Now the task is to move some of the users and computers in the old OU to the new one. The only difference among the old and new OU tree is that the root OU name is different.

The below script reads the OU information from the objects and modify the DistinguishedName and move the objects to the respective new OU. The new OU has got only its root name modified, rest all of the tree remain same as old.

Old OU : domainname.local/DepartmentOU/*

New OU : domainname.local/DepartmentOU_new/*

domainname.local
 |_ DepartmentOU                            ------- OLD OU
   |_ SubDepartmentOU1
     |_ SubDepartmentOU1_USB
     |_ SubDepartmentOU1_Floppy
   |_ SubDepartmentOU2
     |_ SubDepartmentOU2_USB
   |_ SubDepartmentOU3
 |_ DepartmentOU_new                        -------- NEW OU
   |_ SubDepartmentOU1
     |_ SubDepartmentOU1_USB
     |_ SubDepartmentOU1_Floppy
   |_ SubDepartmentOU2
     |_ SubDepartmentOU2_USB
   |_ SubDepartmentOU3 

#List of Users
 $Users = Get-Content D:\Test\Movement\Users.txt
#List of Computers
 $Computers = Get-Content D:\Test\Movement\Computers.txt
 foreach($User in $Users)
 {
     $userInfo = Get-ADUser -Identity $User
     $Detected_OU = $userInfo.DistinguishedName.Split(",")[-3].replace("OU=","")
     $targetOU = $userInfo.DistinguishedName.Substring($userInfo.DistinguishedName.IndexOf(',') + 1, $userInfo.DistinguishedName.Length - $userInfo.DistinguishedName.IndexOf(',') - 1)
     $targetOU = $targetOU.Replace($Detected_OU,"$($Detected_new)_10")
 "Moved: " + $userInfo.DistinguishedName Move-ADObject -Identity $userInfo.DistinguishedName -TargetPath $targetOU
 }
 foreach($Computer in $Computers)
 {
     $ComputerInfo = Get-ADComputer -Identity $Computer
     $Detected_OU = $ComputerInfo.DistinguishedName.Split(",")[-3].replace("OU=","")
     $targetOU = $ComputerInfo.DistinguishedName.Substring($ComputerInfo.DistinguishedName.IndexOf(',') + 1, $ComputerInfo.DistinguishedName.Length - $ComputerInfo.DistinguishedName.IndexOf(',') - 1)
     $targetOU = $targetOU.Replace($Detected_OU,"$($Detected_OU)_new")
 "Moved: " + $ComputerInfo.DistinguishedName Move-ADObject -Identity $ComputerInfo.DistinguishedName -TargetPath $targetOU
 }

Thank you for reading my post. Hope this is helpful to you

Get list of all OU's under the domain
 $OUs = Get-ADOrganizationalUnit -Filter * -SearchBase "OU=OUName,DC=domain,DC=local" -Properties *
 Variable Declaration
 $__FinalGPOList = @()
 Loop through each OU and get the linked GPO
 foreach($OU in $OUs)
 {
     $__GPOLink = @{}
     $__OUGPInheritance = Get-GPInheritance -Target $ou.DistinguishedName 
     $__GPOLink = $__OUGPInheritance |          select -ExpandProperty GpoLinks |
         select @{Name = "GPOName"; Expression = {$_.DisplayName}}, @{Name = "OU_DN"; Expression = {$_.Target}}, Order, Enabled
 Along with the GPO name, OU Distinguished Name, Link Order and Enabled status, below code gives details
 of OU canonical name and OU inheritance details.
 $__GPOLink | % { $_ | Add-Member -MemberType NoteProperty -Name OU -Value $OU.CanonicalName } $__GPOLink | % { $_ | Add-Member -MemberType NoteProperty -Name InheritanceBlocked -Value $__OUGPInheritance.GpoInheritanceBlocked } $__GPOLink $__FinalGPOList += $__GPOLink
 }
 $__FinalGPOList | select OU, GPOName, Order, InheritanceBlocked, Enabled | Export-Csv C:\Users\admin\Desktop\gpo.csv -NoTypeInformation

Thank you for reading my post and hope it is helpful to you.

Suppose we have the below OU in AD domain

 domainname.local
 |_  DepartmentOU
   |_ SubDepartmentOU1
     |_ SubDepartmentOU1_USB
     |_ SubDepartmentOU1_Floppy
   |_ SubDepartmentOU2
     |_ SubDepartmentOU2_USB
   |_ SubDepartmentOU3 

DepartmentOU branch need to be duplicated with different name DepartmentOU_new

 domainname.local
 |_ DepartmentOU
   |_ SubDepartmentOU1
     |_ SubDepartmentOU1_USB
     |_ SubDepartmentOU1_Floppy
   |_ SubDepartmentOU2
     |_ SubDepartmentOU2_USB
   |_ SubDepartmentOU3
 |_ DepartmentOU_new
   |_ SubDepartmentOU1
     |_ SubDepartmentOU1_USB
     |_ SubDepartmentOU1_Floppy
   |_ SubDepartmentOU2
     |_ SubDepartmentOU2_USB
   |_ SubDepartmentOU3 

