Installing RSAT: Remote Server Administration Tools for Windows Vista

Remote Server Administration Tools was released by Microsoft for Windows Vista SP1 users to be able to manage both Windows 2003 and Windows 2008 Servers.

If you had upgraded to Vista in the past and wanted to manage Windows servers with your Vista client, you were able to with some hacks. But all in all it was a very painful process and a lot of administrators had to run a Windows XP machine virtually or have a second box to do server administrative tasks.

Now that the RSAT is released for general consumption what can it do?

Remote Server Administration Tools for Roles

Active Directory Certificate Services Tools – includes the Certification Authority snap-in, the Certificate Templates snap-in, the Enterprise PKI snap-in, and the Online Responder Management snap-in.

• Active Directory Certification Authority Tools includes the Certification Authority, Certificate Templates, and Enterprise PKI snap-ins.
• Online Responder Tools includes the Online Responder Management snap-in.

Active Directory Domain Services (AD DS) Tools – includes snap-ins and command-line tools for remotely managing Active Directory Domain Services.

• Active Directory Domain Controller Tools includes Active Directory Users and Computers, Active Directory Domains and Trusts, Active Directory Sites and Services, and other snap-ins and command-line tools for remotely managing AD DS.
• Server for Network Information Service (NIS) Tools includes an extension to the Active Directory Users and Computers snap-in, and the ypclear.exe command-line tool.

Active Directory Lightweight Directory Services (AD LDS) Tools – includes Active Directory Sites and Services, Active Directory Service Interfaces (ADSI) Edit, Schema Manager, and other snap-ins and command-line tools for managing AD LDS.

DHCP Server Tools – includes the DHCP snap-in.

DNS Server Tools – includes the DNS Manager snap-in and dnscmd.exe command-line tool.

File Services Tools – includes the following, along with the storagemgmt.msc snap-in:

• Distributed File System Tools includes the DFS Management snap-in, and the dfsradmin.exe, dfscmd.exe, dfsdiag.exe, and dfsutil.exe command-line tools.
• File Server Resource Manager Tools includes the File Server Resource Manager snap-in, and the filescrn.exe and storrept.exe command-line tools.
• Share and Storage Management Tools includes the Share and Storage Management snap-in.

Terminal Services Tools – includes the Remote Desktops and Terminal Services Manager snap-ins.

Universal Description, Discovery, and Integration (UDDI) Services Tools - includes the UDDI Services snap-in.

Microsoft Remote Server Administration Tools for Features

BitLocker Drive Encryption Tools – includes the manage-bde.wsf script.

Failover Clustering Tools – includes the Failover Cluster Manager snap-in and the cluster.exe command-line tool.

Group Policy Management Tools – includes Group Policy Management Console, Group Policy Management Editor, and Group Policy Starter GPO Editor.

Network Load Balancing Tools – includes the Network Load Balancing Manager snap-in, the nlb.exe and wlbs.exe command-line tools, and wlbsctrl.dll.

SMTP Server Tools – includes the Simple Mail Transfer Protocol (SMTP) snap-in.

Storage Manager for SANs Tools – Tools includes the Storage Manager for SANs snap-in, and the provisionstorage.exe command-line tool.

Windows System Resource Manager Tools – includes the Windows System Resource Manager snap-in and the wsrmc.exe command-line tool.

How to Install Remote Server Administration Tools for Vista

There are two versions of the RSAT tool, one for 32-bit machines and one for 64-bit machines. You can download the version you need at their respective download locations:

• Download: Remote Server Administration Tools (x86)
• Download: Remote Server Administration Tools (x64)

Once you download the file go ahead and give it a left click … c’mon … you know you want to! After clicking the file you will see it preparing the installation and doing a search to make sure your copy of Vista is prepared for the remote server admin tools.

After a bit you will get a prompt to install Update for Windows (KB941314)

After clicking Ok, you will now get prompted to read the license terms, in this case it is a simple paragraph that I actually read, that said if you are using an illegal copy you can’t use this software.

