99.1125363
ADFind : 80.1497852
DSP Using DN : 64.3716824
DSP Using 1.1 : 64.1940421

Summary: adfind.exe was faster (by bout 4sec on Avg.) remotely and larger domain, but protocals was faster (by bout 8 sec on Avg.) local on smaller domain.
Remote

ADFind: 46.92
DSP Using 1.1: 50.89
DSP Using DN: 72.73
DirectorySearcher: 125.32

Local

DSP Using 1.1: 45.03
ADFind: 52.99
DSP Using DN: 62.19
DirectorySearcher: 100.10

Here the script I ran for the test and how I measured the commands. I am going to play with passing the stats control and see what the server says later.

$SearcherExpression = @’

$searcher = new-object System.DirectoryServices.DirectorySearcher([ADSI]"","(objectclass=user)",@("distinguishedName"))

$searcher.pagesize = 1000

$searcher.findall()

‘@

Write-Host "Test 1"

Write-Host ("-"*40)

$myresults1 = "" | select @{n="DirectorySearcher";e={(Measure-command {invoke-expression $SearcherExpression}).TotalSeconds}},

@{n="ADFind";e={(Measure-Command { .\adfind -b "dc=corp,dc=lab" -c -f "(objectclass=user)" }).TotalSeconds}},

@{n="DSP Using DN";e={(Measure-command { .\Test-DSProtocals.ps1 }).TotalSeconds}},

@{n="DSP Using 1.1";e={(Measure-command { .\Test-DSProtocalsSP.ps1 }).TotalSeconds}}

$myresults1 | fl

Write-Host "Test 2"

Write-Host ("-"*40)

$myresults2 = "" | select @{n="ADFind";e={(Measure-Command { .\adfind -b "dc=corp,dc=lab" -c -f "(objectclass=user)" }).TotalSeconds}},

@{n="DSP Using 1.1";e={(Measure-command { .\Test-DSProtocalsSP.ps1 }).TotalSeconds}},

@{n="DSP Using DN";e={(Measure-command { .\Test-DSProtocals.ps1 }).TotalSeconds}},

@{n="DirectorySearcher";e={(Measure-command {invoke-expression $SearcherExpression}).TotalSeconds}}

$myresults2 | fl

Write-Host "Test 3"

Write-Host ("-"*40)

$myresults3 = "" | select @{n="DSP Using DN";e={(Measure-command { .\Test-DSProtocals.ps1 }).TotalSeconds}},

@{n="DSP Using 1.1";e={(Measure-command { .\Test-DSProtocalsSP.ps1 }).TotalSeconds}},

@{n="DirectorySearcher";e={(Measure-command {invoke-expression $SearcherExpression}).TotalSeconds}},

@{n="ADFind";e={(Measure-Command { .\adfind -b "dc=corp,dc=lab" -c -f "(objectclass=user)" }).TotalSeconds}}

$myresults3 | fl

$myresults1,$myresults2,$myresults3

Here is what the output of that Script looks like

Here is the System.DirectoryServices.Protocols Code

[System.Reflection.assembly]::LoadWithPartialName("system.directoryservices.protocols") | Out-Null

$domain = ([ADSI]"").distinguishedName -replace ",","." -replace "dc=",""

$DomainDN = "DC=" + $Domain -replace "\.",",DC="

[int]$pageCount = 0

[int]$pageSize = 1000

[int]$count = 0

$connection = New-Object System.DirectoryServices.Protocols.LdapConnection($domain)

$subtree = [System.DirectoryServices.Protocols.SearchScope]"Subtree"

$filter = "(objectclass=user)"

$searchRequest = New-Object System.DirectoryServices.Protocols.SearchRequest($DomainDN,$filter,$subtree,@("1.1"))

$pagedRequest = New-Object System.DirectoryServices.Protocols.PageResultRequestControl($pageSize)

$searchRequest.Controls.add($pagedRequest) | out-null

$searchOptions = new-object System.DirectoryServices.Protocols.SearchOptionsControl([System.DirectoryServices.Protocols.SearchOption]::DomainScope)

$searchRequest.Controls.Add($searchOptions) | out-null

while ($true)

{

## increment the pageCount by 1

$pageCount++

## cast the directory response into a

## SearchResponse object

$searchResponse = $connection.SendRequest($searchRequest)

