Macetes TI

Entire OU set password never expires

dsquery user “OU={your target OU},DC={your domain},DC={your domain extension}” | dsmod user -pwdneverexpires yes

Update: Note: If your OU has more than 100 users in it you need to add the ‘-limit’ flag, and set it to a number greater than your actual amount of users, e.g.

dsquery user “OU={your target OU},DC={your domain},DC={your domain extension}” -limit 2000 | dsmod user -pwdneverexpires yes

Finding Stale User and Computer Accounts

Find Users Who Have Never Logged On

Use the following PowerShell Command;

Get-ADUser -Filter { LastLogonDate -notlike "*" -and Enabled -eq $true } -Properties LastLogonDate | Select-Object @{ Name="Username"; Expression={$_.SamAccountName} }, Name, LastLogonDate, DistinguishedName | Export-Csv C:\temp\Users-Never-Logged-On.csv

Note: This will output the users to a csv file, and requires you to have a C:\Temp directory.

Find Users Who Have Not Logged On In ‘x‘ Days

I’m going to use the value of 90 days (remember some staff might be on long term sick/maternity so check with HR!) Execute the following three commands;

$DaysInactive = 90
$TrueInactiveDate = (Get-Date).Adddays(-($DaysInactive))
Get-ADUser -Filter { LastLogonDate -lt $TrueInactiveDate -and Enabled -eq $true } -Properties LastLogonDate | Select-Object @{ Name="Username"; Expression={$_.SamAccountName} }, Name, LastLogonDate, DistinguishedName | Export-Csv C:\temp\Users-Inactive-90-days.csv

Note: This will output the users to a csv file, and requires you to have a C:\Temp directory.

Find Computers Who Have Not Logged On In ‘x‘ Days

Again I’m using 90 days.

$DaysInactive = 90
$TrueInactiveDate = (Get-Date).Adddays(-($DaysInactive))
Get-ADComputer -Filter { PasswordLastSet -lt $TrueInactiveDate} -properties PasswordLastSet | Select-Object Name, PasswordLastSet, DistinguishedName | Export-Csv C:\temp\Computers-Inactive-90-days.csv

Note: This will output the users to a csv file, and requires you to have a C:\Temp directory.

Add All Members of an OU to a Security Group

Get-ADUser -SearchBase ‘OU=Source-OU,OU=PNL,DC=pnl,DC=com’ -Filter * |

ForEach-Object {Add-ADGroupMember -Identity ‘SG-Test-Group’ -Members $_ }

Getting Object Numbers From Active Directory

Users:
(Get-ADUser -Filter *).Count

Computers:
(Get-ADComputer -Filter *).Count

Groups:
(Get-ADGroup -Filter *).Count

Enabled or disabled users:
(Get-AdUser -filter 'Enabled -eq $true').count
(Get-AdUser -filter 'Enabled -eq $false').count

Group users:
(Get-ADGroup GS-VPN-Users -Properties *).Member.Count

OU users:
(Get-ADUser -Filter * -SearchBase "OU=Users, OU=PNL,DC=pnl,DC=com").Count

Network masks

Run local script on remote host via SSH

ssh root@<remoteServer> "bash -s" < /opt/script.sh

Run in multiple hosts:

for i in `cat hosts.txt` ; do echo $i && ssh root@$i "bash -s" < script.sh ; done

Source: https://unix.stackexchange.com/questions/87405/how-can-i-execute-local-script-on-remote-machine-and-include-arguments

Get remote logged user

wmic /node:(hostname ou IP) computersystem get username

C:\Users\douglastos>wmic /node:desk0191 computersystem get username
UserName
grupo\userteste