Since I am lucky enough to be using a legal copy I let off a sigh of relief and plunged ahead by clicking I Accept

Now it will begin Initializing installation and applying updates

After it is done installing you will see the Installation Complete screen:

Now when you go to Start->Administrative Tools you will see the following help file: Remote Server Administration Tool

When you click on it you will be able to read all about using Remote Server Administration Tool goodness. But instead of wasting your time reading that, I went through some of it above and will show some examples below here so you don’t have to!

The one thing you don’t see is any of the additional tools for administrating your Windows Servers, but that’s because you still have to enable them.

Now let’s go in and enable Remote Server Administration Tools in the control panel so you can use them: Start->Control Panel

Next you will see the control panel, go ahead and click on Programs

Click on Program & Features

On the left pane click on Turn Windows features on or off

Note: If you are prompted by UAC go ahead and click Ok

In the Windows Features window you can scroll down until you see Remote Server Administration Tool.

At this point you can install all the features, by checking the box, or you can expand out both the Feature Administration Tools & Role Administration Tools and only install the tools you wish to use. For our example I am going install them all!

Once you hit OK, you will see a window that shows it is configuring Vista with the features selected.

Now that it is enabled lets go back in to the Administrative Tools to see if anything is different?

Seems like everything was loaded correctly! Let’s take this baby for a test drive …

RSAT Terminal Services Manager in Vista

This section of the article will walk you through starting Terminal Services Manager and connecting to a remote Windows 2008 Server.

Go to your Administrative tools and go Terminal Services->Terminal Services Manager

You will see the following MMC open.

Note: You may be prompted by UAC, go ahead and click Ok

When you run Terminal Services Manager the first time (and every time if you don’t disable it) you get prompted by a warning that certain features are disabled when run from the console session.

If you wish to disable this, go ahead and check In the future, do not show this message and click Ok

As you can see this MMC is in the new Server 2008 layout. Let’s go ahead and click Connect to Computer in the right Actions pane

In the next window you can either connect to the local computer, or another computer. In this case I am going to enter an IP address to the test Windows Server 2008 I am running and click Ok

It connects successfully as you can see and I can tell that I already have a session on the test server through RDP.

There is a lot more to see in the MMC but I just wanted to demonstrate the functionality of administrating from Vista, and will have to cover actual usage in a future article.

As you can see RSAT brings a much overdue set of tools for System Administrators that will cut down on having to keep separate machines running just to do simple administrator tasks.

Search\Modify Objects

Search\Modify Objects

You can use the Active Directory module for Windows PowerShell to manage your search and modify operations on objects in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with searching for and modifying objects in AD DS:

• Counting Objects in Active Directory
  
  
• Viewing the RootDSE
  
  
• Connecting to a Well-Known Container
  
  
• Searching for a Large Number of Objects
  
  
• Viewing the Attributes of an Object
  
  
• Searching with a Bitwise Filter
  
  
• Creating an Object
  
  
• Searching the Global Catalog
  
  
• Searching for Objects in a Domain
  
  
• Deleting a Container That Has Child Objects
  
  
• Modifying an Object
  
  
• Modifying a Bit Flag Attribute
  
  
• Connecting to an Object GUID
  
  
• Dynamically Linking an Auxiliary Class
  
  
• Refreshing a Dynamic Object
  
  
• Exporting Objects to a CSV File
  
  
• Importing Objects by Using a CSV File
  
  
• Referencing an External Domain
  
  
• Renaming an Object
  
  
• Moving an Object to a Different OU or Container
  
  
• Deleting an Object
  
  
• Viewing the Created and Last Modified Time Stamp of an Object
  
  
• Searching for Deleted Objects
  
  
• Restoring a Single Object
  
  
• Restoring a Container Object and Its Children
  
  
• Viewing the ACL for an Object
  

Restoring a Container Object and Its Children,

Restoring a Container Object and Its Children

This topic explains how to use the Active Directory module for Windows PowerShell to restore a container and its child objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to restore the deleted organizational unit (OU) Finance_Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Finance_Department)" –IncludeDeletedObjects | Restore-ADObject
You have to first restore the parent object and then restore the child objects because the container must be in place for the objects to be restored to their proper location. The following example demonstrates how to restore the deleted child objects of the OU Finance_Department:
Get-ADObject -SearchBase "CN=Deleted Objects,DC=Fabrikam,DC=com" -Filter {lastKnownParent -eq "OU=Finance_Department,DC=Fabrikam,DC=com"} -IncludeDeletedObjects | Restore-ADObject

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Restore-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Restore-ADObject –detailed, and then press ENTER.

