"managed by" attribute of computer object

Hi all,
I am working on a script to manage the computer's attribute "managed-by" through power shell. I have found the command Set-ADComputer "AAECNBJ003403L" -ManagedBy "dn_path_of_user" which does not seem to be a solution in
my ad environment.
In our environment, all the client machines are in one domain (machine.domain.com) and users from different domains (user1.domain.com ; user2.domain.com) logon to these machines ( all domains in same forest ). when I provide the DN path of the users which
is "cn=user,dc=user1,dc=domain,dc=com" in the command Set-ADComputer "AAECNBJ003403L" -ManagedBy "dn_path_of_user" I get the error as follows 
 Identity info provided in the extended attribute: 'ManagedBy' could not be resolved. Reason: 'Cannot find an object with identity: 'cn=user,dc=user1,dc=domain,dc=com under: 'DC=machine,DC=domain,DC=com'.
SO it is searching for the user object in machine.domain.com where the object does not exist. Please tell me if I can specify a user domain name in the command.

I need to dig into my customer's environment to know why it works for them when they add the user of a different domain. Yes, we were in the process of domain migration which has been delayed due to some incompatible applications.
We have also been using a script which is taking the input from a csv file and updating the managed by attribute of the machine. In the script we are specifying the domain  "user.domain.com" and it works for us when we need to update the attribute
in bulk. But we also need the command for updating the attribute of the individual machine as per the end user request. Please see the script below if this can be taken into reference. 
 Import-CSV C:\Users\W9a0n3p9\Desktop\comp.csv |%{
#Specify the search criteria
$Computer = $_.Computername
$samname = $_.Username
$domain = "user.domain.com"
#Get a list of domains in the forest and grab the DN of the one matching the above parameter.
$forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$domain = $forest.Domains | ? {$_.Name -eq $domain}
$domainDN = $domain.GetDirectoryEntry().distinguishedName  
Write-Output  "Found the remote domain, the full LDAP distinguished name is $DomainDN"
#Create an LDAP searcher object and pass in the DN of the domain we wish to query
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]"LDAP://$domainDN")
#Pass in the ceriteria we are searching for.
#In this case we're looking for users with a particular SAM name.
$Searcher.filter = "(&(objectCategory=person)(objectClass=user)(sAMAccountName= $samname))"  
$results = $Searcher.Findall()
#Loop through the results
Foreach($result in $results){
    $User = $result.GetDirectoryEntry()
    $userDN =  $user.DistinguishedName
    Write-Output "Set the Owner for Computer $computer as $userDN"
    $A= Get-adcomputer $computer
    $A.managedby = "$userdn"
    Set-adcomputer -instance $A
Regards,
Maddy

Similar Messages

  • Logoncount Attribute on Computer objects in Active Directory

    Hello,
    I have one question about the logoncount Attribute on Active Directory objects. As I understood on user objects this attribute counts the number of logons per DC (because it is not replicating).
    My question is:
    What exactly is count here on computer objects?
    I can see that on a Domain Controller computer object the logoncount is high for the DC itself and low on the other DC objects.
    Thank you.
    Regards
    Dennis

    Here is an old thread.  You will see some of the explanation from our own Richard :)
    http://www.techtalkz.com/windows-server-2003/500367-attributes-update-during-computer-logon.html
    Santhosh Sivarajan | Houston, TX | www.sivarajan.com
    ITIL,MCITP,MCTS,MCSE (W2K3/W2K/NT4),MCSA(W2K3/W2K/MSG),Network+,CCNA
    Windows Server 2012 Book - Migrating from 2008 to Windows Server 2012
    Blogs: Blogs
    Twitter: Twitter
    LinkedIn: LinkedIn
    Facebook: Facebook
    Microsoft Virtual Academy:
    Microsoft Virtual Academy
    This posting is provided AS IS with no warranties, and confers no rights.

