List DC OS Versions and Roles in a Forest.

Question

Hi Guys
I need to get info on all DC's in my forest, like OS version, Role, OU, What domain it resides in etc.
DSquery does not give me all the info, neither does ADUC, neither does Hyena, and powershell is not sufficient it ignores 2003 DC's.
ADUC has got me the most info so far, except i cannot export the search results to file.
Saved Queries only allows me to search one domain at a time.
I have about 100 Domains in the forest, and 1200 DC's
Any assistance will be appreciated.
Regards
Michael

Answer 1

I haven't had a chance to post to my Blog yet, but if you wnat to run discovery on a domain the following saved as a cmd file and using the freeware tool adFind.exe will dump a lot of results for you.
Echo off
cls
Rem --------------------------------------------------------------------------------------------------------------------------
Rem Program      - newDomain_adFind
Rem Author       - Paul Bergson
Rem Date Written - February 11, 2014
Rem Description  - Series of command lines utilizing adFind to extract information from domains (dnscmd is used to enumerate zones)
Rem                  This script must be run in the same sub-folder where adFind exists or adFind must be in the system path
Rem                  A sub-folder named domain_dump is created and a series of outputs are generated
Rem --------------------------------------------------------------------------------------------------------------------------
SET /P domainName=Please enter domain name:
md domain_dump_%domainName%
Echo Schema Version Number
AdFind -sc schver > .\domain_dump_%domainName%\schemaVersion.txt
Echo.
Echo Find Functional Levels
adfind -sc modes -nodn > .\domain_dump_%domainName%\functionalLevels.txt
Echo.
Echo Tombstone Lifetime
AdFind -config -f objectclass=ntdsservice tombstoneLifetime -nodn > .\domain_dump_%domainName%\tombstoneLifetime.txt
Echo.
Echo Password Policy
AdFind -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties -nodn -samdc > .\domain_dump_%domainName%\passwordPolicy.txt
Echo.
Echo Find FSMO Roles
adfind -sc fsmo -nodn > .\domain_dump_%domainName%\fsmo.txt
Echo.
Echo Organizational Unit count and number at the root
Echo Organizational Unit count and number at the root > .\domain_dump_%domainName%\ad_OU.csv
adfind -f "(objectCategory=organizationalUnit)" name -nodn -csv -s tree -c >> .\domain_dump_%domainName%\ad_OU.csv
Echo. >> .\domain_dump_%domainName%\ad_OU.csv
adfind -f "(objectCategory=organizationalUnit)" name -nodn -csv -s one >> .\domain_dump_%domainName%\ad_OU.csv
Echo.
Echo Sites In Domain
Echo Sites In Domain           > .\domain_dump_%domainName%\AD_Sites.csv
adfind -sites name -nodn -csv >> .\domain_dump_%domainName%\AD_Sites.csv
Echo.
Echo Subnets In Domain
Echo Subnets In Domain                                  > .\domain_dump_%domainName%\AD_Subnets.csv
AdFind -subnets -f (objectCategory=subnet) -csv  -nodn >> .\domain_dump_%domainName%\AD_Subnets.csv
Echo.
Echo List Domain Admins
Echo List Domain Admins   > .\domain_dump_%domainName%\domain_admins.csv
adfind -default -f "name= domain admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\domain_admins.csv
Echo.
Echo List Enterprise Admins
Echo List Enterprise Admins > .\domain_dump_%domainName%\ent_admins.csv
adfind -default -f "name= Enterprise Admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\ent_admins.csv
Echo.
Echo List Admins
Echo List Admins > .\domain_dump_%domainName%\admins.csv
adfind -default -f "name= administrators" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\admins.csv
Echo.
Echo List Schema Admins
Echo List Schema Admins > .\domain_dump_%domainName%\schema_admins.csv
adfind -default -f "name= Schema Admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\schema_admins.csv
Echo.
Echo List DNSAdmins
Echo List DNSAdmins > .\domain_dump_%domainName%\dns_admins.csv
adfind -default -f "name= DNS Admins" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\dns_admins.csv
Echo.
Echo List Account Operator
Echo List Account Operator > .\domain_dump_%domainName%\account_operators.csv
adfind -default -f "name= Account Operators" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\account_operators.csv
Echo.
Echo List Backup Operators
Echo List Backup Operators > .\domain_dump_%domainName%\backup_operators.csv
adfind -default -f "name= Backup Operators" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\backup_operators.csv
Echo.
Echo List Print Operators
Echo List Print Operators > .\domain_dump_%domainName%\print_operators.csv
adfind -default -f "name= Print Operators" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\print_operators.csv
Echo.
Echo List Server Operators
Echo List Server Operators > .\domain_dump_%domainName%\server_operators.csv
adfind -default -f "name= Server Operators" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\server_operators.csv