Viewing the ACL for an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the access control list (ACL) for an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the ACL for the user TempUser. In the following example, AD is the name of the Active Directory PowerShell drive that is connected to AD DS:
(Get-ACL 'AD:\CN=TempUser,CN=Users,DC=Fabrikam,DC=com').Access | ft IdentityReference,AccessControlType -A

Additional information

For a full explanation of the parameters that you can pass to Get-ACL, at the Active Directory module command prompt, type Get-Help Get-ACL –detailed, and then press ENTER.

Viewing the Created and Last Modified Time Stamp of an Object,Searching for Deleted Objects,Restoring a Single Object

Viewing the Created and Last Modified Time Stamp of an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the Created and Last Modified time stamp of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the Created and Last Modified time stamp of the organizational unit (OU) ManagedGroups in the Fabrikam.com domain:
Get-ADObject ManagedGroups -Properties Created,Modified

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching for Deleted Objects

This topic explains how to use the Active Directory module for Windows PowerShell to search for deleted objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to search for the deleted organizational unit (OU) Finance Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Finance_Department)" –IncludeDeletedObjects

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed , and then press ENTER.

Restoring a Single Object

This topic explains how to use the Active Directory module for Windows PowerShell to restore a single object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to restore the deleted organizational unit (OU) Accounting_Department in the Fabrikam.com domain:
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Accounting_Department)" –IncludeDeletedObjects | Restore-ADObject

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Restore-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Restore-ADObject –detailed, and then press ENTER.

Moving an Object to a Different OU or Container,Renaming,Deleting an Object

Renaming an Object

This topic explains how to use the Active Directory module for Windows PowerShell to rename an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to rename the name attribute of the OU ManagedGroups to Groups:
Rename-ADObject "OU=ManagedGroups,OU=Managed,DC=Fabrikam,DC=Com" -NewName Groups

Additional information

The following property value is the value that is used in the renaming of an Active Directory object:

• NewName
  

For a full explanation of the parameters that you can pass to Rename-ADObject, at the Active Directory module command prompt, type Get-Help Rename-ADObject –detailed, and then press ENTER.

Moving an Object to a Different OU or Container

This topic explains how to use the Active Directory module for Windows PowerShell to move an object to a different organizational unit (OU) or container in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to move the user object Brad Sutton from the Users container to the OU Accounting in the Fabrikam.com domain:
Move-ADObject 'CN=Brad Sutton,CN=Users,DC=Fabrikam,DC=com' -TargetPath 'OU=Accounting,DC=Fabrikam,DC=com'

Additional information

For a full explanation of the parameters that you can pass to Move-ADObject, at the Active Directory module command prompt, type Get-Help Move-ADObject –detailed, and then press ENTER.

Deleting an Object

This topic explains how to use the Active Directory module for Windows PowerShell to delete an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to delete the computer object AmyAl-LPTOP from AD DS:
Remove-ADObject 'CN=AmyAl-LPTOP,CN=Computers,DC=FABRIKAM,DC=COM'

Additional information

For a full explanation of the parameters that you can pass to Remove-ADObject, at the Active Directory module command prompt, type Get-Help Remove-ADObject –detailed, and then press ENTER.

Exporting Objects to a CSV File,Importing Objects by Using a CSV File,Referencing an External Domain

Exporting Objects to a CSV File

This topic explains how to use the Active Directory module for Windows PowerShell to export objects in Active Directory Domain Services (AD DS) to a comma-separated value (CSV) file.