  • Managing multiple "old" AD computer objects

    So we have implemented a naming convention where the techs just select a location and department during the imaging process for a  machine that is about to be deployed; during that process and the computers are automagically named something like "NYC-FIN-1234567"...
    with 1234567 being the dell asset tag.... pretty nifty Johan(!)
    However... the problem is that once that machine gets re-imaged at the same location and deployed to another team like the marketing folks  (ie."MKT")... it gets the name NYC-MKT-1234567...
    the problem I am seeing is now we have multiple objects in AD with the same asset tag which is causing nightmares for licensing management... NYC-FIN-1234567 & NYC-MKT-1234567 respectively.
    I am working on a PowerShell script that will trim the names down to their respective tags and then compare the list for duplicates - then check  and compare the duplicates properties like "created date" and make a determination and delete
    the older object...
    this checking for duplicates is proving to be a little more difficult and haven't even gotten to the evaluate section yet...  I am still working on my proficiency when it comes to more complex arrays.
    am i going about this the right way or does anyone else have another approach to this conundrum?
    scripting games '14 anyone :p

    all good info!
    Since our AD has less than 3000 workstation objects the 'scaling' is manageable... but could make it a little faster, but alas here is what i have with a couple of tweaks
    i am skimming all computer objects in our 'workstation' OU... and dropping the first two prefixes, and then checking for machines that match... we were originally using "created date" but since we have workstations that have been imaged to say
    a FIN dept and then to a MKT dept and then re-re-imaged back to FIN... the created date doesn't change so i switched to Modified date, and keep the newest one...
    but also as another 'layer' of protection i test-path of the workstation (we run this middle of the day) before disabling it and moving it to a "temp" ou where we can let them sit for a couple weeks in case we had a false positive (thus the ping)
    we can quickly restore that object... i also can just comment out the actual "move and disable command" so it generates me a nice list of machines that would have been deleted so i can do a 'sanity check' before deleting a bunch of vip's machiens
    from AD :)
    #Declare Domain and OU to be Scrubbed - and $dupou is the ou we can let them 'chillout' before deleting on the next run
    $domain = "domain.com"
    $OU = "OU=Workstations,DC=domain,DC=com"
    $CleanupList = "c:\disabled.txt"
    $dupOU = "OU=Duplicates,OU=INACTIVE,DC=domain,DC=com"
    if (test-path $CleanupList) {Remove-Item $CleanupList}
    $delOK = "c:\DelOk.txt"
    if (test-path $delOK) {Remove-Item $delOK}
    #this is the TEMPORARY throttle cap... so it will stop after it finds the amount defined by $cap (so we can phase it in)
    $cap = 10000
    $Global:i = 0
    $sdate = (Get-Date)
    Write-Output "AD Duplicate 'Scrubber' Script started on: "$sdate >> $CleanupList
    Write-output "These Machines were disabled and moved to the Inactive\Duplicates OU in our domain" >> $CleanupList
    Write-Output "--------------------------------------------------------------------------------------------------------------">> $CleanupList
    $comps = (Get-ADComputer -filter * -Server $domain -SearchBase $OU).name
    ForEach ($comp in $comps) {
    if ($global:i -lt $cap) {
    #trim length to just asset tags (last 7 digits)
    $Length = $comp.Length
    $var = $Length - 7
    $tag = $comp.Substring($var,7)
    Write-host -ForegroundColor yellow "Testing asset tag: $tag"
    $x =(Get-ADComputer -Filter "name -like '*$tag'" -Properties DistinguishedName, Modified -Server $domain -SearchBase $OU |Sort-Object -Property Modified)
    if ($x.count -gt 1) {
    $y = ($x.count) -1
    while ($y -ge 1 ) {
    $z = $y - 1
    $x.name[$z] >> $CleanupList
    #added a ping feature to as another level of "protection"
    if (Test-Connection $x.name[$z] -Count 2 -Quiet){
    Write-Output $x.name[$z]" is Online... Skipping"
    $x.name[$z] >> c:\WTF.txt
    }Else {
    #this line below this one is the one that moves and disables... comment out if testing with a # sign or remove when testing compelete
    #Get-ADComputer $x.name[$z] | Move-ADObject -TargetPath $dupOU -PassThru | Disable-ADAccount
    Write-Output $x.name[$z]" is Offline... should delete"
    $global:i++
    $x.name[$z] >> $delOK
    write-host -ForegroundColor Cyan $x.name[$z]" Moved and Disabled - $global:i"
    $y--
    Write-host "------------"
    Write-host -foregroundcolor cyan "$i Computer objects were Disabled and Moved to $dupOU :)"
    #message in the body
    $msg ="Please review the attached list to see the Duplicate machines that were moved and disabled via this script"
    #Recipients
    $mailTo = "shad acker <[email protected]>"
    Send-MailMessage -SmtpServer smtp.domain.com -Attachments $delOK -Body $msg -to $mailTo -From "DuplicateFinder<[email protected]>" -Subject "Computer Duplicates Disabled" -Cc "who ever <[email protected]>"
    not the prettiest or most efficinent but it seems to be working :)

