This is the updated version of my old LName function.

I changed the name to Get-SNames instead of Get-LNames because of
that I know that the correct name is not Last Name and It should be Surname instead.

I use It in my create AD lab script and in a couple of other scripts when I
need “real” peoples name.

My thought have been to update It so that I can use names from other countries
as well.

So I came up with an updated version of the function that can create
a list from USA and It can also create a list from Sweden, as It could
before.

The Swedish list is taken from The Gothenburg University

The US list is taken from mongabay.com’s name site

I have done some changes to the Swedish list as well.
The list is now sorted and saved as UTF-8. The UTF-8 part is for viewing and using names that contains Swedish letters å ä and ö.

The function can be downloaded from here.

No related posts.

Back in 2009 I wrote a Function that took peoples first names from a source in Sweden.
It was top 1000 names here in Sweden.

I use It in my create AD lab script and in a couple of other scripts when I need “real” peoples name.

My thought have been to update It so that I can use names from other countries as well.
So I came up with an updated version of the function that can create a list from USA and It can also create a list from Sweden, as I could before.

The names from USA comes from Social Security Online.

The Swedish names come from the Gothenburg University.

When you run the function you need to have internet access!

The function can be downloaded from here.

No related posts.

I have been working with Quest AD cmdlets.
Here are my stuff about It…

Get it here:
http://www.questsoftware.de/powershell/activeroles-server.aspx

Install it!

Now we need to add the snapin.
To find out the name we just write (Get-PSSnapin –Registered).name

And then we add it by writing Add-PSSnapin Quest.ActiveRoles.ADManagement

To list the cmdlets we can write Get-Command *qad*

To count the cmdlets associated with Quests AD cmdlets we can write
(Get-Command *qad*).count

This means that we now have 81 new cmdlets loaded

In just a oneliner we now can get all users in the AD and export It to a csv file.

Get-QADUser -sizelimit 5000 | select SamAccountName, UserPrincipalName, Name, DN
| export-csv C:\scripts\users.txt

And now we can open the csv file in excel and see all the information.

And this in under 10 min

No related posts.

I got an Excel sheet with Users that
I should move from OUs to an inactive OU.

I’m not a fan of manual work and I like to make tools
for others.

So I made a Move Users tool.

The script populates the drop down lists with all OUs in the current domain.
Then It’s just to paste all users in the Users box and then hit Move.

If you want to test this script, mail me at fredrik(at)poweradmin(dot)se.

No related posts.

I wrote an little GUI app that will help Service desk add users to a group.

No users in the group:

The Application:

The users:

In this way they can take usernames from a Excel file and just
paste them into the application, chose Group from the drop down list, that have been populated with groups from the current Active Directory. And then press Add.

If you want this script, please e-mail me at fredrik(!at!)poweradmin(!dot!)se.

No related posts.

I created a Create Lab AD script a while back.
The script is now updated with some fixes.

The script got error messages sometimes, but created users
anyway. With wrong samaccountnames, but created users

I looked at the text files with names and thought at the first that It was empty lines
that was the bad thing. So I did a easy fix for that, but got the errors anyway.

After some tests and looking to the files I understood that the problem was when the names
was shorter then 3, so I did a fix for that too.

I have been posted the script in pieces before.

http://poweradmin.se/blog/2009/12/15/create-lab-ad-functions-updated/
http://poweradmin.se/blog/2009/12/16/create-lab-ad-continue/
http://poweradmin.se/blog/2009/12/17/create-lab-ad-part-3/
http://poweradmin.se/blog/2009/12/17/create-lab-ad-part-4/
http://poweradmin.se/blog/2009/12/21/create-lab-ad-part-5/
http://poweradmin.se/blog/2009/12/21/create-lab-ad-part-5-changed/
http://poweradmin.se/blog/2009/12/21/create-lab-ad-part-6/
http://poweradmin.se/blog/2009/12/22/lab-ad-with-5000-users/
http://poweradmin.se/blog/2009/12/22/the-story-continues/

I thought that I had posted the whole script, but It seems like I did not…
…the first half of last year was not good in my private life, so I have missed a lot in my PowerShelling

BUT this year will be a really good one instead

The Story, short version

The script will download first names (1000) and last names (1000) from a site in Sweden.
Then It will clean up the file, use it to create 1-5000 AD users with random names in a Lab OU with the choice of OUs, number of
letters from first name and last name for the samaccountname and more.