Example

The following example demonstrates how to export the OU ManagedGroups and all its child objects to a CSV file:
Get-ADObject -Filter 'Name -like "*"' -Searchbase 'OU=ManagedGroups,DC=Fabrikam,DC=com' | Export-CSV ExportOU.csv

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Importing Objects by Using a CSV File

This topic explains how to use the Active Directory module for Windows PowerShell to import objects from a comma-separated value (CSV) file into Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to import the organizational unit (OU) ManagedGroups and all its child objects from a CSV file:
Import-CSV ImportOU.csv | foreach {New-ADObject -Path $_.Path -Name $_.Name -Type $_.Type}

Additional information

The following parameters are the most commonly used parameters for creating Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help Get-NewObject –detailed, and then press ENTER.

Referencing an External Domain

This topic explains how to use the Active Directory module for Windows PowerShell to refer to an external domain in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to create a cross-reference to the Northwind.com domain in the Fabrikam.com domain:
New-ADObject -Name northwind -Type crossref -OtherAttributes @{NcName="DC=NORTHWIND,DC=COM";DnsRoot="northwind-dc1.northwind.com"} -Path 'CN=Partitions,CN=Configuration,DC=FABRIKAM,DC=COM' -Description 'A cross reference to the external domain northwind.com'

Additional information

The following property values are the most common values that are used in the creation of a new Active Directory object:

• Description
  
• DisplayName
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help New-ADObject –detailed, and then press ENTER.

Connecting to an Object GUID, Refreshing a Dynamic Object,Dynamically Linking an Auxiliary Class

Connecting to an Object GUID

This topic explains how to use the Active Directory module for Windows PowerShell to connect to an object’s globally unique identifier (GUID) in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to connect to the user object SaraDavis using the object’s GUID:
Get-ADObject -Identity ccc6c0f8-5dd9-42bc-93da-407c6f9695ef

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Dynamically Linking an Auxiliary Class

This topic explains how to use the Active Directory module for Windows PowerShell to dynamically link an auxiliary class in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to dynamically link the auxiliary class object member-Fabrikam-User to the user SaraDavis:
Set-ADObject SaraDavis -Add @{ObjectClass="Fabrikam-User"}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Refreshing a Dynamic Object

This topic explains how to use the Active Directory module for Windows PowerShell to refresh a dynamic object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to refresh the Time to Live (TTL) attribute of the dynamic user object Brad Sutton:
Set-ADObject -Identity ‘CN=Brad Sutton,OU=Accounting,DC=Fabrikam,DC=com’ -Replace @{entryTTL="200000"}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Modifying a Bit Flag Attribute,Modifying an Object,Deleting a Container That Has Child Objects

Deleting a Container That Has Child Objects

This topic explains how to use the Active Directory module for Windows PowerShell to delete a container that has child objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to delete the container organizational unit (OU) Finance, which has child objects:
Remove-ADObject "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM" -Recursive

Additional information

For a full explanation of the parameters that you can pass to Remove-ADObject, at the Active Directory module command prompt, type Get-Help Remove-ADObject –detailed, and then press ENTER.

Modifying an Object

This topic explains how to use the Active Directory module for Windows PowerShell to modify the attribute of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to modify the Description attribute of the AntonioAl Direct Reports distribution list in the Fabrikam.com domain:
Set-ADObject 'CN=AntonioAl Direct Reports,OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM' -Description "Distribution List of Antonio Alwan Direct Reports"

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For the full explanation of the list of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed.

Modifying a Bit Flag Attribute

This topic explains how to use the Active Directory module for Windows PowerShell to modify a bit flag attribute of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to modify the bit flag attribute userAccountControl of the user object SaraDavis to Enabled:
Set-ADObject 'SaraDavis' -Replace @{<BitflagAttributeName>='512'}

Additional information

You can use the following parameters when you set many of the common values of Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Set-ADObject, at the Active Directory module command prompt, type Get-Help Set-ADObject –detailed, and then press ENTER.