## verify support for this advanced search operation

if (($searchResponse.Controls.Length -lt 1) -or

!($searchResponse.Controls[0] -is [System.DirectoryServices.Protocols.PageResultResponseControl]))

{

Write-Host "The server cannot page the result set"

return;

}

## cast the diretory control into

## a PageResultResponseControl object.

$pageResponse = $searchResponse.Controls[0]

## display the retrieved page number and the number of

## directory entries in the retrieved page

#"Page:{0} Contains {1} response entries" -f $pageCount,$searchResponse.entries.count

$count += $searchResponse.entries.count

## display the entries within this page

## foreach($entry in $searchResponse.entries){$entry.DistinguishedName}

## if this is true, there

## are no more pages to request

if ($pageResponse.Cookie.Length -eq 0){write-Host $count;break}

## set the cookie of the pageRequest equal to the cookie

## of the pageResponse to request the next page of data

## in the send request

$pagedRequest.Cookie = $pageResponse.Cookie

}

tshell :: Jun.07.2008 :: All :: No Comments »

Fun with Active Directory (Playing Around Series)

This is the first in a series of posts call “Playing Around Series.” This series will basically be demo Videos of different Snapins/.NET Classes and their use.

In this entry I run through creating a DirectoryEntry, DirectorySearcher, and using the System.DirectoryServices.ActiveDirectory.Domain Class.

Note: This is a fast run through. I STRONGLY recommend pausing and reading the Comments. Best Viewed Full Screen

Get the Flash Player to see this player.

Special Shout-out to JayKul and Jeffrey Snover for the Start-Demo script.
http://www.powershellcentral.com/scripts/302

Demo Text

#

# Lets start off by looking at DirectoryEntry

#

$DE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=tstUsr101,OU=MyUsers,DC=corp,DC=lab")

#

# First lets see what we have access to

#

$DE | Get-Member

#’

# Hmmm.. doesn’t seem like much. OH WAIT! Remember Powershell abstracts the class… Lets add psbase

#

$DE.psbase | Get-Member

#

# Lets look at what properties are available.

#

$DE.psbase.Properties

#

# Thats more like it. You may also note that some AD properties are still missing.

# That is because that LDAP doesnt return all the properties. For these you need to "GET" them.

$DE.psbase.InvokeGet(‘msExchUMFaxID’)

#

# Using DirectoryEntry is fine if you know the DN of the object, but what if you need to search?

# Lets look at System.DirectoryServices.DirectorySearcher

#

# The Searcher needs some info so put that in variables first

#

$root = [ADSI]"" ## This is using the Type Accelerator we spoke about earlier… This is Gets the base

$filter = "(&(objectcategory=user))"

#

# Now Lets create the searcher

#

$searcher = New-Object System.DirectoryServices.DirectorySearcher($root,$filter)

#

# That gets the searcher ready, but to execute we need to call findall() or findone()

#

$users = $searcher.findAll()

#

# Lets see what we got. We have alot so lets only pick the first 10

#

$users | select -first 10

#

# Tons of info, but notice that this is NOT the same as DirectoryEntry

#

$users | get-Member

#

# It still has the properties property, Lets look (but only the first 3)

#

$users | select -first 3 | %{$_.Properties}

#

# Finally Lets look at System.DirectoryDervices.ActiveDirectory.Domain

#

# We can use this to interactively browse around

#

[system.directoryservices.activedirectory.domain]::GetCurrentDomain()

#

# Lets assign that to variable to play with

#

$domain = [system.directoryservices.activedirectory.domain]::GetCurrentDomain()

$domain

#

# Lets see what this has to offer

#

$domain | get-member

#

# Tons of cool stuff here.

#

# We can find all domain controllers

$domain.FindAllDomainControllers()

#

# We Can look at our Domain FSMO

#

$domain | ft PdcRoleOwner,RidRoleOwner,InfrastructureRoleOwner

#

# I can even step the tree and get my forest root

#

$forest = $domain.Forest

$forest

#

# With our new found $forest object… what can do we do?

#

$forest | Get-Member

#

# WE can find all our GCs

#

$forest.FindAllGlobalCatalogs()

#

# We can look at the Forest Mode

#

$forest.ForestMode

#

# Look at the Forest FSMO

#

$forest | ft SchemaRoleOwner,NamingRoleOwner

#

# Even look at sites

$forest.Sites

#

# We can go on forever and ever. If you would like we can revisit this later.

#

tshell :: May.20.2008 :: All :: No Comments »

Get/Set-ADACL (ACL and SDDLs for Active Directory!)

