In the past, whenever you needed to reset the machine (computer) account password for a computer joined to an Active Directory domain, you could use netdom.exe to perform the task. While this no longer exists in Windows 10, you can also perform the task through Powershell:

Reset-ComputerMachinePassword -Server dc.domain.local -Credential (Get-Credential)

Replace dc.domain.local with the FQDN of a domain controller, or simply type the domain name (domain.local) to automatically select a domain controller. When running the cmdlet, you will also be prompted to enter the credentials of an account which is delegated to reset the computer account password of this particular machine.

read more

Using Powershell, you can quickly verify the status of the replication between domain controllers in Active Directory. This can be used in monitoring to verify a healthy AD replication. This can be run on any domain controller or on another system with RSAT or ActiveDirectory Powershell module.

Get-ADReplicationPartnerMetadata -Target "$env:USERDNSDOMAIN" -Scope Domain | FT -Auto Server,LastReplication*

To see forest-wide replication, replace -Scope Domain with -Scope Forest.

read more

read more

Ned Pyle from Microsoft TechNet wrote an article about DCDiag, explaining in detail what it actually does.

Read full article on TechNet.

Using ADUC, it can be quite a hassle to find and/or unlock AD accounts. Powershell solves this by providing some neat commands for a system administrator to use.

To list all locked out AD accounts:

Search-ADAccount -LockedOut

To get more info about these accounts, you can do a Full-List:

Search-ADAccount -LockedOut | FL

Furthermore, you can pipe the output to quickly unlock some/all AD accounts:

Search-ADAccount -LockedOut | Unlock-ADAccount

read more

Sometimes you may want to set or clear attributes of an AD object (e.g. the extensionAttributes of an AD user) through Powershell.

To set an attribute:

Set-ADUser -Identity "AnyADUser" -Add @{extensionAttribute15="SomeValue"}

To clear an attribute (i.e. unset the attribute):

Set-ADUser -Identity "AnyADUser" -Clear extensionAttribute15

read more

You can mail-enable multiple accounts with a single Powershell command. Look below for some examples:

Mail-enable AD accounts whose first name is John:

Get-ADUser -Filter * | Where {$_.GivenName -like "John"} | ForEach-Object { Enable-Mailbox -Identity $_.DistinguishedName }

Mail-enable all accounts in an OU called Engineering:

Get-ADUser -Filter * -SearchBase "OU=Engineering,DC=contoso,DC=local" | ForEach-Object { Enable-Mailbox -Identity $_.DistinguishedName }

Based on recommendations and best practices from Microsoft, and information I found here, I compiled a FSMO placement scenario for 2 domain controllers:

Also, if your domain is top-level in the AD forest, configure DC1 to sync with external time sources.

read more

read more

Microsoft has released the Azure Active Directory Connect to the general public. Azure AD Connect replaces (although "incorporates" is a better word) DirSync as the new tool to set up synchronization between your on-premise Active Directory and Azure Active Directory, including Office 365.

The current version of Azure AD Connect is only the beginning. Microsoft has announced a lot more features, which will be made available in the next versions.

More information and installation resources: https://azure.microsoft.com/nl-nl/documentation/articles/active-directory-aadconnect/

read more

Active Directory (AD) integrated DNS zones are not replicated by the DNS server, but replicates through the Active Directory replication mechanism, and uses the same settings for AD replication.

You can trigger replication through Active Directory Sites and Services, or with repadmin.exe on command prompt:

repadmin.exe /replicate target_dc source_dc DC=DomainDnsZones,DC=domain,DC=com

Replace parameters accordingly:

• target_dc is the DC to replicate to
• source_dc is the DC to replicate from
• Edit the naming context so it includes your FQDN: e.g. contoso.co.uk → DC=contoso,DC=co,DC=uk

read more

read more

When demoting a 2003 domain controller using dcpromo, you may run into the following error:

Error

The operation failed because:

Failed to configure the service NETLOGON as requested

"The wait operation timed out"

The error message is quite misleading as the real cause has got nothing to do with NETLOGON, but is in fact a DNS issue. You will most likely have the server's primary DNS pointing to itself using loopback address (127.0.0.1) or its own IP address.

You can correct the issue by having the DNS point to remaining domain controllers, and remove any DNS pointing to itself (i.e. loopback address or any other IP owned by the server being demoted).