  • Editing Computer object "info" attribute in AD

    Hi.
    I need to make it possible for users to update the AD computer object of the machine they are logged onto.
    To be able to do this I need to grant users write access to the "info" attribute of computer objects in AD. My problem is that I cannot figure out what permission entry to set to allow for users to apply "info".
    Does anyone know what permission entry on the "Computers" OU object to use to set delegated rights for "Domain users" to be able to edit the "info" attribute on each computer object?
    I am trying to achieve much of the same as described in this article, but I need to edit the "info" attribute...
    http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_24097287.html
    /Tord Bergset

    Greetings!
    Use 'Delegation Wizard' and select 'Create a custom task to delegate'. After that only choose
    'Computer Objects' and assign below rights:
    Regards.
    Mahdi Tehrani   |  
      |  
    www.mahditehrani.ir
    Please click on Propose As Answer or to mark this post as
    and helpful for other people.
    This posting is provided AS-IS with no warranties, and confers no rights.
    How to query members of 'Local Administrators' group in all computers?

  • Script Help - Adding Users from AD Group to Computer Object Attribute

    Environment:
    Computer Objects have the following name convention - USERNAME-INV#-PC.  An example is TEST1-54321-D.  There is a GPO in place that adds any user populated under the managedBy attribute in a computer object to the administrators group for that computer
    object.
    Scenario:
    Create "Local PC Admin" group
    When user TEST1 gets added to the "Local PC Admin" group, a powershell script that runs on an hourly scheduled task goes out and finds any computer object (that is not a server) that has TEST1 in its name.  For example, TEST1-54321-D for desktop
    and TEST1-98765-L for laptop.
    It then adds the user to the managedBy attribute of the computer object and appends the text "added as local admin on <currentdate>" to the computerobject description.
    If TEST2 is added to the group later, the script should see that TEST1 has already been added and only add TEST2 to the managedBy attribute to the appropriate computer as well as the "added as local admin on <currentdate>".
    Still thinking how this can be automated when a user is removed from the "Local PC Admin" group.
    Can somebody please find holes in this scenario or suggest a better method to approach this?

    Security nightmare?  How so?  Regular domain users cannot modify the "managedBy"  computer object attribute.
    The "Local PC Admin" group would be a ADUC security group.  The Help Desk and Network Admins would be the only ones that can either add users to the group or directly modify the "managedBy" computer object attribute.
    The Group Policy that runs against the desktops/laptops looks to see if the managedBy attribute of the computer object is populated.  If so, it adds that user as a local admin to their workstation/laptop and removes any other user/group not specified
    and given local admin rights.  This would only be done for a handful of users (those in the Local PC Admin group) that need admin access ; in other words, the attribute would only be populated for a few computer objects and not the entire organization.
     If it is not populated, it does nothing and leaves the default admins on it. 
    More info on how the GPO works here: http://fbinotto.blogspot.com/2014/01/making-user-object-set-in-managedby.html

  • AMT Computer Object Creation in Out of Band Management

    Just configured our Out of Band Management / AMT settings and we're getting all our AMT systems provisioned successfully. I've noticed that now, in SCCM 2012, the AMT object that gets created are Computer objects in AD. Their objectCategory is
    CN=Computer,CN=Schema,CN=Configuration,DC=mydomain,DC=com
    Back in the SCCM 2007 days, They were Person objects in AD. We still have some in AD.
    CN=Person,CN=Schema,CN=Configuration,DC=mydomain,DC=com
    Is this the default setting or do I have the option to change it?
    Orange County District Attorney

    Since no one has answer this post, I recommend opening  a support case with CSS as they can work with you to solve this problem.
    Garth Jones | My blogs: Enhansoft and
    Old Blog site | Twitter:
    @GarthMJ

