PowerShell for Windows Admins

November 6, 2013  1:11 PM

Get-ADUser issue

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

By default Get-ADUser returns a limited number of properties. If you wanted to see all properties on a user account you would do this

Get-Aduser –Identity richard –Properties *

This option appears to be broken in Windows 2012 R2 / PowerShell 4

PS C:\Windows\system32> Get-ADUser -Identity richard -Properties *

Get-ADUser : One or more properties are invalid.
Parameter name: msDS-AssignedAuthNPolicy
At line:1 char:1
+ Get-ADUser -Identity richard -Properties *
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (richard:ADUser) [Get-ADUser], ArgumentException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Commands.GetADUser

You can work round the problem like this:

Get-ADUser -Identity richard| Get-ADObject -Properties *

November 6, 2013  12:52 PM

Active Directory Lunches MEAPs chapter 21

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Manning have released an update MEAP for Active Directory Management in a Month of Lunches. This one adds chapter 21 and appendix B.

Almost done now. Enjoy

November 4, 2013  3:05 PM

Managed by for groups

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Many Active Directory objects have a ManagedBy attribute that shows the business owner of the group. Setting this doesn’t confer rights to manage the object. However in AD users and computers if you look at the Managed by tab for a group you will see a check box with the label “Manager can update membership list”

This doesn’t set an attribute – it sets permissions on the group members property. The Microsoft cmdlets don’t handle AD permissions – a major omission in my mind – but if you have a copy of the Quest cmdlets handy you can do this

$user = Get-QADUser -Identity dgreen

$group = Get-QADGroup -Identity Accounts -IncludeAllProperties
$group | Set-QADGroup -ManagedBy $user

$group | Add-QADPermission -Property Member -Account $user -ApplyTo ThisObjectOnly -Rights WriteProperty

Get the user and group objects. Set the managedBy property using Set-QADGroup. There is a switch to enable the manager update the membership list but you need Active Roles running to use it.

Instead use Add-QADPermission and define the property, the account to be granted the permissions, limit inheritance and state the permission being granted.

You can never have to many cmdlets even if you don’t use them that often.

November 4, 2013  3:43 AM

Scripting Guy–capacity planning

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

First post in a short series on capacity planning now available on the Scripting Guy blog


November 2, 2013  2:50 PM

Useful PowerShell resources

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Want to know more about using PowerShell in these contexts:

File system
Arrays and Hash tables
Date, Time & Culture
Objects & Types
Regular Expressions
Then head over to http://powershell.com/cs/media/28/default.aspx

and look at the PowerTips Monthly volumes


October 31, 2013  2:58 PM

A thought for Halloween

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Just a quick thought

31 OCT = 25 DEC


October 31, 2013  11:58 AM

Book offers from Manning

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

those really nice people at www.manning.com have some real bargains this weekend:

Thursday October 31–Half off all MEAPs

Friday November 1–Half off all pBooks

Saturday November 2–Half off all eBooks

Sunday November 3–Half off any purchase


October 30, 2013  3:05 PM

Using WQL in PowerShell

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

WMI Query Language – WQL – is used to either form a query directly or indirectly in the –Filter parameter of Get-WmiObject and Get-CimInstance.

$query = “SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3”
Get-CimInstance -Query $query

OR using the –Filter parameter

Get-CimInstance -ClassName Win32_LogicalDisk -Filter “DriveType = 3”

WQL is a limited subset of SQL.

If you want to find out more there is a help file available in PowerShell 3.0 and above

get-help about_WQL -ShowWindow

October 30, 2013  2:35 AM

SCCM 2012 lunches deal of the day

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Manning’s deal of the day is Learn SCCM 2012 in a Month of Lunches – get 50% off – today only at www.manning.com

October 29, 2013  4:44 PM

where syntax

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

This type of construction has been part of PowerShell since the very beginning:

Get-Process | where {$_.Handles -gt 500}

Get some data and use where-object to filter the data based on the value of some property. $_ represents the object on the pipeline.

PowerShell 3.0 introduced a simpler syntax

Get-Process | where Handles -gt 500

which is shorthand for

Get-Process | where -Property Handles -gt -Value 500

At which point it becomes obvious what is happening – you are comparing a property against a value. There are a whole set of comparison operators you can use in this manner – see the help file for details.

This new syntax makes life much easier when you only have a single comparison to perform – you need to use the old style syntax if you need to test on two properties.

The problem is that I don’t see this syntax being used that much. If you are using PowerShell 3.0 or above I recommend changing to the new style syntax. It does save typing.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: