Category: Microsoft

AD CS : Delegate GPO Creation/Management

To delegate creation of new Group Policy Objects and link Group Policy Objects to existing OU’s you mustperform the following tasks:

• Add the user to the Group policy Creator Owner built-in group
• Delegate the ‘Manage Group Policy links‘ permission on the Organisational Units you wish the user to be able to link policies to.

Optional for generating RSOP information:

• Delegate the ‘Read Group Policy Results data‘ permission on the Organisational Units you wish the user to be able to link policies to.

You can also utilise GPMC for delegation of GPO permissions.

LastlogonTimeStamp : Report

Use the following script to report on your users lastLogontimeStamp – note this will be accurate to within one week due to the very nature of the lastlogonTimeStamp attribute being replicated between DC’s once per week.

Save the text below into a VBS file and execute like so: cscript.exe file.vbs >> report.csv

If the script fails, download a copy from here: http://cb-net.co.uk/downloads/compreport2.txt

Option Explicit

Dim objRootDSE, adoConnection, adoCommand, strQuery, strCN
Dim adoRecordset, strDNSDomain, objShell, lngBiasKey
Dim lngBias, k, strDN, dtmDate, objDate
Dim strBase, strFilter, strAttributes, lngHigh, lngLow

‘ Obtain local Time Zone bias from machine registry.
‘ This bias changes with Daylight Savings Time.
Set objShell = CreateObject(“Wscript.Shell”)
lngBiasKey = objShell.RegRead(“HKLM\System\CurrentControlSet\Control\” _
    & “TimeZoneInformation\ActiveTimeBias”)
If (UCase(TypeName(lngBiasKey)) = “LONG”) Then
    lngBias = lngBiasKey
ElseIf (UCase(TypeName(lngBiasKey)) = “VARIANT()”) Then
    lngBias = 0
    For k = 0 To UBound(lngBiasKey)
        lngBias = lngBias + (lngBiasKey(k) * 256^k)
    Next
End If
Set objShell = Nothing

‘ Determine DNS domain from RootDSE object.
Set objRootDSE = GetObject(“LDAP://RootDSE”)
strDNSDomain = objRootDSE.Get(“defaultNamingContext”)
Set objRootDSE = Nothing

‘ Use ADO to search Active Directory.
Set adoCommand = CreateObject(“ADODB.Command”)
Set adoConnection = CreateObject(“ADODB.Connection”)
adoConnection.Provider = “ADsDSOObject”
adoConnection.Open “Active Directory Provider”
adoCommand.ActiveConnection = adoConnection

‘ Search entire domain.
strBase = “”

‘ Filter on all user objects.
strFilter = “(&(objectCategory=computer)(objectClass=user))”

‘ Comma delimited list of attribute values to retrieve.
strAttributes = “distinguishedName,lastLogonTimeStamp,cn”

‘ Construct the LDAP syntax query.
strQuery = strBase & “;” & strFilter & “;” & strAttributes & “;subtree”

‘ Run the query.
adoCommand.CommandText = strQuery
adoCommand.Properties(“Page Size”) = 5000
adoCommand.Properties(“Timeout”) = 60
adoCommand.Properties(“Cache Results”) = False
Set adoRecordset = adoCommand.Execute

‘ Enumerate resulting recordset.
Do Until adoRecordset.EOF
   ‘ Retrieve attribute values for the user.
    strDN = adoRecordset.Fields(“distinguishedName”).Value
    strCN = adoRecordset.Fields(“cn”).Value
    ‘ Convert Integer8 value to date/time in current time zone.
    On Error Resume Next
    Set objDate = adoRecordset.Fields(“lastLogonTimeStamp”).Value
    If (Err.Number 0) Then
        On Error GoTo 0
        dtmDate = #1/1/1601#
    Else
        On Error GoTo 0
        lngHigh = objDate.HighPart
        lngLow = objDate.LowPart
        If (lngLow
            lngHigh = lngHigh + 1
        End If
        If (lngHigh = 0) And (lngLow = 0) Then
            dtmDate = #1/1/1601#
        Else
            dtmDate = #1/1/1601# + (((lngHigh * (2 ^ 32)) _
                + lngLow)/600000000 – lngBias)/1440
        End If
    End If
    ‘ Display values for the user.
    If (dtmDate = #1/1/1601#) Then
       Wscript.Echo chr(34) & strDN & chr(34) & “,” & strCN &  “,Never”
    Else
       Wscript.Echo chr(34) & strDN & chr(34) & “,” & chr(34) & strCN & chr(34) & “,” & dtmDate
    End If
    adoRecordset.MoveNext
Loop