  • Disabled domain controller computer object

    on one of our DC's DC01 (RID/PDC) the computer account was disabled this was showing as disabled on all DC's in the domain. I have managed to fix it by changing the
    User account control attribute on that object to 532480 in adsiedit on all DC's. I then had to reset the secure password for DC01 using netdom resetpwd as it had got out of sync. Everything now seems fine replication/authentication/DCdiag/netdiag
    Why did this occur ? it looks like you cant disable a Domain controller computer account from the GUI ? am i likely to get any further issues

    I have seen similar situations on the net but I have not found an explanation to this behavior (assuming here that this is a bug in the system). You can see references here:
    http://www.kenmanohar.com/blog/tag/domain-controller-computer-account-disabled/
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/9fb5084e-b27d-48c8-92e7-8818fc769a90/disabled-domain-controller-computer-account
    You might check if any of the administrators have mistakenly changed the value of UserAccountControl attribute. By using ADUC, you would not be able to disable the computer account of a DC.
    Please also enable the auditing in AD so that you can get more details about what happened in the future: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Pull owner from computer object and add to BUILTIN\Administrators via GPO

    Quick question here - is it possible to pull an owner from computer object in AD (left side of picture) and add him to BUILTIN\Administrators on this particular workstation along with 2 AD groups and 'LocalAdmin' user (right side of picture)? Im interested
    only in doing it via GPO.

    > Quick question here - is it possible to pull an owner from computer
    You mean "manager" and not "owner", right? The owner is defined in
    "security - advanced - owner" and is the account that initially created
    the object. Typically "Domain Admins"...
    > object in AD (left side of picture) and add him to
    > BUILTIN\Administrators on this particular workstation along with 2 AD
    > groups and 'LocalAdmin' user (right side of picture)? Im interested only
    > in doing it via GPO.
    Nothing as easy as that. You can use GPP local users and groups, and you
    can use Item Level Targeting with LDAP filters. Grab the managedBy
    attribute of the computer account, grab the samaccountname of the
    managedBy DN and you're almost done :)
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • Request for info regarding MAC address population in computer objects

     
    Hi,
    I am trying to determine how MAC address information is populated in computer objects. I had assumed initially that the hardware scan would be used, but observation shows this information
    to be obtained prior to any hardware inventory.
    I have laptops that are primarily connected via VPN, and before long their objects lose the internal network interface's MAC address. When I try to rebuild them, they fail to PXE boot. I have
    found that importing a CSV of host / MAC / SMBIOD GUID will update the object (rather than having to delete and recreate it) which works temporarily. The MAC will eventually disappear, and the device fail to PXE boot.
    I have thousands of these devices to manage, and it is already difficult enough having a CAS and two primaries (the windows Deployment Service on a DP only cares about devices in the DPs primary
    site, and so devices that move site are a real pain already, try finding that anywhere in the OSD reference documents!)
    I'm assuming now that this information is pulled from the actual client-server connection, and therefore is dynamic(ish), like IP information. If this is the case, more detail around that process,
    where to find evidence of  that process occurring would be very useful.

    The MAC is updated by hardware inventory and heartbeat discovery. 
    Torsten Meringer | http://www.mssccmfaq.de