Creating an Object,Searching the Global Catalog, Searching for Objects in a Domain

Creating an Object

This topic explains how to use the Active Directory module for Windows PowerShell to create an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to create a new site object in the Fabrikam.com domain:
New-ADObject -Name 'BO3' -Type site -Description 'Branch Office 3' -Path 'CN=Sites,CN=Configuration,DC=FABRIKAM,DC=COM'

Additional information

The following parameters are the most commonly used parameters for creating Active Directory objects:

• -Description
  
• -DisplayName
  
• -ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to New-ADObject, at the Active Directory module command prompt, type Get-Help New-ADObject –detailed, and then press ENTER.

Searching the Global Catalog

This topic explains how to use the Active Directory module for Windows PowerShell to connect to and search the global catalog.

Example

The following example demonstrates how to connect to and search the global catalog for all the users in the Fabrikam forest:
Get-ADObject -Filter 'ObjectClass -eq "users"' –Server corp-DC12:3268 -SearchBase 'DC=Fabrikam,DC=com' -Properties Name,sAMAccountName | FT Name,sAMAccountName

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

 

 

Searching for Objects in a Domain

This topic explains how to use the Active Directory module for Windows PowerShell to search for objects in a domain in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to search for all the computer objects in the Fabrikam.com domain:
Get-ADObject -Filter 'ObjectClass -eq "computer"' -SearchBase 'DC=Fabrikam,DC=com' -Properties Name,sAMAccountName | FT Name,sAMAccountName

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching for a Large Number of Objects,Viewing the Attributes of an Object,Searching with a Bitwise Filter

Searching for a Large Number of Objects

This topic explains how to use the Active Directory module for Windows PowerShell to search for a large number of objects in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to retrieve a large number of objects from the domain partition of the Fabrikam.com domain:
Get-ADObject -filter {name-like '*'}-SearchBase 'DC=Fabrikam,DC=com'-ResultSetSize $null | Measure-Object

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObject or Measure-Object, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Measure-Object -detailed, and then press ENTER.

Viewing the Attributes of an Object

This topic explains how to use the Active Directory module for Windows PowerShell to view the attributes of an object in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to view the attributes Name and CanonicalName of the sites in the Fabrikam.com domain:
Get-ADObject -Filter 'ObjectClass -eq "site"' -SearchBase 'CN=Configuration,DC=Fabrikam,DC=Com' -Properties CanonicalName | FT Name,CanonicalName -A

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADObject cmdlet by using the -Properties parameter:

• ObjectClass
  
• Created
  
• Modified
  
• Deleted
  
• ProtectedFromAccidentalDeletion
  

For a full explanation of the parameters that you can pass to Get-ADObjects, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Searching with a Bitwise Filter

This topic explains how to use the Active Directory module for Windows PowerShell to search for objects in Active Directory Domain Services (AD DS), based on a bitwise filter query.

Example

The following example demonstrates how to search for all universal groups in a domain by using a bitwise filter:
Get-ADObject -Filter 'GroupType -band 8'

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed, and then press ENTER.

Viewing the RootDSE

Viewing the RootDSE

This topic explains how to use the Active Directory module for Windows PowerShell to view the rootDSE of a domain. By viewing the attributes of the rootDSE, you can view the basic information about a forest, domain, or domain controller without having to hard-code the naming context in a search query.

Example

The following example demonstrates how to view the rootDSE of the Fabrikam.com domain:
Get-ADRootDSE

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADRootDSE cmdlet by using the -Properties parameter:

• ConfigurationNamingContext
  
• CurrentTime
  
• DefaultNamingContext
  
• DnsHostName
  
• DomainControllerFunctionality
  
• DomainFunctionality
  
• DsServiceName
  
• ForestFunctionality
  
• HighestCommittedUSN
  
• IsGlobalCatalogReady
  
• IsSynchronized
  
• LdapServiceName
  
• NamingContexts
  
• RootDomainNamingContext
  
• SchemaNamingContext
  
• ServerName
  
• SubschemaSubentry
  
• SupportedCapabilities
  
• SupportedControl
  
• SupportedLDAPPolicies
  
• SupportedLDAPVersion
  
• SupportedRootDSEOperations
  
• SupportedSASLMechanisms
  

For a full explanation of the parameters that you can pass to Get-ADRootDSE, at the Active Directory module command prompt, type Get-Help Get-ADRootDSE –detailed, and then press ENTER.

