More Training Questions: Connect to different domain

At a recent internal PowerShell training session, I was asked how to connect to a different domain. Following are a couple ways to accomplish this (using Quest cmdlets or the ActiveDirectory Module):

# Quest cmdlets
Add-PSSnapin Quest.ActiveRoles.ADManagement
$cred = Get-Credential 'ExtDomain.Local\FatBeard'
Connect-QADService -Service ExtDomain.Local -Cred $cred

Get-QADUser

# Active Directory Module
Import-Module ActiveDirectory
New-PSDrive –Name ExtDomain
–PSProvider ActiveDirectory
–Server ExtDomain.Local
–credential (Get-Credential ‘ExtDomain.Local\FatBeard’)
–root ‘//RootDSE/’

Get-ADUser -filter *

Enjoy!

PowerShell ActiveDirectory Module vs Quest.ActiveRoles.ADManagement Snapin

I have used the Quest.ActiveRoles.ADManagement snapin for a few years and have enjoyed their ease of use. Now that we have migrated our domain controllers to 2008 R2, I often use the ActiveDirectory Module. In fact, I end up using both and see no reason to pick one over the other.

Being of curious nature, I wanted to compare the time it took for a standard query to run using both approaches. Following is a comparison of:

• Quest.ActiveRoles.ADManagement snapin with Where-Object
• Quest.ActiveRoles.ADManagement snapin with LDAP Filter
• ActiveDirectory Module with Filter parameter
• ActiveDirectory Module with LDAP Filter

The query is looking for "stale" servers and runs 10 times for each one and averages the result.

# Add required snapin and module    
Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue    
Import-Module ActiveDirectory -ErrorAction SilentlyContinue    

$d = ((Get-Date).AddDays(-90)).ToFileTime()    
$LDAP = "(&(OperatingSystem=*Server*)(pwdLastSet<=$d)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"    
$server = "DC-P01"    

# Quest.ActiveRoles.ADManagement with Where-Object    
$QAD_Where = (1..10 | foreach {    
(Measure-Command -Expression {     
Get-QADComputer -Service DC-P01 -OSName '*Server*' -PasswordNotChangedFor 90 `
        | Where-Object {-not $_.AccountIsDisabled}}).TotalSeconds     
} | Measure-Object -Average    
).Average    

# Quest.ActiveRoles.ADManagement with LDAP filter    
$QAD_LDAP = (1..10 | foreach {    
(Measure-Command -Expression {     
Get-QADComputer -Service $server -LDAPFilter $LDAP }).TotalSeconds    
} | Measure-Object -Average    
).Average    

# Active Directory Module with Filter parameter    
$AD_Filter = (1..10 | foreach {    
(Measure-Command -Expression {    
Get-ADComputer -Server $server -Filter { (OperatingSystem -like "*Server*") -AND     
(PasswordLastSet -le $d) -AND (Enabled -eq $True)}}).TotalSeconds    
} | Measure-Object -Average    
).Average    

# Active Directory Module with LDAP Filter    
$AD_LDAP = (1..10 | foreach {    
(Measure-Command -Expression {    
Get-ADComputer -Server $server -LDAPFilter $LDAP}).TotalSeconds    
} | Measure-Object -Average    
).Average            

"Quest.ActiveRoles.ADManagement with Where-Object took {0:N2} seconds." -f $QAD_Where    
"Quest.ActiveRoles.ADManagement with LDAPFilter took {0:N2} seconds."   -f $QAD_LDAP    
"Active Directory Module with filter took {0:N2} seconds."              -f $AD_Filter    
"Active Directory Module with LDAPFilter took {0:N2} seconds."          -f $AD_LDAP

The results (for the most part) are not surprising.
Quest.ActiveRoles.ADManagement with Where-Object took 4.97 seconds.
Quest.ActiveRoles.ADManagement with LDAPFilter took 4.19 seconds.
Active Directory Module with filter took 3.20 seconds.
Active Directory Module with LDAPFilter took 3.21 seconds.

At some point, I need to run this again with a long running query.

Is this consistent with your results?

Enjoy!

Setting user LogonWorkstations and LogonHours in Active Directory

​If you find the need to add restrictions to a user in Active Directory, specifically LogonWorkstations and logonHours then the following script will serve as a template.

A few notes:
- We are using the ActiveDirectory module
- We are using a set list of workstations
- We are using a template approach for the logon hours

Import-Module ActiveDirectory -ErrorAction SilentlyContinue  



# Define the list of workstations we want to allow access   

$WorkStations = "Workstation1,Workstation2,Workstation3"  

$WorkStations+= "Workstation4,Workstation5,Workstation6"  

$WorkStations+= "Workstation7,Workstation8,Workstation9"  



# Create the logonHours array  

[array]$logonHours = (Get-ADUser test010 -Properties logonHours).logonHours  



# Iterate over users and assign accordingly  

foreach ($user in Get-Content C:\temp\users.txt) {  

Get-ADUser -Identity $user | `

    Set-ADUser -LogonWorkstations $Workstations -Add @{logonhours=$logonHours}   

}

Checking our results shows that the logonHours were set exactly to what our template was.

Enjoy!