It can be done with the below script

$rootOUName = "DepartmentOU_new"
 $newRootDN = "OU=DepartmentOU_new,DC=domainname,DC=local"
 $oldRootDN = "OU=DepartmentOU,DC=domainname,DC=local"
 $rootOU_ParentDN = "DC=domainname,DC=local"
 We are reading the canonical name just as a place holder to keep the parent OU of the object
 $old_ChildOUs = Get-ADOrganizationalUnit -Filter * -Properties *  | where {$_.DistinguishedName -like "*$oldRootDN" -and $_.DistinguishedName -ne "$oldRootDN" }
     | select Name, CanonicalName, DistinguishedName, Description
 To fetch the description form the existing root ou
 $oldRootDN_temp = Get-ADOrganizationalUnit -Filter * -Properties *  | where {$_.DistinguishedName -eq "$oldRootDN" }
     | select Name, DistinguishedName, Description
 For each sub OU, the root has to be renamed to the desired name and base path has to be made
 $count = 0
 foreach($ou in $old_ChildOUs) {
     #renaming the OU with new name
     $ou.DistinguishedName = $ou.DistinguishedName.Replace($oldRootDN, $newRootDN)
 #building the base OU for each child OU #we split the DN with comma "," and rejoin the array from 2nd location to the last and save it into the same objects canonical name property $rootOU = ($ou.DistinguishedName.Split(",")) $rootOU = $rootOU[1..$rootOU.length] -join "," $old_ChildOUs[$count].CanonicalName = $rootOU $old_ChildOUs[$count].DistinguishedName = $ou.DistinguishedName $count++
 }
 Creating the parent OU
 New-ADOrganizationalUnit -Name $rootOUName -Path $rootOU_ParentDN -Description $oldRootDN_temp.Description
 "Created parent ou : " + $rootOUName + " under " + $rootOU_ParentDN
 creating all child OU's
 foreach($__newOU in $old_ChildOUs){
     New-ADOrganizationalUnit -Name $__newOU.Name -Path $__newOU.CanonicalName -Description $__newOU.Description
     "Created ou : " + $__newOU.Name + " under " + $__newOU.CanonicalName
 }

The script will generate the OU structure with default security permission inherited from the root.

Thank you reading my post. Hope this is helpful to you.

In this post, We will see how to backup and restore Group Policy objects and to Export and import the GPO settings to other domains.

Backup Group Policy Objects

Suppose we have created couple of GPO for Windows 10 clients with the name Win10_GPO

#Search All GPO with name starting with Win10
$newGPOs = Get-GPO -All | where {$_.DisplayName -like "Win10*"} | Select DisplayName
#Backup All the GPO
$newGPOs | % { 
    #Backup GPO to a location
    $output = Backup-GPO -Name $_.DisplayName -Path D:\OU 
    #Write GPO file GUID and name to a CSV file
    $output | select DisplayName, Id | export-csv D:\OU\GPO_OBJ.csv -Append
}

We are exporting the GPO name and file GUID to a CSV, which is used while importing GPO

Restore Group Policy Objects

$csvData = import-csv "D:\OU\GPO_OBJ.csv"
foreach($GPOdetails in $csvData) {
    #Importing GPO from location
    Import-GPO -BackupId $GPOdetails.Id -Path D:\OU -TargetName $GPOdetails.DisplayName -CreateIfNeeded
}

All your GPO is back.

We can use this to create policy in one domain and export to other domains. It saves time.

Thank you for reading my post. Hope this is helpful to you.

Use case: Active Directory has many PC/Server objects lying in the computers container/OU. The creators are not informing the admins to move the same to respective OU’s. We need to find a way to know who has created these objects.

I have written a small script which will help to identify these objects and its creators.

#Creating an array to store the details
$ADObjectList = @()

Get-ADComputer -SearchBase "CN=Computers,DC=domain,DC=local" -Filter * -Properties * | % {
    #Custom PS object to store the information
    $ADObj = [pscustomobject]@{
    HostName = $_.Name
    Owner = (Get-Acl -Path "AD:$($_.DistinguishedName)").Owner
    CreatedDate = $_.whenCreated
    }
#Adding the custom object to the list
$ADObjectList += $ADObj
}

#Now we have Output which can be filtered as required
$ADObjectList | where {$_.Owner -like "*username*"} | ft *

Note: when objects are created, the security information has a property “owner” which will have the information about the creator. But there are certain situations where the owner information is overwritten, in such cases the above script will not give correct information.

The same script can be used to get other ACL information of the objects.

Thank you for reading my post.

Search-ADAccount -AccountDisabled -ComputersOnly

Find disabled users in AD

Search-ADAccount -UsersOnly -AccountDisabled

Find users with account locked out

Search-ADAccount -LockedOut

Find InActive accounts

Search-ADAccount -AccountInactive

Import-Module ActiveDirectory
Get-ADUser "S-1-5-21-1757981266-130045698-682003330-37842"

The same with .Net framework

$SID = Read-Host -Prompt "Enter SID: "
$objSID = New-Object System.Security.Principal.SecurityIdentifier($SID) 
$objUser = $objSID.Translate([System.Security.Principal.NTAccount]) 
$objUser.Value