Thursday, January 19, 2017

Domain Controller time is out of sync

Hardware->
Check hardware
Check VM configuration and Hypervisor settings
Check network / firewalls

Operating System->
On the affected DC run the following in cmd:
w32tm /config /syncfromflags:domhier /update
W32tm /resync /rediscover
net stop w32time && net start w32time

No change check the following regkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
AnnounceFlags must be set to 10 (Dec) or a (Hex)
If you have to set it just run again:
net stop w32time && net start w32time

At least you can try to set default settings:
net stop w32time
w32tm /unregister
w32tm /register
net start w32time

Tuesday, December 13, 2016

Powershell: User Accounts With Kerberos Pre-Authentication Disabled


Use the following Powershell command:

Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol | Out-GridView

Get a list of ALL the GP names and GUIDS

Just change: DC=yourdomin,DC=com to your domain name.

Dsquery * "CN=Policies,CN=System,DC=yourdomin,DC=com" -filter (objectClass=groupPolicyContainer) -attr Name DisplayName

Friday, December 2, 2016

Powershell Get Windows 2003 or earlier Computer Objects Found in Active Directory



Use the following Powershell syntax to determine the affected computers in your domain:
 
Get-ADComputer -Filter * -Property Name,OperatingSystem,OperatingSystemServicePack| Where-Object{($_.operatingsystem -like "*XP*") -or ($_.operatingsystem -like "*2000*") -or ($_.operatingsystem -like "*2003*") -or ($_.operatingsystemversion -like "*4.0*")}| Out-GridView

The output will be shown in a grid view.

Friday, November 25, 2016

Powershell Script: Set an extensionAttribute for multiple AD Users

With the attached script you can set extensionAttribute4 for multiple AD Users using a csv file. You can do this for other Attributes as well. :)

# Set extensionAttribute4 for specified AD Users
# Create a CSV file that looks like this:
################################################
# File path: c:\admin\UsersExt4.csv
#
# samAccountName,extensionAttribute4
# username.1,Test12345
# username.2,Test12345
################################################
# Scripty by Tim Buntrock

# import ad module
Import-module ActiveDirectory
# import users from csv and set extensionAttribute4
Import-Csv C:\admin\UsersExt4.csv | ForEach-Object {Set-ADUser $_.samAccountName -Replace @{extensionAttribute4=$_.extensionAttribute4} }