Counting Objects in Active Directory, Connecting to a Well-Known Container

Counting Objects in Active Directory

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the total number of objects that are stored in the Active Directory database.

Example

The following example demonstrates how to retrieve the total number of objects that are stored in the Active Directory database of the Fabrikam.com domain:
Get-ADObject -Filter {name -like '*'} -SearchBase 'CN=Schema,CN=Configuration,DC=Fabrikam,DC=COM' -ResultSetSize $null | Measure-Object

Additional information

For a full explanation of the parameters that you can pass to Get-ADObject or Measure-Object, at the Active Directory module command prompt, type Get-Help Get-ADObject –detailed or Get-Help Measure-Object, and then press ENTER.

Connecting to a Well-Known Container

This topic explains how to use the Active Directory module for Windows PowerShell to connect to a well-known container. A well-known container is an object in Active Directory Domain Services (AD DS), such as Users or Computers, that contains other objects.

Example

The following example demonstrates how to connect to the well-known containers in Active Directory Domain Services (AD DS):
Get-ADDomain Fabrikam.com | FL UsersContainer,ComputersContainer,DomainControllersContainer,DeletedObjectsContainer,SystemsContainer,LostAndFoundContainer,QuotasContainer,ForeignSecurityPrincipalsContainer

Additional information

For a full explanation of the parameters that you can pass to Get-ADDomain, at the Active Directory module command prompt, type Get-Help Get-ADDomain –detailed, and then press ENTER.

Password Policies

Password Policies

You can use the Active Directory module for Windows PowerShell to manage your password policies in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with password policy management:

• Create a New Fine-Grained Password Policy
  
  
• Retrieve Details of a Fine-Grained Password Policy
  
  
• Search for Fine-Grained Password Policies
  
  
• Modify a Fine-Grained Password Policy
  
  
• Apply a Fine-Grained Password Policy
  
  
• Remove a Fine-Grained Password Policy
  
  
• Delete a Fine-Grained Password Policy
  
  
• Get Resultant Password Policy of a User
  
  
• Find All Groups and Users to Which a Fine-Grained Password Policy Applies
  
  
• Retrieve Details of a Default Domain Password Policy
  
  
• Modify the Default Domain Password Policy
  

Modify the Default Domain Password Policy

Modify the Default Domain Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to modify the default domain password policy.

Example

The following example demonstrates how to modify the default domain password policy for the Fabrikam.com domain:
Set-ADDefaultDomainPasswordPolicy -Identity fabrikam.com -PasswordHistoryCount 10 –MinPasswordLength 7 -MinPasswordAge 1.00:00:00 -MaxPasswordAge 30.00:00:00 -LockoutObservationWindow 0.00:10:00 -LockoutThreshold 15

Additional information

You can use the following parameters when you set many of the common values that are associated with a fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Set-ADDefaultDomainPasswordPolicy, at the Active Directory module command prompt, type Get-Help Set-ADDefaultDomainPasswordPolicy –detailed, and then press ENTER.

Retrieve Details of a Default Domain Password Policy

Retrieve Details of a Default Domain Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the details of the default domain password policy.

Example

The following example demonstrates how to retrieve the details of the default domain password policy for the Fabrikam.com domain:
Get-ADDefaultDomainPasswordPolicy Fabrikam

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADDefaultDomainPasswordPolicy cmdlet by using the -Properties parameter:

• ComplexityEnabled
  
• LockoutDuration
  
• LockoutObservationWindow
  
• LockoutThreshold
  
• MaxPasswordAge
  
• MinPasswordAge
  
• MinPasswordLength
  
• PasswordHistoryCount
  
• ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Get-ADDefaultDomainPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADDefaultDomainPasswordPolicy –detailed, and then press ENTER.

Get Resultant Password Policy of a User,Find All Groups and Users to Which a Fine-Grained Password Policy Applies

Get Resultant Password Policy of a User

This topic explains how to use the Active Directory module for Windows PowerShell to get the resultant password policy of a user.

