Here’s a little powershell script to enable mailboxes based on an OU and put their new mailbox into a given database. To customize, change OU=ORGANIZATIONALUNIT,DC=companyname,DC=com to the DN for the OU you are configuring. Also, change DATABASENAME to the name of the information store that you’d like to use for the mailboxes in that OU. Import-module activedirectory $OUusers = Get-ADUser -LDAPfilter ‘(name=*)’ -searchBase {OU=ORGANIZATIONALUNIT,DC=companyname,DC=com} foreach($username in $OUusers) { Enable-Mailbox -Identity $username.SamAccountName -database {DATABASENAME} }
-
-
Obtain UPN from PowerShell
A UserPrincipalName (or UPN) is an attribute that contains an Internet-style login name for a user based on the Internet standard RFC 822. The UPN is used for a lot of different tasks, notably for Kerberos/Single Sign-On. As such, there are a lot of scripts that can now key off of a UPN. You can use the Get-ADUser cmdlet to query accounts for the UserPrincipalName attribute. To do so, we’re going to -Filter our results to display everyone (although we could include a username to only get one user) and then define the Search Base (using -SearchBase) to refine where in the query that the search will begin. Use the –Properties parameter…
-
Creating Users On Windows Server 2012 Using PowerShell
Scripting user creation in Windows Server is something we’ve long done using LDIF files; however, when building a system that creates users in more of a one-off capacity it’s pretty easy to script the creation process using PowerShell, piping information in from other solutions. To create a user, use the New-ADUser cmdlet. I’ve found that we usually need to populate this with a few pieces of information, including the account name (SamAccountName), the password (AccountPassword), the full name (name) enabling the account (enabled), setting the password not to expire (PasswordNeverExpires) and forcing the user to change their password when they log on (ChangePasswordAtLogon). Respectively, the following example would create user…
-
Setting Up Active Directory In Windows Server 2012
Installing Active Directory services is arguably one of the first things done on many a Windows Server. And for well over a decade you could unbox, update, run dcpromo and be done with much of that. While the wizards are still there, in the case of Windows Server 2012, the process has changed ever-so-slightly. To install a domain controller in Windows Server 2012, start with Server Manager. This new tool is the place where you start many a process in a Windows Server now, and Active Directory is no different. To get started, first open Server Manager. From Server Manager, click on the Manage menu and select Add Roles and…
-
Adding Roles In Windows Server 2012
Out of the box a Windows Server 2012 isn’t really that helpful. But luckily, it has these things called Roles. Roles are things like Hyper-V, File Sharing, Windows Update Services, Web Server, etc. Each role then has a collection of services that it can run as well, within the Role. Roles include (borrowing from Microsoft here): Active Directory Certificate Services Overview This content provides an overview of Active Directory Certificate Services (AD CS) in Windows Server 2012. AD CS is the server role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization. Active Directory Domain Services Overview By…
-
Configuring Windows 2008 As An NTP Server
When you’re configuring a Mac to leverage an existing Windows infrastructure, having the clocks in sync is an important task. Luckily, Windows Server has been able to act as an NTP server for a long time. In this article, we’ll look at configuring Server 2008 R2 to be an NTP server for Mac and Linux clients. Note: Before you get started, or any time you’re hacking around in the registry, make sure to do a backup of your registry/SystemState! To enable NTP on Windows Server, open your favorite registry editor and navigate to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpServer. From here, enter a key called Enabled as a dword with a value of 00000001. The NTP Server should…
-
Automatically assign admin rights in OS X based on Active Directory group membership
Thanks to Tedd Kidd for the following article, on automatically managing administrative privileges based on Active Directory groups! This is a quick and easy way to assign any user to the local admin group in OS X based on their group membership in your Active Directory. This should also work with Open Directory or eDirectory groups if your workstations are bound to those directory services. You’ll need to include this code in the workstation login script so that it runs as root but uses the $@ variable to determine the user that is logging in. #!/bin/bash # Set group name to check against groupname=”domain admins” if [ “`/usr/bin/dsmemberutil checkmembership -U…
- Active Directory, Articles and Books, iPhone, Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Microsoft Exchange Server
Holy White Papers, Apple?!?!?
For those of you who say Apple doesn’t care about the enterprise, Apple has released a number of assets (technical white papers) on integrating Macs (Lion) into enterprise environments at http://training.apple.com/lion. This is also the page that you’ll find links to all of the official training and certification courses for Lion. The assets up on this page are about as close to a publicly accessible book on integrating OS X into the enterprise as you’ll to see for Lion… The first covers the basics of integrating Macs into enterprise environments: The second covers self support: The third is on evaluating Macs in Enterprise environments: The fourth is on deployment: The…
-
Directory Services Scripting Changes in Lion
opendirectoryd Scripting directory services events is one of the most common ways that the OS X community automates post-imaging tasks. As such, there are about as many flavors of directory services scripts are there engineers that know both directory services and have a little scripting experience. In OS X Lion, many aspects of directory services change and bring with them new techniques for automation. The biggest change is the move from DirectoryService to opendirectoryd. In Snow Leopard and below, when you performed certain tasks, you restarted the directory services daemon, DirectoryService. The same is true in Lion, except that instead of doing a killall on DirectoryService, you do it on…
-
Building Exchange 2010 Signatures En Masse
There are a lot of environments that standardize mail signatures. In Exchange 2010 you can now automatically assign users a signature based on a user’s Active Directory information, thus allowing en masse standardization of signatures. To do so is pretty straight forward, first open the Exchange Management Console and browse to the Organization Configuration. Then click on Hub Transport and then on Transport Rules. Next, click New to create a new transport rule. Here you can build an organizational signature based on user’s Active Directory attributes. You can provide some text and then any of the attributes that you see fit by wrapping them in the standard double percentage signs…