‘ Clean up.
adoRecordset.Close
adoConnection.Close

Windows : Uninstalling a hotfix from the Recovery Console

Use the following steps to remove a hotfix from a Windows Operating system whilst running from the recovery console:
1) Ensure you have a record of installed hotfixes/patches (the KB numbers are the important bit!) that you wish to remove.
2) Boot to the recovery console
3) Check for installed patches/hotfixes; dir $*
4) Change to the directory of the hotfix/patch you wish to remove, change text in red to match the KB number: CHDIR $NTUninstallKBXXXXXXXXX
5) To uninstall execute the spunist.txt file; BATCH spuninst.txt

DNS Scavenging : Existing Environment

Many peopple are wary of the impact of enabling DNS scavenging on an existing environment. Th following command/script will allow you to identify all of the records that will be deleted if you were to enable scavenging.

First execute the command: dnscmd SRV /enumrecords zone @ /continue > DNS_Records.txt

Save the text below into a file names DNSScavenge.vbs, then execute the command: cscript.exe /nologo DNSScavengeTest.vbs DNS_Records.txt >> DNS.csv

‘———————————————————————————————-

Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
Const AGING_TOKEN = “[Aging:”

Const DDNS_NO_REFRESH = 7        ‘ The dynamic DNS no refresh period, where an update classified as a refresh will not be accepted for the record
Const DDNS_REFRESH = 7            ‘ The dynamic DNS refresh period, during which an update will be accepted for the record
Const GMT_OFFSET = +10            ‘ Offset in hours to adjust the resultant times based on the current GMT timezone

Set objFSO = CreateObject(“Scripting.FileSystemObject”)

If WScript.Arguments.Count = 1 Then
    strFileName = WScript.Arguments(0)
Else
    wscript.echo “Specify a filename containing the output of dnscmd. eg DNSScavengeTest.vbs DNS_Records.txt”
    wscript.quit(2)
End If

If Not objFSO.FileExists(strFileName) Then
    WScript.Echo “Error: ” & strFileName & ” file not found.”
    wscript.quit(2)
End If

Set objTextStream = objFSO.OpenTextFile(strFileName, ForReading)
strZoneRecords = objTextStream.ReadAll
WScript.Echo “name,timestamp,wouldBeScavengedIn”

For Each strLine in Split(strZoneRecords, vbCRLF)
    intStart = InStr(1, strLine, AGING_TOKEN, 1)
    If intStart 0 Then                                ‘ Does this line contain an aging value?
        intStart = intStart + Len(AGING_TOKEN)
        intEnd = InStr(intStart, strLine, “]”)
        If intEnd 0 Then intLength = intEnd – intStart
        strHost = Left(strLine, InStr(strLine, ” “)-1)                ‘ Yes, extract the host

        intAging = Mid(strLine, intStart, intLength)                ‘ Extract the aging value, expressed in the decimal number of hours since 01/01/1601
       
        dtmDate = DateAdd(“h”, intAging, “01/01/1601 00:00:00 AM”)        ‘ Convert to a date timestamp
        dtmDate = DateAdd(“h”, GMT_OFFSET, dtmDate)                ‘ Add the current GMT offset

        intDiff = DateDiff(“h”, dtmDate, Now)                    ‘ The difference between now and the timestampe
        intHourDiff = intDiff – ((DDNS_NO_REFRESH * 24) + (DDNS_REFRESH * 24))    ‘ Based on the dynamic DNS no-refresh and refresh periods combined
        If intHourDiff > 0 Then                            ‘ Is this a positive number, indicating the record will be scavenged
            intDay = CInt(intHourDiff / 24)                    ‘ Yes, convert to a number of days for output
            WScript.Echo strHost & “, ” & dtmDate & “, ” & intDay + DDNS_NO_REFRESH + DDNS_REFRESH    ‘This record would be scavenged
        Else
            WScript.Echo “*” & strHost & “, ” & dtmDate            ‘ This record won’t be scavenged
            intDay = 0
        End If
    End If
Next