Skip to content

Commit 732a938

Browse files
SamErdeSamErde
committed
PSSA whitespace and alignment
1 parent 36f9c15 commit 732a938

29 files changed

+387
-418
lines changed

‎Active Directory/AD Groups/Get Foreign Security Principals in Groups.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# List all foreign security principals in Active Directory that are a member of any group
22
$FSPContainer = $Domain.ForeignSecurityPrincipalsContainer
3-
Get-ADObject -Filter 'ObjectClass -eq "foreignSecurityPrincipal"' -Properties 'msds-principalname','memberof' -SearchBase $FSPContainer -Server $GlobalCatalog |
3+
Get-ADObject -Filter 'ObjectClass -eq "foreignSecurityPrincipal"' -Properties 'msds-principalname', 'memberof' -SearchBase $FSPContainer -Server $GlobalCatalog |
44
Where-Object { $_.memberof -ne $null } | ForEach-Object {
55
$AllForeignSecurityPrincipalMembers.Add($_)
66
}

‎Active Directory/AD Groups/Remove Disabled Computer from All Groups Except Domain Computers.ps1‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
$Token = (Get-ADGroup "Domain Computers" -Properties PrimaryGroupToken).PrimaryGroupToken
1+
$Token = (Get-ADGroup 'Domain Computers' -Properties PrimaryGroupToken).PrimaryGroupToken
22

3-
Get-ADComputer -Filter 'Enabled -eq "False"' -SearchBase "OU=Disabled Computers,..." -Properties PrimaryGroup,MemberOf | ForEach-Object {
3+
Get-ADComputer -Filter 'Enabled -eq "False"' -SearchBase 'OU=Disabled Computers,...' -Properties PrimaryGroup, MemberOf | ForEach-Object {
44

55
#If Computer Primary Group is not Domain Computers, then Set Domain Computers as Primary Group.
6-
If ($_.PrimaryGroup -notmatch "Domain Computers"){
6+
If ($_.PrimaryGroup -notmatch 'Domain Computers') {
77
Set-ADComputer -Identity $_ -Replace @{PrimaryGroupID = $Token } -Verbose
88
} #If
99

1010
#If Computer is a member of more than 1 Group. Remove All Group except Domain Computers.
1111
If ($_.memberof) {
12-
$Group = Get-ADPrincipalGroupMembership -Identity $_ | Where-Object {$_.Name -ne 'Domain Computers'}
13-
Remove-ADPrincipalGroupMembership -Identity $_ -MemberOf $Group -Confirm:$false -Verbose
12+
$Group = Get-ADPrincipalGroupMembership -Identity $_ | Where-Object { $_.Name -ne 'Domain Computers' }
13+
Remove-ADPrincipalGroupMembership -Identity $_ -MemberOf $Group -Confirm:$false -Verbose
1414
} #If
1515

1616
#Move Computer to Disabled OU.

