Escolar Documentos
Profissional Documentos
Cultura Documentos
ADPowershell is available starting Windows Server 2008 R2. To play with AD Powershell cmdlets, you must have at
least one Windows Server 2008 R2 domain controller (DC) in your domain.
On a Windows Server 2008 R2 box, open an elevated Powershell console window (powershell.exe) and run the
following commands:
If the machine is joined to a domain then a default drive named AD: is created. You can CD into this drive and use
all the regular file system commands to navigate the directory. The paths are in X500 format.
PS C:\> cd AD:
PS AD:\>
PS AD:\> dir
…
PS AD:\> cd "DC=fabrikam,DC=com"
PS AD:\DC=fabrikam,DC=com> md "OU=myNewOU"
…
PS AD:\DC=fabrikam,DC=com> del "OU=myNewOU"
If you want to create a new drive connected to another domain/forest or use the more readable canonical path
format, type:
New-ADGroup
Get-ADDomain
To get a list of AD cmdlets type
Common tasks:
PS C:\> Get-ADUser -Filter { name –like "john*" } ## Gets all the users whose
name starts with John
1 of 5 5/11/2011 2:34 PM
Active Directory Module for Windows PowerShell – Quick start guide ... http://blogs.msdn.com/b/adpowershell/archive/2009/02/25/ad-powersh...
What next?
In the next post we will give an overview of Active Directory Powershell and talk about various cmdlets we provide
in this release.
Enjoy!
Swami
--
Swaminathan Pattabiraman [MSFT]
Developer – Active Directory Powershell Team
Comments
Why you _require_ -Server parameter in New-PsDrive? You can provide default value for it pointing to
current logon server for example. Same about -root parameter which can easily defaults to "" as in your
example.
Why not to make Canonical names default format btw? X500 requres quotes "every,time,when
used,because, of, commas", it right to left so hard to type, and tabcompletion works only on current level
( so you cant do cd mydomain.com\myou\[tab] for example).
Get-ADDomain : Parameter set cannot be resolved using the specified named parameters.
Event if it cant be resolved (why not return my logon domain?) why not to ask me about required
parameters, or return all matching objects, like Get-Process do for example?
Get-ADUser -Filter { name –like "john*" } ## Gets all the users whose name starts with John
Why not Get-ADSomething john* or even Get-ADSomething john ? You can use query by ANR
(http://support.microsoft.com/kb/243299) as default parameter, and this will be perfect choice. Or
another solution, just dont leave us with this ugly one. BTW, how to get _all_ users? ;) Get-ADSomething
(without params) should work. All other PowerShell cmdlets work this way, just look around.
Why in one case you use "Principal" (Get-ADPrincipalGroupMembership) and in another "Account"
(Get-ADAccountAuthorizationGroup)? As it seems to me - its equal meanings there. BTW, IMHO
"ADObject" is better and more intuitive ;)
Again...
Get-ADDomainController -Filter { name -like "*" } ## Gets all the DCs in the current domain
Thats all for today :) I hope my silly critics somehow help you build the real PowerAD ;) Thanks for your
work.
2 of 5 5/11/2011 2:34 PM
Active Directory Module for Windows PowerShell – Quick start guide ... http://blogs.msdn.com/b/adpowershell/archive/2009/02/25/ad-powersh...
Get
Retrieves a resource. For example, the Get-Content cmdlet retrieves the content of a file. Pairs with Set.
Do not use verbs such as Read, Open, Cat, Type, Dir, Obtain, Dump, Acquire, Examine, Find, or _Search_.
All this functionality that it provides, must be built in the Get-AD* cmdlets.
There is no good in building more and more cmdlets just for separate some aspects of same general task
(exept if you get bonuses for it ;)). Get-ADObject (Account/Principal/Whatever) should Get any ad
objects in any way that I want (I'm dont want to search, i want GET ;)). Get-ADUser/Computer is just
special aliases for some popular types.
Same with Set. Set-ADSomething should set any of Something properties, like password for example.
Reset-ADPrincipalPassword doesnt hurt while it "alias" for Set-AdAccount -Password (Get-Credential).
All this will make AD part of PowerShell better integrate in whole system.
And... I'm dont noticed formatting of ad objects, just because I think it will be done some time later prior
to release. Is it in plans? :)
-Server parameter is optional in all our cmdlets and by default the cmdlets talk to a suitable DC in the
computer's domain.
Fair point.
>> 3. Regarding - Why not Get-ADSomething john* or even Get-ADSomething john ? You can use
query by ANR ..
>> Get-ADDomainController -Filter { name -like "*" } ## Gets all the DCs in the current domain
>> Get-ADDomain : Parameter set cannot be resolved using the specified named parameters.
We are working on the default behavior of all the cmdlets and the experience should be better in the
next release :)
The default parameter set for get directory object cmdlets such as: Get-ADObject, Get-ADUser,
Get-ADGroup etc. is -Identity.
The purpose of -Identity is to uniquely identify an object in a domain. Thus we only support identities
(such as: distinguishedName, objectGuid, objectSid and samAccountName) that are guaranteed to be
unique by the server. For certain special objects (example: Fine Grained Password policy, Site, Domain
controller etc.) we support "name" as the identity.
Since, ANR can potentially return more than objects it does not qualify as Identity. However, you can
run a ANR query using filter.
Not exactly. Get-ADAccountAuthorizationGroup returns all the security groups in which an account is a
direct or indirect member. It does not include Distribution Groups.
The returned set may also include additional groups that system would consider the user a member of
for authorization purposes.
>> 5. Why in one case you use "Principal" (Get-ADPrincipalGroupMembership) and in another
3 of 5 5/11/2011 2:34 PM
Active Directory Module for Windows PowerShell – Quick start guide ... http://blogs.msdn.com/b/adpowershell/archive/2009/02/25/ad-powersh...
"Account" (Get-ADAccountAuthorizationGroup)?
Good question. We would like to address this in a separate blog. Watch out for a topic on "ADObject
model"
>> 6. About Search-ADAccount... There is no such verb as Search- or Find- in PowerShell, and no need
in it.
>> 7. There is no good in building more and more cmdlets just for separate some aspects of same
general task.
Again a good question, but I would prefer to address this in a separate blog.
Get-ADUser/ADComputer are not just special aliases. They retrieve additional data and display them in
rich format. They also accept data in rich format inside -Filter parameter.
>> 8. And... I'm dont noticed formatting of ad objects, just because I think it will be done some time
later prior to release. Is it in plans? :)
Cheers,
Swami
Cheers,
Swami
You can have more than one default parameter (in different parameter sets), so it can easily be -Identity,
and then (if input not valid X500 path) fallback to -Anr.
Yes, I was just joking. Btw, was your comment regarding Provider cmdlet output? Or for all AD cmdlets?
Cheers,
Swami
Only one suggestion, please accept wildcard chars for -Properties parameter :) Not all can remember ad
4 of 5 5/11/2011 2:34 PM
Active Directory Module for Windows PowerShell – Quick start guide ... http://blogs.msdn.com/b/adpowershell/archive/2009/02/25/ad-powersh...
property names form objects, so get-aduser someone -prop *logon* will be useful. And get-aduser
someone -prop * of course.
It does not support wildcard chars on the parameters. You can query the schema to get a list of all ldap
attributes that can be set on an AD object.
function GetPossibleLdapAttributes() {
$rootDSE = Get-ADRootDSE
$schemaObject.MayContain
$schemaObject.SystemMayContain
Type:
Cheers,
Swami
AD admins think in terms of OUs rather than paths plus it would be consistent with Exchange
5 of 5 5/11/2011 2:34 PM