  • Problem with Persistent Object as Reference Attribute of Persistent Object

    Hello All,
    I have a problem with a persistent class that contains a reference attribute to another persistent class.  I can write the reference object attribute to the DB but when I read the reference attribute back from the DB the object is null.  Allow me to explain...
    I have two tables; one is a data table with one key field of type OS_GUID, the second is a mapping table with several business key fields and two further fields; an instance GUID and a class identifier GUID.  The data table is used to contain all the data for an object.  The mapping table is used to hold a relationship between the GUID assigned in the data table and the business key.  The mapping table has been structured in this way by following the help here:
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/df/e785a9e87111d4b2eb0050dadfb92b/frameset.htm
    and the field mapping in persistent class for the mapping table has been mapped following the help here:
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/06/f23c33638d11d4966d00a0c94260a5/frameset.htm
    The code I use to create entries in the data and mapping table is:
    <-snip->
      DATA:
        gv_blank_data_guid TYPE REF TO zcl_ps_data,
        gv_data_guid       TYPE        os_guid,
        go_data_ps         TYPE REF TO zcl_ps_data,
        go_data_agent      TYPE REF TO zca_ps_data,
        go_data_map_ps     TYPE REF TO zcl_ps_data_map,
        go_data_map_agent  TYPE REF TO zca_ps_data_map,
        go_exc             TYPE REF TO cx_root.
      go_data_agent = zca_ps_data=>agent.
      go_data_map_agent = zca_ps_data_map=>agent.
      TRY.
    Check if there's already data with the business key on the DB
          go_data_map_ps = go_data_map_agent->get_persistent(
                             i_data_ref     = iv_data_ref
                             i_action       = iv_action ).
    ... if there is then exit.
          EXIT.
        CATCH cx_root INTO go_exc.
      ENDTRY.
      TRY.
    Create the data...
          go_data_ps = go_data_agent->create_persistent(
                           i_root_guid = gv_blank_data_guid
                           i_req_date  = iv_req_date ).
          TRY.
    ... finally, write the new data to the data business key map table
              go_data_map_ps = go_data_map_agent->create_persistent(
                                 i_data_ref     = iv_data_ref
                                 i_action       = iv_action
                                 i_data_guid    = go_data_ps ).    "note1
            CATCH cx_root INTO go_exc.
          ENDTRY.
        CATCH cx_os_object_not_found.
      ENDTRY.
      COMMIT WORK.
    <-snip->
    The fact that it is possible to pass the object GO_DATA_PS in the call to GO_DATA_MAP_AGENT (the line that I've put the comment "note1" on) indicates to me that the reference to the data persistent object can be written to the DB by the mapping persistent object.  After executing the above code the mapping table object and class identifier fields are populated.  Also, if multiple entries are written to the tables then the class identifier field in the mapping table is always the same and the object ID is different as expected.
    However, the problem I have is if I read an object from the DB using the business key with the following code:
    <-snip->
      DATA:
        gv_req_date        type        datum,
        gv_data_guid       TYPE        os_guid,
        go_data_ps         TYPE REF TO zcl_ps_data,
        go_data_agent      TYPE REF TO zca_ps_data,
        go_data_map_ps     TYPE REF TO zcl_ps_data_map,
        go_data_map_agent  TYPE REF TO zca_ps_data_map,
        go_exc             TYPE REF TO cx_root.
      go_data_agent = zca_ps_data=>agent.
      go_data_map_agent = zca_ps_data_map=>agent.
      TRY.
    Read data mapping with the business key
          go_data_map_ps = go_data_map_agent->get_persistent(
                             i_data_ref     = iv_data_ref
                             i_action       = iv_action ).
    ... then read the data.
          TRY.
              CALL METHOD go_data_map_ps->get_data_guid
                RECEIVING
                  result = go_data_ps.
            CATCH cx_os_object_not_found.
          ENDTRY.
        CATCH cx_root INTO go_exc.
      ENDTRY.
    <-snip->
    At no point during this code are the attributes of the object of the persistent class for the data table populated with the contents of the fields of the data table referenced as the attribute of the mapping table.  To clarify, when viewing the object in the debugger all the attributes of the mapping object that are simple table fields are populated with the values of the fields of in the mapping table, however, the attributes of the object that represents the persistent class for the data table are not populated with the fields of the data table.  I had hoped that by reading the mapping table object the data object would automatically be populated.  Is there another step I need to perform to populate the data object?
    I'm sorry if the above is hard to follow.  Without being able to provide screenshots it's difficult to explain.
    If someone has managed to store references to persistent objects in a table and then read the references back could you list the steps you went through to create the persistent classes and include the code that reads the objects please?  The code I have almost works, I must be just missing some subtle point...
    Thanks in advance,
    Steve.