‎Active Directory/AD Users/Get-ADDirectReport.ps1‎

Lines changed: 59 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,40 @@
1-
function Get-ADDirectReports
2-
{
3-
<#
1+
function Get-ADDirectReports {
2+
<#
43
.SYNOPSIS
54
This function retrieve the directreports property from the IdentitySpecified.
65
Optionally you can specify the Recurse parameter to find all the indirect
76
users reporting to the specify account (Identity).
8-
7+
98
.DESCRIPTION
109
This function retrieve the directreports property from the IdentitySpecified.
1110
Optionally you can specify the Recurse parameter to find all the indirect
1211
users reporting to the specify account (Identity).
13-
12+
1413
.NOTES
1514
Francois-Xavier Cat
1615
www.lazywinadmin.com
1716
@lazywinadm
18-
17+
1918
VERSION HISTORY
2019
1.0 2014/10/05 Initial Version
21-
20+
2221
.PARAMETER Identity
2322
Specify the account to inspect
24-
23+
2524
.PARAMETER Recurse
2625
Specify that you want to retrieve all the indirect users under the account
27-
26+
2827
.EXAMPLE
2928
Get-ADDirectReports -Identity Test_director
30-
29+
3130
Name SamAccountName Mail Manager
3231
---- -------------- ---- -------
3332
test_managerB test_managerB test_managerB@la... test_director
3433
test_managerA test_managerA test_managerA@la... test_director
35-
34+
3635
.EXAMPLE
3736
Get-ADDirectReports -Identity Test_director -Recurse
38-
37+
3938
Name SamAccountName Mail Manager
4039
---- -------------- ---- -------
4140
test_managerB test_managerB test_managerB@la... test_director
@@ -44,65 +43,54 @@ test_userB2 test_userB2 test_userB2@lazy... test_managerB
4443
test_managerA test_managerA test_managerA@la... test_director
4544
test_userA2 test_userA2 test_userA2@lazy... test_managerA
4645
test_userA1 test_userA1 test_userA1@lazy... test_managerA
47-
46+
4847
#>
49-
[CmdletBinding()]
50-
PARAM (
51-
[Parameter(Mandatory)]
52-
[String[]]$Identity,
53-
[Switch]$Recurse
54-
)
55-
BEGIN
56-
{
57-
TRY
58-
{
59-
IF (-not (Get-Module -Name ActiveDirectory)) { Import-Module -Name ActiveDirectory -ErrorAction 'Stop' -Verbose:$false }
60-
}
61-
CATCH
62-
{
63-
Write-Verbose -Message "[BEGIN] Something wrong happened"
64-
Write-Verbose -Message $Error[0].Exception.Message
65-
}
66-
}
67-
PROCESS
68-
{
69-
foreach ($Account in $Identity)
70-
{
71-
TRY
72-
{
73-
IF ($PSBoundParameters['Recurse'])
74-
{
75-
# Get the DirectReports
76-
Write-Verbose -Message "[PROCESS] Account: $Account (Recursive)"
77-
Get-Aduser -identity $Account -Properties directreports |
78-
ForEach-Object -Process {
79-
$_.directreports | ForEach-Object -Process {
80-
# Output the current object with the properties Name, SamAccountName, Mail and Manager
81-
Get-ADUser -Identity $PSItem -Properties mail, manager, DistinguishedName | Select-Object -Property Name, SamAccountName, DistinguishedName, Mail, @{ Name = "Manager"; Expression = { (Get-Aduser -identity $psitem.manager).samaccountname } } | Where-Object { $_.DistinguishedName -like "*,OU=Employees,OU=People,DC=DOMAINNAME,DC=org" }
82-
# Gather DirectReports under the current object and so on...
83-
Get-ADDirectReports -Identity $PSItem -Recurse
84-
}
85-
}
86-
}#IF($PSBoundParameters['Recurse'])
87-
IF (-not ($PSBoundParameters['Recurse']))
88-
{
89-
Write-Verbose -Message "[PROCESS] Account: $Account"
90-
# Get the DirectReports
91-
Get-Aduser -identity $Account -Properties directreports | Select-Object -ExpandProperty directReports |
92-
Get-ADUser -Properties mail, manager | Select-Object -Property Name, SamAccountName, Mail, @{ Name = "Manager"; Expression = { (Get-Aduser -identity $psitem.manager).samaccountname } }
93-
}#IF (-not($PSBoundParameters['Recurse']))
94-
}#TRY
95-
CATCH
96-
{
97-
Write-Verbose -Message "[PROCESS] Something wrong happened"
98-
Write-Verbose -Message $Error[0].Exception.Message
99-
}
100-
}
101-
}
102-
END
103-
{
104-
Remove-Module -Name ActiveDirectory -ErrorAction 'SilentlyContinue' -Verbose:$false | Out-Null
105-
}
48+
[CmdletBinding()]
49+
PARAM (
50+
[Parameter(Mandatory)]
51+
[String[]]$Identity,
52+
[Switch]$Recurse
53+
)
54+
BEGIN {
55+
TRY {
56+
IF (-not (Get-Module -Name ActiveDirectory)) { Import-Module -Name ActiveDirectory -ErrorAction 'Stop' -Verbose:$false }
57+
} CATCH {
58+
Write-Verbose -Message '[BEGIN] Something wrong happened'
59+
Write-Verbose -Message $Error[0].Exception.Message
60+
}
61+
}
62+
PROCESS {
63+
foreach ($Account in $Identity) {
64+
TRY {
65+
IF ($PSBoundParameters['Recurse']) {
66+
# Get the DirectReports
67+
Write-Verbose -Message "[PROCESS] Account: $Account (Recursive)"
68+
Get-ADUser -Identity $Account -Properties directreports |
69+
ForEach-Object -Process {
70+
$_.directreports | ForEach-Object -Process {
71+
# Output the current object with the properties Name, SamAccountName, Mail and Manager
72+
Get-ADUser -Identity $PSItem -Properties mail, manager, DistinguishedName | Select-Object -Property Name, SamAccountName, DistinguishedName, Mail, @{ Name = 'Manager'; Expression = { (Get-ADUser -Identity $psitem.manager).samaccountname } } | Where-Object { $_.DistinguishedName -like '*,OU=Employees,OU=People,DC=DOMAINNAME,DC=org' }
73+
# Gather DirectReports under the current object and so on...
74+
Get-ADDirectReports -Identity $PSItem -Recurse
75+
}
76+
}
77+
}#IF($PSBoundParameters['Recurse'])
78+
IF (-not ($PSBoundParameters['Recurse'])) {
79+
Write-Verbose -Message "[PROCESS] Account: $Account"
80+
# Get the DirectReports
81+
Get-ADUser -Identity $Account -Properties directreports | Select-Object -ExpandProperty directReports |
82+
Get-ADUser -Properties mail, manager | Select-Object -Property Name, SamAccountName, Mail, @{ Name = 'Manager'; Expression = { (Get-ADUser -Identity $psitem.manager).samaccountname } }
83+
}#IF (-not($PSBoundParameters['Recurse']))
84+
}#TRY
85+
CATCH {
86+
Write-Verbose -Message '[PROCESS] Something wrong happened'
87+
Write-Verbose -Message $Error[0].Exception.Message
88+
}
89+
}
90+
}
91+
END {
92+
Remove-Module -Name ActiveDirectory -ErrorAction 'SilentlyContinue' -Verbose:$false | Out-Null
93+
}
10694
}
10795