A friend had a need to get/set Active Directory ACLs. So I wrote these.

They will use [System.DirectoryServices.ActiveDirectoryAccessRule] objects or SDDLs strings.

Note: I put the .NET classes and MS Spec for SDDLs at the bottom. Dont miss it!

Get-ADACL.ps1

# Get-ADACL.ps1

Param($DNPath,[switch]$SDDL,[switch]$help,[switch]$verbose)

function HelpMe{

Write-Host

Write-Host " Get-ADACL.ps1:" -fore Green

Write-Host " Gets ACL object or SDDL for AD Object"

Write-Host

Write-Host " Parameters:" -fore Green

Write-Host " -DNPath : Parameter: DN of Object"

Write-Host " -sddl : [SWITCH]: Output SDDL instead of ACL Object"

Write-Host " -Verbose : [SWITCH]: Enables Verbose Output"

Write-Host " -Help : [SWITCH]: Displays This"

Write-Host

Write-Host " Examples:" -fore Green

Write-Host " Get ACL for ‘cn=users,dc=corp,dc=lab’" -fore White

Write-Host " .\Get-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’" -fore Yellow

Write-Host " Get SDDL for ‘cn=users,dc=corp,dc=lab’" -fore White

Write-Host " .\Get-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -sddl " -fore Yellow

Write-Host

}

if(!$DNPath -or $help){HelpMe;return}

Write-Host

if($verbose){$verbosepreference="continue"}

Write-Verbose " + Processing Object [$DNPath]"

$DE = [ADSI]"LDAP://$DNPath"

Write-Verbose " - Getting ACL"

$acl = $DE.psbase.ObjectSecurity

if($SDDL)

{

Write-Verbose " - Returning SDDL"

$acl.GetSecurityDescriptorSddlForm([System.Security.AccessControl.AccessControlSections]::All)

}

else

{

Write-Verbose " - Returning ACL Object [System.DirectoryServices.ActiveDirectoryAccessRule]"

$acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])

}

Set-ADACL.ps1

# Set-ADACL.ps1

Param($DNPath,$acl,$sddl,[switch]$verbose,[switch]$help)

function HelpMe{

Write-Host

Write-Host " Set-ADACL.ps1:" -fore Green

Write-Host " Sets the AD Object ACL to ‘ACL Object’ or ‘SDDL’ String"

Write-Host

Write-Host " Parameters:" -fore Green

Write-Host " -DNPath : Parameter: DN of Object"

Write-Host " -ACL : Parameter: ACL Object"

Write-Host " -sddl : Parameter: SDDL String"

Write-Host " -Verbose : [SWITCH]: Enables Verbose Output"

Write-Host " -Help : [SWITCH]: Displays This"

Write-Host

Write-Host " Examples:" -fore Green

Write-Host " Set ACL on ‘cn=users,dc=corp,dc=lab’ using ACL Object" -fore White

Write-Host " .\Set-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -ACL $acl" -fore Yellow

Write-Host " Set ACL on ‘cn=users,dc=corp,dc=lab’ using SDDL" -fore White

Write-Host " .\Set-ADACL.ps1 ‘cn=users,dc=corp,dc=lab’ -sddl `$mysddl" -fore Yellow

Write-Host

}

if(!$DNPath -or (!$acl -and !$sddl) -or $help){HelpMe;Return}

Write-Host

if($verbose){$verbosepreference="continue"}

Write-Verbose " + Processing Object [$DNPath]"

$DE = [ADSI]"LDAP://$DNPath"

if($sddl)

{

Write-Verbose " - Setting ACL using SDDL [$sddl]"

$DE.psbase.ObjectSecurity.SetSecurityDescriptorSddlForm($sddl)

}

else

{

foreach($ace in $acl)

{

Write-Verbose " - Adding Permission [$($ace.ActiveDirectoryRights)] to [$($ace.IdentityReference)]"