Echo.
Echo List Remote Desktop Users
Echo List Remote Desktop Users > .\domain_dump_%domainName%\remote_desktop_users.csv
adfind -default -f "name= Remote Desktop Users" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\remote_desktop_users.csv
Echo.
Echo List Group Policy Creator Owners
Echo List Group Policy Creator Owners > .\domain_dump_%domainName%\gpo_creators.csv
adfind -default -f "name= Group Policy Creator Owners" member -list | adfind -bit -f "&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)" samaccountname -nodn -csv >> .\domain_dump_%domainName%\gpo_creators.csv
Echo.
Echo List Domain Controllers and Config
adfind -config -rb cn=sites -f objectcategory=ntdsdsa > .\domain_dump_%domainName%\domainControllers.txt
Echo.
Echo List Trusts  
Echo List Trusts                                       > .\domain_dump_%domainName%\trusts.csv
Echo    TrustAttributes - 0x1 (Nontransitive)         >> .\domain_dump_%domainName%\trusts.csv
Echo                    - 0x2 (Uplevel clients only)  >> .\domain_dump_%domainName%\trusts.csv
Echo                    - 0x40000 (Tree parent)       >> .\domain_dump_%domainName%\trusts.csv
Echo                    - 0x80000 (Tree root)         >> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
Echo.   TrustDirection  - 1 (Inbound)                 >> .\domain_dump_%domainName%\trusts.csv
Echo.                   - 2 (Outbound)                >> .\domain_dump_%domainName%\trusts.csv
Echo.                   - 3 (Bidirectional)           >> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
Echo.   TrustType       - 1 (Downlevel)               >> .\domain_dump_%domainName%\trusts.csv
Echo.   TrustType       - 2 (Uplevel)                 >> .\domain_dump_%domainName%\trusts.csv
Echo.   TrustType       - 3 (Kerberos realm)          >> .\domain_dump_%domainName%\trusts.csv
Echo.   TrustType       - 4 (DCE)                     >> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
Echo ------------------------------------------------ >> .\domain_dump_%domainName%\trusts.csv
Echo.                                                
>> .\domain_dump_%domainName%\trusts.csv
adfind -gcb -f objectcategory=trusteddomain trustpartner trusttype trustdirection trustattributes -samdc -csv -nodn   >> .\domain_dump_%domainName%\trusts.csv
Echo.
Echo User Count
Echo User Count           > .\domain_dump_%domainName%\userCount.txt
adFind -sc adobjcnt:user >> .\domain_dump_%domainName%\userCount.txt
Echo.
Echo Password Not Expire
Echo Password Not Expire                             > .\domain_dump_%domainName%\PasswordNotExpire.txt
adFind -sc users_noexpire -nodn -csv samAccountName >> .\domain_dump_%domainName%\PasswordNotExpire.txt
Echo.
Echo Not Required
Echo Not Required                                      > .\domain_dump_%domainName%\PasswordNotRequired.txt
adFind -sc users_pwdnotreqd -nodn -csv samAccountName >> .\domain_dump_%domainName%\PasswordNotRequired.txt
Echo.
Echo Computer Count
Echo Computer Count           > .\domain_dump_%domainName%\computerCount.txt
adFind -sc adobjcnt:computer >> .\domain_dump_%domainName%\computerCount.txt
Echo.
Echo User Count
Echo User Count           > .\domain_dump_%domainName%\userCount.txt
adFind -sc adobjcnt:user >> .\domain_dump_%domainName%\userCount.txt
Echo.
Echo List All Users
AdFind -f "objectcategory=person" -sl -csv -nodn -tdcd samAccountName displayName lastLogonTimeStamp > .\domain_dump_%domainName%\users.csv
Echo.
Echo List Computer Objects
AdFind -f "objectcategory=computer" cn operatingsystem  operatingsystemServicePack lastLogonTimeStamp -csv -nodn -tdcd > .\domain_dump_%domainName%\computers.csv
Echo Foreign Security Principals Count
Echo Foreign Security Principals Count > .\domain_dump_%domainName%\FSP.txt
adfind -fsps -c                       >> .\domain_dump_%domainName%\FSP.txt
Echo.
Echo Partitions
Echo Partitions        > .\domain_dump_%domainName%\partitions.txt
adfind -sc domainncs >> .\domain_dump_%domainName%\partitions.txt
Echo.
Echo Exchange
Echo Exchange               > .\domain_dump_%domainName%\exchange.txt
adfind -exch -nodn -csv dn >> .\domain_dump_%domainName%\exchange.txt
Echo.
Echo Group Policy
Echo Group Policy              > .\domain_dump_%domainName%\gpo.txt
AdFind -gpo displayname -nodn >> .\domain_dump_%domainName%\gpo.txt
Echo.
REM Echo DNS
REM Echo DNS              > .\domain_dump_%domainName%\dns.txt
REM dnscmd /enumzones    >> .\domain_dump_%domainName%\dns.txt
REM Echo.
Echo DC Diagnostics
Echo DC Diagnostics   > .\domain_dump_%domainName%\dcDiag.txt
dcdiag /v /c /d /e    >> .\domain_dump_%domainName%\dcDiag.txt
Echo.
Echo Replication Diagnostics
Echo Replication Diagnostics                       > .\domain_dump_%domainName%\repAdmin.txt
repadmin.exe /showrepl * /verbose /all /intersite >> .\domain_dump_%domainName%\repAdmin.txt
Echo.
Echo This has completed
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.