10896
<#
@@ -111,4 +99,4 @@ Get-ADDirectReports -Identity Test_director
11199
112100
# Find all Indirect user reporting to Test_director
113101
Get-ADDirectReports -Identity Test_director -Recurse
114-
#>
102+
#>

‎Active Directory/AD Users/Remove-DisabledUsersFromAllGroups.ps1‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
$Token = (Get-ADGroup "Domain Users" -Properties PrimaryGroupToken).PrimaryGroupToken
1+
$Token = (Get-ADGroup 'Domain Users' -Properties PrimaryGroupToken).PrimaryGroupToken
22

3-
Get-ADUser -Filter 'Enabled -eq "False"' -Properties PrimaryGroup,MemberOf | ForEach-Object {
3+
Get-ADUser -Filter 'Enabled -eq "False"' -Properties PrimaryGroup, MemberOf | ForEach-Object {
44

55
# If the user's Primary Group is not Domain Users, then set Domain Users as their Primary Group.
6-
If ($_.PrimaryGroup -notmatch "Domain Users"){
6+
If ($_.PrimaryGroup -notmatch 'Domain Users') {
77
Set-ADUsers -Identity $_ -Replace @{PrimaryGroupID = $Token } -Verbose
88
}
99

1010
# If User is a member of more than 1 Group, remove all group memberships except Domain Users.
1111
If ($_.memberof) {
12-
$Group = Get-ADPrincipalGroupMembership -Identity $_ | Where-Object {$_.Name -ne 'Domain Users'}
13-
Remove-ADPrincipalGroupMembership -Identity $_ -MemberOf $Group -Confirm:$false -Verbose
12+
$Group = Get-ADPrincipalGroupMembership -Identity $_ | Where-Object { $_.Name -ne 'Domain Users' }
13+
Remove-ADPrincipalGroupMembership -Identity $_ -MemberOf $Group -Confirm:$false -Verbose
1414
}
1515

1616
# Move User to Disabled OU.