$DE.psbase.ObjectSecurity.SetAccessRule($ace)

}

}

$DE.psbase.commitchanges()

Write-Host

More Info
I used the following .NET Classes
System.DirectoryServices.DirectoryEntry
http://msdn2.microsoft.com/en-us/library/system.directoryservices.directoryentry.aspx
System.DirectoryServices.ActiveDirectoryAccessRule
http://msdn2.microsoft.com/en-us/library/system.directoryservices.activedirectoryaccessrule.aspx
System.DirectoryServices.ActiveDirectorySecurity
http://msdn2.microsoft.com/en-us/library/system.directoryservices.activedirectorysecurity.aspx
System.Security.AccessControl.AccessControlSections
http://msdn2.microsoft.com/en-us/library/system.security.accesscontrol.accesscontrolsections(vs.80).aspx

SDDL Info
MS: http://msdn2.microsoft.com/en-us/library/aa379567.aspx

tshell :: Mar.30.2008 :: .NET, Active Directory, HowTo, Powershell, Scripting :: 2 Comments »

Check Active Directory Latency

The other day I had a need to see how long it took for an object to be replicated to all the Domain Controllers in my Environment.

Here is the script I came up with. It does the following:
- Finds all Domain Controllers in the Domain (using .NET)
- Creates a contact object in a specified OU (Default is users container for the Domain)
- Gets the start Time
- Loops and Checks each DC for the object.
- Once all DCs have the object it gets End Time
- Outputs the results

Some extra features
- re-writes screen using $host.UI.RawUI.CursorPosition. No scrolling text - Outputs a custom object with Name and Time to Replicate (-table)

Parameters/Switches
-target: DC to create object on. (Default: it will find one for you)
-fqdn: Used to Find Domain Controllers (Default: Use current Domain)
-ou: DN of the path to create contact objects (Default Users Container)
-remove: If $true it removes the temp object (default is $true)
-table: switch that will return a table with the DC and Time it took to replicate (as output)

Here is the code:

Param($target = (([ADSI]"LDAP://rootDSE").dnshostname),

$fqdn = (([ADSI]"").distinguishedname -replace "DC=","" -replace ",","."),

$ou = ("cn=users," + ([ADSI]"").distinguishedname),

$remove = $true,

[switch]$table

)

$context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("Domain",$fqdn)

$dclist = [System.DirectoryServices.ActiveDirectory.DomainController]::findall($context)

if($table)

{

$DCTable = @()

$myobj = "" | select Name,Time

$myobj.Name = ("$target [SOURCE]").ToUpper()

$myobj.Time = 0.00

$DCTable += $myobj

}

$name = "rTest" + (Get-Date -f MMddyyHHmmss)

Write-Host "`n Creating Temp Contact Object [$name] on [$target]"

$contact = ([ADSI]"LDAP://$target/$ou").Create("contact","cn=$Name")

$contact.SetInfo()

$dn = $contact.distinguishedname

Write-Host " Temp Contact Object [$dn] Created! `n"

$start = Get-Date

$i = 0

Write-Host " Found [$($dclist.count)] Domain Controllers"

$cont = $true

While($cont)

{

$i++

$oldpos = $host.UI.RawUI.CursorPosition

Write-Host " =========== Check $i ===========" -fore white

start-Sleep 1

$replicated = $true

foreach($dc in $dclist)

{

if($target -match $dc.Name){continue}

$object = [ADSI]"LDAP://$($dc.Name)/$dn"

if($object.name)

{

Write-Host " - $($dc.Name.ToUpper()) Has Object [$dn]" (" "*5) -fore Green

if($table -and !($dctable | ?{$_.Name -match $dc.Name}))

{

$myobj = "" | Select-Object Name,Time

$myobj.Name = ($dc.Name).ToUpper()

$myobj.Time = ("{0:n2}" -f ((Get-Date)-$start).TotalSeconds)

$dctable += $myobj

}

}

else{Write-Host " ! $($dc.Name.ToUpper()) Missing Object [$dn]" -fore Red;$replicated = $false}

}

if($replicated){$cont = $false}else{$host.UI.RawUI.CursorPosition = $oldpos}

}

$end = Get-Date

$duration = "{0:n2}" -f ($end.Subtract($start).TotalSeconds)

Write-Host "`n Took $duration Seconds `n" -fore Yellow

if($remove)

{

Write-Host " Removing Test Object `n"

([ADSI]"LDAP://$target/$ou").Delete("contact","cn=$Name")

}

if($table){$dctable | Sort-Object Time | Format-Table -auto}

tshell :: Mar.11.2008 :: Active Directory, HowTo, Powershell, Scripting :: No Comments »

AD Replication Metadata (when did that change?)