Example

The following example demonstrates how to get the resultant password policy of the user BobKe:
Get-ADUserResultantPasswordPolicy BobKe

Additional information

For a full explanation the parameters that you can pass to Get-ADUserResultantPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADUserResultantPasswordPolicy –detailed, and then press ENTER.

Find All Groups and Users to Which a Fine-Grained Password Policy Applies

This topic explains how to use the Active Directory module for Windows PowerShell to find all the groups and users to which a fine-grained password policy applies.

Example

The following example demonstrates how to find all the groups and users to which the fine-grained password policy AdminsPSO applies:
Get-ADFineGrainedPasswordPolicy AdminsPSO | ft AppliesTo -A

Additional information

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Search ,Modify ,Apply ,Remove ,Delete a Fine-Grained Password Policy

Search for Fine-Grained Password Policies

This topic explains how to use the Active Directory module for Windows PowerShell to search for fine-grained password policy policies.

Example

The following example demonstrates how to search for the fine-grained password policies in the Fabrikam.com domain:
Get-ADFineGrainedPasswordPolicy -Filter 'Name -like "*"' | ft Name, Precedence,MaxPasswordAge,MinPasswordLength -A

Additional information

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Modify a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to modify a fine-grained password policy.

Example

The following example demonstrates how to modify the minimum password length and password history count of the fine-grained password policy DomainUsersPSO:
Set-ADFineGrainedPasswordPolicy "DomainUsersPSO" -MinPasswordLength 8 -PasswordHistoryCount 24

Additional information

You can use the following parameters when you set many of the common values that are associated with a fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Set-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Set-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Apply a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to apply a fine-grained password policy.

Example 1

The following example demonstrates how to apply the fine-grained password policy DomainUsersPSO to the global security group Domain Users:
Add-ADFineGrainedPasswordPolicySubject DomainUsersPSO -Subjects 'Domain Users'

Example 2

The following example demonstrates how to apply the fine-grained password policy DlgtdAdminsPSO to two users with the samAccountName(s) BobKe and KimAb:
Add-ADFineGrainedPasswordPolicySubject DlgtdAdminsPSO -Subjects BobKe,KimAb

Additional information

For a full explanation of the parameters that you can pass to Add-ADFineGrainedPasswordPolicySubject, at the Active Directory module command prompt, type Get-Help Add-ADFineGrainedPasswordPolicySubject –detailed, and then press ENTER.

Remove a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to remove a fine-grained password policy from a user in Active Directory Domain Services (AD DS).

Example

The following example demonstrates how to remove the fine-grained password policy DlgtdAdminsPSO from two users, BobKe and KimAb:
Remove-ADFineGrainedPasswordPolicySubject DlgtdAdminsPSO -Subjects BobKe,KimAb

Additional information

For a full explanation of the parameters that you can pass to Remove-ADFineGrainedPasswordPolicySubject, at the Active Directory module command prompt, type Get-Help Remove-ADFineGrainedPasswordPolicySubject –detailed, and then press ENTER.

Delete a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to delete a fine-grained password policy.

Example

The following example demonstrates how to delete the fine-grained password policy DlgtdAdminsPSO:
Remove-ADFineGrainedPasswordPolicy -Identity DlgtdAdminsPSO

Additional information

For a full explanation of the parameters that you can pass to Remove-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Remove-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Retrieve Details of a Fine-Grained Password Policy

Retrieve Details of a Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to retrieve the details of a fine-grained password policy.

Example

The following example demonstrates how to retrieve the details of the fine-grained password policy AdminsPSO:
Get-ADFineGrainedPasswordPolicy AdminsPSO

Additional information

In addition to the standard Lightweight Directory Access Protocol (LDAP) attributes, you can retrieve the following extended properties of the Get-ADFineGrainedPasswordPolicy cmdlet by using the -Properties parameter:

• AppliesTo
  
• ComplexityEnabled
  
• LockoutDuration
  
• LockoutObservationWindow
  
• LockoutThreshold
  
• MaxPasswordAge
  
• MinPasswordAge
  
• MinPasswordLength
  
• PasswordHistoryCount
  
• Precedence
  
• ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to Get-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help Get-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Create a New Fine-Grained Password Policy

Create a New Fine-Grained Password Policy

This topic explains how to use the Active Directory module for Windows PowerShell to create a new fine-grained password policy.