    Hi Andrea,
    The iObject being replicated at item level for Service Complaints is the SAP standard behaviour.
    Generally we raise complaint refering to some sales or service issues. In your scenario you are trying to create a complaint based on an iObject, then you have to mention the corresponding product details. I dont see any business requirement not to copy the iObject product at the item level.
    If you want it then I think only you have to write a Z program for it.
    Hope this helps!
    Regards,
    Chethan

  • Health rollup to computer object from Microsoft.Windows.ApplicationComponent

    Hi All.
    Trying to author a Management Pack in Authoring Console 2007 R2. And can't get rollup to work as I want.
    Here's the long story.
    I've created:
    A discovery MP witch holds:
    - an abstract class inherited from Microsoft.Windows.Computer, named: "AppX.Cmp.Role"
    - a (seed?) class inherited from the above, named: "AppX.Cmp.Role.Server"
    - a class inherited from "AppX.Cmp.Role.Server" named "App.Cmp.Role.Server.Replicator"
    - a class inherited from "Microsoft.Windows.ApplicationComponent" named: "AppX.Cmp.Role.Server.Replicator.Loginstance"
    - a class of type "Microsoft.SystemCenter.InstanceGroup" named: "AppX.Group"
    - a relationship (system.hosting) where source class is "AppX.Cmp.Role.Server.Replicator" and target class is "AppX.Cmp.Role.Server.Replicator.Loginstance"
    - a registrydiscovery to discover "AppX.Cmp.Role.Server" targeted at "Windows.Operating.System"
    - a scriptdiscovery to discover "AppX.Cmp.Role.Server.Replicator" targeted at "AppX.Cmp.Role.Server"
    - a scriptdiscovery to discover "AppX.Cmp.Role.Server.Replicator.Loginstance" targeted at "AppX.Cmp.Role.Server.Replicator"
    - a groupdiscovery ("Microsoft.SystemCenter.GroupPopulator") target: "AppX.Group" (Microsoft.Windows.Computer)
    - a dependencymonitor targeted at "AppX.Cmp.Role.Server.Replicator" and monitor dependency set to "AppX.Cmp.Role.Server.Replicator.Loginstance", HealthRollup set to "worst state".
    A monitoring MP (depending on the discovery MP) witch holds:
    - a processmonitor targeted to "AppX.Cmp.Role.Server.Replicator" and "replicator.exe"
    - a logfilemonitor targeted to "AppX.Cmp.Role.Server.Replicator.Loginstance"
    - a stateview targeted to "AppX.Group"
    When I kill the "replicator.exe" process the object goes to unhealthy all the way up to "Windows.Computer". But when the logfilemonitor triggers and turns into "unhealthy state" the object in the above view turns RED but not the
    "Windows.Computer" object (looking at the default view "Windows Computers").
    Is it possible to get the "Windows.Computer" object to reflect the "AppX.Cmp.Role.Server.Replicator.Loginstance" state?
    How?

    Sorry about that - its been a long weekend.
    I was quoting from the following;
    "Use the Microsoft.Windows.LocalApplication as
    a base class when your class type represents a local application that shares the resources of the hosting Windows computer with other applications. Unlike theMicrosoft.Windows.ComputerRole class,
    the Microsoft.Windows.LocalApplication class
    type does not automatically roll its health up to the hosting computer."
    http://msdn.microsoft.com/en-us/library/ee533867.aspx
    Would you be able to upload the results if you run the Visio MP diagram generator and possibly the health explorer views and this will help me see how it hangs togther?

  • Powershell Get-ADUser returns Computer objects as well ???! How to prevent.

    I ran the following script and got a bunch of computer objects in my csv. How to i Prevent this? I already tried using 
    Where-Object{$_.type
    -eq
    "user"} OR
     -filter{type
    -eq
    "user"}
    script:
    Get-ADUser-Filter*-PropertiessamAccountName,accountExpires,Created,LastLogonTimeStamp,Department,physicalDeliveryOfficeName,employeeID,AccountExpirationDate,Manager|
    Where-Object
    {$_.accountexpirationdate
    -lt$timex}
    |
    select
    Name,samAccountName,@{Name="Timestamp";
    Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{n='Date
    Created';e={$_.created}},Department,@{n='Location';e={$_.physicalDeliveryOfficeName}},employeeID,AccountExpirationDate,@{Label='Manager
    sAMAccountName';Expression={(Get-ADUser$_.Manager).sAMAccountName}},@{Label='Manager
    Name';Expression={(Get-ADUser$_.Manager).name}}
    |
    export-csv
    -path$mypath-notypeinformation

    Someone told me the Computer accounts are generic accounts...makes any sense?
    No.
    EDIT: What's the output of this command for one of these computer accounts:
    Get-ADUser ThatComputerAccount | Select *
    Don't retire TechNet! -
    (Don't give up yet - 13,225+ strong and growing)

  • Trying to update hidden attibute in AD computer objects.