‎Active Directory/AD Users/Test-IsMemberOfProtectedUsers.ps1‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ function Test-IsMemberOfProtectedUsers {
3030
Author: Sam Erde (https://linktr.ee/SamErde)
3131
Modified: 2024-02-16
3232
Version: 0.1.0
33-
33+
3434
Membership in Active Directory's Protect Users group can have implications for anything that relies on NTLM authentication.
3535
3636
To Do:
@@ -55,8 +55,7 @@ function Test-IsMemberOfProtectedUsers {
5555
# These two are different types. Fixed by referencing $CheckUser.SID later, but should fix here by using one type.
5656
$CurrentUser = ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name).Split('\')[-1]
5757
$CheckUser = Get-ADUser $CurrentUser -Properties primaryGroupID
58-
}
59-
else {
58+
} else {
6059
$CheckUser = Get-ADUser $User -Properties primaryGroupID
6160
}
6261

‎Active Directory/Domain Services/AD Permissions Class Types.ps1‎

Lines changed: 43 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,60 @@
11
# Create a hash table of all permission class and sub-class types from the AD schema.
22
$ObjectTypeGUID = @{}
33
(Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -LDAPFilter '(SchemaIDGUID=*)' -Properties Name, SchemaIDGUID).
4-
ForEach({$ObjectTypeGUID.Add([GUID]$_.SchemaIDGUID,$_.Name)})
4+
ForEach({ $ObjectTypeGUID.Add([GUID]$_.SchemaIDGUID, $_.Name) })
55

6-
(Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -LDAPFilter '(ObjectClass=ControlAccessRight)' -Properties Name, RightsGUID).ForEach({$ObjectTypeGUID.Add([GUID]$_.RightsGUID,$_.Name)})
6+
(Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -LDAPFilter '(ObjectClass=ControlAccessRight)' -Properties Name, RightsGUID).ForEach({ $ObjectTypeGUID.Add([GUID]$_.RightsGUID, $_.Name) })
77
$ObjectTypeGUID | Format-Table -AutoSize
88

99
# Example:
1010
$ObjectTypeGUID[[GUID]'00299570-246d-11d0-a768-00aa006e0529']
1111

1212

13-
function Get-NameForGUID{
13+
function Get-NameForGUID {
1414
# Portions from http://blog.wobl.it/2016/04/active-directory-guid-to-friendly-name-using-just-powershell/
15-
[CmdletBinding()]
16-
[OutputType([System.String])]
17-
Param(
18-
[guid]$guid,
19-
[string]$ForestDNSName
20-
)
21-
Begin{
22-
IF (!$ForestDNSName)
23-
{ $ForestDNSName = (Get-ADForest $ForestDNSName).Name }
24-
25-
IF ($ForestDNSName -notlike "*=*")
26-
{ $ForestDNSNameDN = "DC=$($ForestDNSName.replace('.', ',DC='))" }
27-
28-
$ExtendedRightGUIDs = "LDAP://cn=Extended-Rights,cn=configuration,$ForestDNSNameDN"
29-
$PropertyGUIDs = "LDAP://cn=schema,cn=configuration,$ForestDNSNameDN"
30-
}
31-
Process{
32-
If($guid -eq "00000000-0000-0000-0000-000000000000"){
33-
Return "All"
34-
}Else{
35-
$rightsGuid = $guid
36-
$property = "cn"
37-
$SearchAdsi = ([ADSISEARCHER]"(rightsGuid=$rightsGuid)")
38-
$SearchAdsi.SearchRoot = $ExtendedRightGUIDs
39-
$SearchAdsi.SearchScope = "OneLevel"
15+
[CmdletBinding()]
16+
[OutputType([System.String])]
17+
Param(
18+
[guid]$guid,
19+
[string]$ForestDNSName
20+
)
21+
Begin {
22+
IF (!$ForestDNSName)
23+
{ $ForestDNSName = (Get-ADForest $ForestDNSName).Name }
24+
25+
IF ($ForestDNSName -notlike '*=*')
26+
{ $ForestDNSNameDN = "DC=$($ForestDNSName.replace('.', ',DC='))" }
27+
28+
$ExtendedRightGUIDs = "LDAP://cn=Extended-Rights,cn=configuration,$ForestDNSNameDN"
29+
$PropertyGUIDs = "LDAP://cn=schema,cn=configuration,$ForestDNSNameDN"
30+
}
31+
Process {
32+
If ($guid -eq '00000000-0000-0000-0000-000000000000') {
33+
Return 'All'
34+
} Else {
35+
$rightsGuid = $guid
36+
$property = 'cn'
37+
$SearchAdsi = ([ADSISEARCHER]"(rightsGuid=$rightsGuid)")
38+
$SearchAdsi.SearchRoot = $ExtendedRightGUIDs
39+
$SearchAdsi.SearchScope = 'OneLevel'
40+
$SearchAdsiRes = $SearchAdsi.FindOne()
41+
If ($SearchAdsiRes) {
42+
Return $SearchAdsiRes.Properties[$property]
43+
} Else {
44+
$SchemaGuid = $guid
45+
$SchemaByteString = '\' + ((([guid]$SchemaGuid).ToByteArray() | ForEach-Object { $_.ToString('x2') }) -Join '\')
46+
$property = 'ldapDisplayName'
47+
$SearchAdsi = ([ADSISEARCHER]"(schemaIDGUID=$SchemaByteString)")
48+
$SearchAdsi.SearchRoot = $PropertyGUIDs
49+
$SearchAdsi.SearchScope = 'OneLevel'
4050
$SearchAdsiRes = $SearchAdsi.FindOne()
41-
If($SearchAdsiRes){
51+
If ($SearchAdsiRes) {
4252
Return $SearchAdsiRes.Properties[$property]
43-
}Else{
44-
$SchemaGuid = $guid
45-
$SchemaByteString = "\" + ((([guid]$SchemaGuid).ToByteArray() | %{$_.ToString("x2")}) -Join "\")
46-
$property = "ldapDisplayName"
47-
$SearchAdsi = ([ADSISEARCHER]"(schemaIDGUID=$SchemaByteString)")
48-
$SearchAdsi.SearchRoot = $PropertyGUIDs
49-
$SearchAdsi.SearchScope = "OneLevel"
50-
$SearchAdsiRes = $SearchAdsi.FindOne()
51-
If($SearchAdsiRes){
52-
Return $SearchAdsiRes.Properties[$property]
53-
}Else{
54-
Write-Host -f Yellow $guid
55-
Return $guid.ToString()
56-
}
53+
} Else {
54+
Write-Host -f Yellow $guid
55+
Return $guid.ToString()
5756
}
5857
}
5958
}
6059
}
61-
60+
}

