To move windows group to other domain download ADMT Tool Install Active Directory Migration Tool Open the ADMT MMC snap-in it is located in Administrative Tools. Chose source and destination domains and click Next. On the Group Selection screen, chose the group that you want to migrate and click Next. On the next screen, select Browse and locate the desired OU. On the Group Options screen, select one or more of the following and click Next: Update user rights: Copies any user rights that Read more

Creating a Group Using a graphical user interface Open the Active Directory Users and Computers . In the left pane, browse to the parent container of the new group, right-click on it, and select New Group. Enter the name of the group and select the group type (global, domain local, or universal) and group type (security or distribution). Click OK. Using dsadd in command-line interface dsadd group "<GroupDN>" -scope <GroupScope> -secgrp yes|no -desc "<GroupDesc>" Where <GroupDN> Read more

PowerShell script to find all Active Directory admins in domain

Get-QADUser -ldapFilter ‘(SamAccountName=*.admin)’|export-csv filename.csv

Use this script to check user group membership in Windows Domain Active Directory $root=([adsi]"").distinguishedName $ou=[adsi]("LDAP://ou=x,ou=y,ou=z,"+$root) # fill  with user  CN “Common Name” $user=$ou.psbase.children.find("cn=tartetCN ") $groups = $user.memberof foreach($group in $groups) { $strGroup = $group.split(',')[0] $strGroup = $strGroup.split('=')[1] $strGroup } Read more

Things to consider before migration to new hardware Are you going to keep same DC host name ? Are you going to use same IP address? If you are changing your name and IP if it will have influence on your network ( Firewall Roles etc..) Is the server DHCP server Is the server root CA? - I'm not sure if you can migrate Enterprise Root CA - May be Restore from Backup Is the server Global Catalog ? Preparation steps Make full Backup of your Active Directory Install new server and join it to Read more

The script bellow allows you to locate users with invalid logon attempts $strFilter = "(&(objectCategory=User)(badPwdCount>=0))" $objDomain = New-Object System.DirectoryServices.DirectoryEntry $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objSearcher.SearchRoot = $objDomain $objSearcher.PageSize = 1000 $objSearcher.Filter = $strFilter $colProplist = "name" foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} $colResults = $objSearcher.FindAll() foreach Read more

In windows 2003 and later you can use AD saved queries , but for windows 2000 domain the only way is by using CSVDE/LDIFDE The following command should do the work :You will receive file output csvde -f outputfilename.csv -d "dc=domain,dc=com" -r "(&(mailnickname=*)(proxyAddresses=smtp:email@yourdomain.com))" -l name Change  "dc=domain,dc=com" to  your AD domain name and suffix, and email@yourdomain.com with the email address you're looking for. To find all recipients who have an email address Read more

In Windows 2008 Active Directory Users and Computers Microsoft activated new feature "Protect Container from accidential deletion" During OU creation you have the ability to mark OU as protected from accidental deletion , and if you try to delete OU you will receive the following error "You do not have sufficient privileges to delete "OU Name" , or this object is protected from accidential deletion" To unlock OU from accidential deleting protection do the following actions Open Active Directory Read more

Recently I installed 2 2008 terminal servers , and when I started configuring them I realized that I can't use lot of new features that are available only via 2008 Group Policy . The network was 2003 , and adding or upgrading current DC to 2008 domain controller rises project costs ( 2008 CAL's for entire domain ) I had to look for other solution . Since windows 2008 GPO templates changed their format from ADM to ADMX I couldn't import windows 2008 templates to windows 2003 DC. So here how you Read more

BASIC 01 What is Exchange 2003 Forestprep? Exchange 2003 Forestprep extends the AD schema to include Exchange specific information. 02 What is Exchange 2003 Domainprep? Exchange 2003 Domainprep creates the groups and permissions necessary for Exchange servers to read and modify user attributes. 03 What is a DC? A DC is a Windows 2000 or 2003 Domain Controller that holds active directory partitions for a domain (used for things like user authentication). 04 What is a GC? A GC is a Global Read more