Powershell Megathread: Verb-Noun Scripting is the future

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Powershell Megathread: Verb-Noun Scripting is the future

Drumstick: Jun 20, 2006; Lord of cacti

So... what am I doing wrong here? Im trying to create users from a csv. Im not getting any errors, but im not getting any users either.

$user = Import-Csv "csvlocation"
$container = [ADSI] "LDAP://OU=ADUSERTEST,DC=XYZ,DC=LOCAL"

$user | foreach {
$description = $user.description
$userPrincipalname = $user.userPrincipalname
$displayName = $user.displayname
$givenName = $user.givenName
$sn = $user.sn
$password = $user.password
$homeDirectory = $user.homeDirectory
$homedrive = $user.homeDrive

}

# ¿ Aug 26, 2011 21:19

Adbot: ADBOT LOVES YOU

# ¿ Apr 30, 2024 13:17

Drumstick: Jun 20, 2006; Lord of cacti

Ah, thanks. I was afraid that all I was doing was creating variables, but so far, I just kinda fumble around until I get fed up and ask on here. Thank you for the help.

# ¿ Aug 29, 2011 12:53

Drumstick: Jun 20, 2006; Lord of cacti

Is it possible to check folder permissions and then print the folder names if the permissions includes a specific user/group using powershell?

# ¿ Oct 27, 2011 21:12

Drumstick: Jun 20, 2006; Lord of cacti

I am trying to identify and move disabled accounts within in AD. I am able to ID the account that are disabled but I am having problems getting the user account to move. The error that is appearing is in the $from.PSBase.Moveto. What am I missing?

Here is what I currently have

code:

$filter = "(&(objectClass=user)(objectCategory=person))"
$user = [adsi] "LDAP:// OU=xxx,DC=xxx,DC=xxx"

Foreach ($suser in $user.psbase.Children)
{
$user = [adsi]"LDAP://$($user.properties.item(""distinguishedname""))"
$uac=$user.psbase.invokeget ("useraccountcontrol")

if($uac -band 0x2){
 $from = [adsi] "LDAP://<currentlocation>"
 $NewOU = [adsi] "LDAP:// <Newlocation>"
$from.PSBase.MoveTo($NewOU)
}
}

# ¿ Dec 7, 2011 21:34

Drumstick: Jun 20, 2006; Lord of cacti

adaz posted:

Your MoveTo syntax is a bit off, for reference: http://msdn.microsoft.com/en-us/library/w8stwdkc.aspx

Code wise it looks like so:
code:
$user.PSBase.MoveTo($NewOU,"cn=$($user.name)")

Bah, So close yet so far. That you so much. Made that change this morning and it ran exactly how I expected.

# ¿ Dec 8, 2011 13:57

Drumstick: Jun 20, 2006; Lord of cacti

Ive run into a small issue. I had to restore network drives from a backup, but ownership and security permissions are not restored. So, now im stuck with 1200 folders that have incorrect ownership and will not be mapped when a user logs in until they have ownership of that folder.
I want to make sure what im thinking makes sense and check to see if there is possibly an easier way to do this.

The folders are their user names. Could I create an array of the names, then use that to assign ownership of the proper folder? Or can I do a for each, read the name then assign that ownership without the array? I'm way to inexperienced at this.

# ¿ May 2, 2012 15:04

Drumstick: Jun 20, 2006; Lord of cacti

Fantastic, thank you so much. Im glad i'm at least on the right track. I didnt even consider the possibility of locking myself... Im glad I didnt just wing it.

# ¿ May 2, 2012 15:11

Drumstick: Jun 20, 2006; Lord of cacti

It works! Thank you so much!

I was wrong. It mostly works. I tired running it on multiple folders and its assigning multiple people to it instead of just the one the folder is named after, and folders/files inside are not inheriting. It looks like some other people in the thread recently had the same issue

Drumstick fucked around with this message at 16:39 on May 2, 2012

# ¿ May 2, 2012 16:07

Drumstick: Jun 20, 2006; Lord of cacti

Fantastic! Thank you everyone for the help. I really appreciate it, and I know my users will too. This is new territory for me and Ive always received great help and advice from these forums.