‎Active Directory/Domain Services/Get-TrustedDomainNetBIOSNames.ps1‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,16 @@
11
Import-Module ActiveDirectory
2-
[array]$ADDomainTrusts = (Get-ADObject -Filter {ObjectClass -eq "trustedDomain"}).Name
2+
[array]$ADDomainTrusts = (Get-ADObject -Filter { ObjectClass -eq 'trustedDomain' }).Name
33
[array]$NetBIOSDomainNames = @()
44

5-
foreach ($trust in $ADDomainTrusts)
6-
{
5+
foreach ($trust in $ADDomainTrusts) {
76
$trustedDNSDomainName = $trust
8-
$NetBIOSDomainNames += ((Get-ADDomain $trustedDNSDomainName | Select-Object NetBIOSName)| Out-String).Trim()
7+
$NetBIOSDomainNames += ((Get-ADDomain $trustedDNSDomainName | Select-Object NetBIOSName) | Out-String).Trim()
98
}
109

1110
$NetBIOSDomainNames
1211

1312
<# Or using this:
14-
$TrustedDomains = @{}
13+
$TrustedDomains = @{}
1514
$TrustedDomains += Get-ADObject -Filter {ObjectClass -eq "trustedDomain"} -Properties * |
1615
Select-Object @{ Name = 'NetBIOSName'; Expr = { $_.FlatName } },@{ Name = 'DNSName'; Expr = { $_.Name } },$TrustedDomains
1716

‎Active Directory/Domain Services/Invoke-DcDiag.ps1‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ function Invoke-DcDiag {
44
[ValidateNotNullOrEmpty()]
55
[string]$DomainController
66
)
7-
7+
88
$result = dcdiag /s:$DomainController
9-
$result | select-string -pattern '\. (.*) \b(passed|failed)\b test (.*)' | foreach {
9+
$result | Select-String -Pattern '\. (.*) \b(passed|failed)\b test (.*)' | ForEach-Object {
1010
$obj = @{
11-
TestName = $_.Matches.Groups[3].Value
11+
TestName = $_.Matches.Groups[3].Value
1212
TestResult = $_.Matches.Groups[2].Value
13-
Entity = $_.Matches.Groups[1].Value
13+
Entity = $_.Matches.Groups[1].Value
1414
}
1515
[pscustomobject]$obj
1616
}

0 commit comments

Comments
 (0)