    I am trying to update my AD computers using PowerShell to read the items from a CSV file. I have successfully updated the Description and other standard items, but I cannot get the non-common
    hidden attributes to updated. I am very green on PowerShell. I'm not even sure I'm using the correct commands.
    The contents of the CSV file looks like as below:
    Name = preexisting Computer object name
    Description = Information I want to place in the description field (Non-hidden \ standard)
    comment = Information I want to place in the comments field (Hidden field)
    name,description,comment
    Computer1,Computer Model - 123456789 - Office 1111,Comment1
    Computer2,Computer Model - 234567891 - Office 1112,Comment2
    Computer2,Computer Model - 345678912 - Office 1113,Comment3
    Below is the script:
    # Update Computer Description and Comments
    Import-module ActiveDirectory  
    Import-CSV "C:\temp\Computers.csv" | % {
    $Computer = $_.name 
    $Description = $_.description 
    $Comment = $_.comment
    Set-ADComputer $Computer  -description $Description
    Set-ADComputer $Computer  -comment $Comment

    To set comments on non-standard items you need to do something like this:
    Set-ADComputer Computername -replace @{Comment="Test1"}
    [email protected]
    Thank you Richard.  The information worked well.  I modified it slightly to retrieve the information from the CSV file as seen below:
    Set-ADComputer $Computer -replace @{Comment=$Comment}

  • How to configure discover to import workstation computer object only?

    Is there a way to discover workstation computer objects only (exclude server objects)?
    Jason

    If Servers are discovered that doesn't mean that they are managed.
    No, discovery is just that, simple knowledge that the resource exists and has no other specific implications.
    Another option here in 2012 is to use group discovery. You can place all of your workstations in a AD single security group and then include this group in your security group discovery. This does sacrifice some of the functionality offered by system discovery,
    but it will work.
    I also concur with John, having servers and workstations in the same OU within AD is pretty poor design.
    Jason | http://blog.configmgrftw.com
    Read my sentence again Jason :)
    I'm saying that even if they are discovered it doesn't mean that they are managed.
    there is implication. the desktop management team is outsourced and not suppose to know server name and IPs.
    Jason

  • Delete Computer object VS Disjoin

    Quick question on AD administration to help resolve an internal debate:
    We're running AD on Windows Server 2008 R2.  One admin states that "deleting doesn't remove all AD objects", and that you need to run a disjoin on the machine first to properly remove the Computer Object.  Can anyone confirm this? 
    Which is the correct way to remove objects in AD?
    It's my understanding that no matter what, you'll end up running a delete command, which marks the object as deleted; this gets replicated to all other DC's, and whenever the tombstone lifetime expires, then a cleanup process will finally and forever remove
    the tombstone objects.  If you don't run a "disjoin" command first, will there be any other lingering objects that need special care and consideration??
    Any info is appreciated.  Thanks much.

    Hi - This is _how_ it works:
    A domain unjoin comes down to the NetUnJoinDomain() API call documented at:
    http://msdn.microsoft.com/en-us/library/windows/desktop/aa370644(v=vs.85).aspx
    There is two scenarios that can happen, either the account get's disabled (by default) if you unjoin using the UI, or it's not disabled leaving out the misnamed flag 'NETSETUP_ACCT_DELETE' that actually means disable and not delete.
    The computer account is only disabled regardless of the flag if the user that performs the unjoin has the rights to disable the computer account in AD, e.g write to the userAccountControl attribute.
    The computer account (object) in AD is never deleted from AD during a unjoin.
    How ever the importance of clean up here is that the computer accounts password is cleared from the LSA during a unjoin, so it can't be used to authenticate against AD in case that the computer account is NOT being disabled for one of the reasons mentioned
    above.
    Deleting the computer object from AD is like deleting any other object in AD, it stays for the TSL until it's ultimately removed from the database.
    Enfo Zipper
    Christoffer Andersson – Principal Advisor
    http://blogs.chrisse.se - Directory Services Blog

Maybe you are looking for