# ¿ May 2, 2012 18:50

Drumstick: Jun 20, 2006; Lord of cacti

Google has failed me. Im trying to add existing users to a security group. However all my googling has turned up is adding members through csv. Set-adgroup seems to do everything but add members.

Im tried add-adprincipalgroupmembership but its requesting an identity. Here is what I have

$ou = [adsi] "Ldap://<path>"
foreach ($user in $ou) {
add-adprincipalgroupmembership -MemberOf "cn=group,dc=domain,dc=local"
}

When run it prompts for an identity. So I stuck in a -identity $user after the cmdlt. Then I get an error saying Cannot bind paramater Identity. cannot convert system.directoryservices.directoryentry value of type system.directoryservices.directoryentry to type Microsoft.ActiveDirectory.management.adprincipalgroupmembership.

Im sure im missing something glaringly obvious.

# ¿ Aug 8, 2012 14:44

Drumstick: Jun 20, 2006; Lord of cacti

Ah, thank you so much.

"That is way more elegant than what I was going to suggest. I was going to suggest getting a list of all users by doing a get-aduser and pulling their sAMAccountName then pumping that into the foreach statement."

This was one thing I had considered, but it seemed like so much more effort then what was needed.

Im not as familiar with using powershell in that way kampy. It seems like every so often a problem comes up and I know powershell is capable of handling it in a much easier fashion. I have a hard time distinguishing when to use that form(?) over the one I posted.

# ¿ Aug 8, 2012 18:29

Drumstick: Jun 20, 2006; Lord of cacti

I need a way to change the dial-in settings for users in AD to Control Access Through NPS Network Policy. So far my searching has only turned up ways to set it to Allow or Deny. Does anyone have any suggestions on how to set this? Some users are set correctly, however I have 12,000 students/staff accounts that need to be set so they authenticate on our radius server.

# ¿ Apr 16, 2013 12:27

Drumstick: Jun 20, 2006; Lord of cacti

The Gripper posted:

I believe you can just do netsh set user name=adusername dialin=policy, which should use remote access policies to determine access (which in this case should match the Control access through NPS Network Policy setting).

I tried this and it kept returning an error, command not found.
I did find set-aduser <name> -replace @{msnpallowdialin=$true/$false} but to allow by policy it needs to be set as empty which to be honest, I have no idea how to do.

Edit: Found a tool to do it. http://admodify.codeplex.com/ doesnt help me learn anything more about powershell, but it sure does get the job done.

Drumstick fucked around with this message at 13:34 on Apr 16, 2013

# ¿ Apr 16, 2013 13:30

Drumstick: Jun 20, 2006; Lord of cacti

The Gripper posted:

Hm, that is pretty annoying. You could try setting msnpallowdialin=$null and see if that counts as the default value, since MSDN seems to list that attribute as being boolean when it obviously isn't.

Yeah, that was the confusing part. Everything I saw had it listed as a boolean when there are 3 options. I did try and set it to $null and it would throw up a bunch of errors. After trying a few things I was able to find that program that got me what I needed. Thank you for the help!

# ¿ Apr 16, 2013 16:00

Drumstick: Jun 20, 2006; Lord of cacti

Is there a simple way to change user passwords? I have a csv of the usernames, and the new passwords but Im not sure how to set the new passwords. I have about 11,500 passwords that need changed...

# ¿ Jul 15, 2013 20:31

Adbot: ADBOT LOVES YOU

# ¿ Apr 30, 2024 13:17

Drumstick: Jun 20, 2006; Lord of cacti

Well, I went to post a big thing about how I couldnt get it to work and it turns out I just cant spell.

Thanks for the help! Its working great, I want to run it through another time or two before hitting it all.

# ¿ Jul 16, 2013 20:24

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Powershell Megathread: Verb-Noun Scripting is the future