Example 1

The following example demonstrates how to create a new fine-grained password policy for the domain users in the Fabrikam.com domain:
New-ADFineGrainedPasswordPolicy -Name "DomainUsersPSO" -Precedence 500 -ComplexityEnabled $true -Description "The Domain Users Password Policy"-DisplayName "Domain Users PSO" -LockoutDuration "0.12:00:00" -LockoutObservationWindow "0.00:15:00" -LockoutThreshold 10 -MaxPasswordAge "60.00:00:00" -MinPasswordAge "1.00:00:00" -MinPasswordLength 8 -PasswordHistoryCount 24 -ReversibleEncryptionEnabled $false

Example 2

The following example is a sample script that demonstrates how to create a new fine-grained password policy from a template:

C#

$templatePSO = New-Object Microsoft.ActiveDirectory.Management.Commands.ADFineGrainedPasswordPolicy
$templatePSO.ComplexityEnabled = $true
$templatePSO.LockoutDuration = [TimeSpan]::Parse("0.12:00:00")
$templatePSO.LockoutObservationWindow = [TimeSpan]::Parse("0.00:15:00")
$templatePSO.LockoutObservationWindow = [TimeSpan]::Parse("0.00:15:00")
$templatePSO.LockoutThreshold = 10
$templatePSO.MinPasswordAge = [TimeSpan]::Parse("0.00:10:00")
$templatePSO.PasswordHistoryCount = 24
$templatePSO.ReversibleEncryptionEnabled = $false
New-ADFineGrainedPasswordPolicy -Instance $templatePSO -Name "SvcAccPSO" -Precedence 100 -Description "The Service Accounts Password Policy" -DisplayName "Service Accounts PSO" -MaxPasswordAge "30.00:00:00" -MinPasswordLength 20
New-ADFineGrainedPasswordPolicy -Instance $templatePSO -Name "AdminsPSO" -Precedence 200 -Description "The Domain Administrators Password Policy" -DisplayName "Domain Administrators PSO" -MaxPasswordAge "15.00:00:00" -MinPasswordLength 10

Additional information

You can use the following parameters when you set many of the common values that are associated with the creation of a new fine-grained password policy:

• -ComplexityEnabled
  
• -Description
  
• -DisplayName
  
• -LockoutDuration
  
• -LockoutObservationWindow
  
• -LockoutThreshold
  
• -MaxPasswordAge
  
• -MinPasswordAge
  
• -MinPasswordLength
  
• -PasswordHistoryCount
  
• -ReversibleEncryptionEnabled
  

For a full explanation of the parameters that you can pass to New-ADFineGrainedPasswordPolicy, at the Active Directory module command prompt, type Get-Help New-ADFineGrainedPasswordPolicy –detailed, and then press ENTER.

Domain Controller and Operations Master Management

Domain Controller and Operations Master Management

You can use the Active Directory module for Windows PowerShell to manage your domain controllers and operations master (also known as flexible single master operations or FSMO) roles in Active Directory Domain Services (AD DS). The topics in this section explain how to use the Active Directory module to accomplish many of the common tasks that are associated with domain controller and operations master management:

• Finding the Domain Controllers for a Domain
  
  
• Finding the Closest Domain Controller
  
  
• Finding a Domain Controller's Site
  
  
• Finding the Global Catalog Servers in a Forest
  
  
• Moving a Domain Controller to a Different Site
  
  
• Enabling and Disabling the Global Catalog
  
  
• Determining Whether Global Catalog Promotion Is Complete
  
  
• Finding the Domain Controllers or Global Catalog Servers in a Site
  
  
• Finding Domain Controllers and Global Catalogs with DNS
  
  
• Enabling Universal Group Caching
  
  
• Seizing an Operations Master Role
  
  
• Finding the PDC Emulator Role Owner with DNS
  
  
• Finding the Operations Master Role Holders
  
  
• Transferring an Operations Master Role