There was a discussion on the NG about determining when a user was disabled. The initial request was to determine this based on whenChanged, but I thought that could be invalid as you can easily change an account after it was disabled. I can not think of a way to be sure, but the best way I can think of is to use the replication metadata on the attribute userAccountControl (the second bit is what determines if its disabled or not.) While it is possible to change the useraccountcontrol after a user is disabled it is unlikely.

More info for UserAccountControl bits
http://support.microsoft.com/kb/305144

Of course the next question was how do you check the Replication Metadata for an attribute on and AD object?

Enter Get-ADObjectREplicationMetadata.ps1

This uses

System.DirectoryServices.ActiveDirectory.DirectoryContext
- http://msdn2.microsoft.com/en-us/library/system.directoryservices.activedirectory.directorycontext.aspx
System.DirectoryServices.ActiveDirectory.DomainController
- http://msdn2.microsoft.com/en-gb/library/system.directoryservices.activedirectory.domaincontroller.aspx

# Get-ADObjectREplicationMetadata.ps1

# Brandon Shell (www.bsonposh.com)

# Purpose: Get attribute(s) Replication Metadata from a Domain controller.

Param($Domain,$objectDN,$property)

# Sets Context to Domain for System.DirectoryServices.ActiveDirectory.DomainController

$context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("Domain",$domain)

# .NET Class that returns a Domain Controller for Specified Context

$dc = [System.DirectoryServices.ActiveDirectory.DomainController]::findOne($context)

# GetReplicationMetadata returns metadate from the DC for the DN specified.

$meta = $dc.GetReplicationMetadata($objectDN)

if($property){$meta | %{$_.$Property}}else{$meta}

This will return either all the metadata or just the metadata for a specific attribute. I should note that if you do not specify an attribute it returns all of them. You should expect to parse these as each attribute has a child object with the data in it.

All Attributes. The value can be found by .PropertyName

PS# .\Get-ADObjectMetaData.ps1 ‘my.lab.domain’ ‘CN=TestUser,DC=my,dc=lab,dc=domain’

Name Value

—- —–

countrycode System.DirectoryServices.ActiveDirectory.AttributeMetadata

cn System.DirectoryServices.ActiveDirectory.AttributeMetadata

mail System.DirectoryServices.ActiveDirectory.AttributeMetadata

scriptpath System.DirectoryServices.ActiveDirectory.AttributeMetadata

ntsecuritydescriptor System.DirectoryServices.ActiveDirectory.AttributeMetadata

accountexpires System.DirectoryServices.ActiveDirectory.AttributeMetadata

displayname System.DirectoryServices.ActiveDirectory.AttributeMetadata

profilepath System.DirectoryServices.ActiveDirectory.AttributeMetadata

primarygroupid System.DirectoryServices.ActiveDirectory.AttributeMetadata

unicodepwd System.DirectoryServices.ActiveDirectory.AttributeMetadata

objectclass System.DirectoryServices.ActiveDirectory.AttributeMetadata

objectcategory System.DirectoryServices.ActiveDirectory.AttributeMetadata

instancetype System.DirectoryServices.ActiveDirectory.AttributeMetadata

homedrive System.DirectoryServices.ActiveDirectory.AttributeMetadata

samaccounttype System.DirectoryServices.ActiveDirectory.AttributeMetadata

homedirectory System.DirectoryServices.ActiveDirectory.AttributeMetadata

whencreated System.DirectoryServices.ActiveDirectory.AttributeMetadata

useraccountcontrol

The “Power” of SHELL

Phase 3 of S.DS.P “CSV Output” (as much as 21 sec faster!)

My First Venture into S.DS.P and Powershell

Fun with Active Directory (Playing Around Series)

Get/Set-ADACL (ACL and SDDLs for Active Directory!)

Check Active Directory Latency

AD Replication Metadata (when did that change?)