The whole script:

cls
# Populate LAB AD with "Real" users and OUs

# Number Of Users to create
$nrOfUsers = 5000

# Number of Letters from Firstname in User Name
$lettersUNamefName = 3

# Number of Letters from Lastname in User Name
$lettersUNamelName = 3

# Name of the AD
# Default is the domain where your user are.
$activeLabDomain = new-object DirectoryServices.DirectoryEntry
$labDomain = $activeLabDomain.distinguishedName

# LAB OU
$labOU = "Lab OU"

# OUs to create
$labOUs = "Finance", "IT", "Marketing", "Operations", "Service", "Customer Support"

# OU structure under each OU
$OUStructure = "Users", "Groups", "Computers","Service Accounts", "Admins"

# Country
$userCountry = "Sweden", "Norway", "Denmark", "Finland"

# Path to the file with Firstnames
$fNameFile = "c:\scripts\fname.txt.tmp"
$fNameFileFixed = "c:\scripts\fname.txt"
# Path to the file with Lastnames
$lNameFile = "c:\scripts\lname.txt.tmp"
$lNameFileFixed = "c:\scripts\lname.txt"

function getFNames {
# Get a list of Swedish Firstnames from Gothenburg University
param ($fNameFile)
if(!(test-path -path $fNameFile)){
    if ($WebClient -eq $null) {$Global:WebClient=new-object System.Net.WebClient  }
    $url="http://spraakbanken.gu.se/statistik/lbfnamn.phtml"

    $fNames = $WebClient.DownloadString($url)  -replace "[0-9]","" -replace "<td>","" -replace "<tr>","" -replace "</td>","" -replace "</tr>","" -replace "<b>","" -replace "</b>","" -replace "<td class=""le"">","" -replace "<table>","" -replace "</table>","" -replace "<br />","" -replace "<hr />","" -replace "<body>","" -replace "</body>","" -replace "<html>","" -replace "</html>","" -replace "<table width=""%""><td width=""%"">","" -replace "<td class=""lastupd"">Senaste ändring <b class=""date"">  okt  av lbtekn@svenska.gu.se</a>.","" -replace "<!doctype html public ""-//wc//dtd html . transitional//en"">","" -replace "<head>","" -replace "</head>","" -replace "<h>","" -replace "</h>","" -replace "<title>","" -replace "</title>","" -replace "<tr class=""headrow"">","" -replace "   <meta http-equiv=""Content-Type"" content=""text/html; charset=iso--"">","" -replace "   <link rel=""STYLESHEET"" href=""/css/statistik.css"" type=""text/css"">","" -replace "Vanliga förnamn, ordnade efter frekvens.","" -replace "       Rang   Pojknamn           Frekvens   Rang   Flicknamn          Frekvens","" -replace "\s{3,}", " "
    $fNames = $fNames -split (" ")

    foreach ($fName in $fNames) {
        $fName | Out-File $fNameFile -append
    }
    }
}

function getLNames {
# Get a list of Swedish Lastnames from Gothenburg University
param ($lNameFile)
if(!(test-path -path $lNameFile)){
    if ($WebClient -eq $null) {$Global:WebClient=new-object System.Net.WebClient  }
    $url="http://spraakbanken.gu.se/statistik/lbenamn.phtml"

    $lNames = $WebClient.DownloadString($url)  -replace "[0-9]","" -replace "<td>","" -replace "<tr>","" -replace "</td>","" -replace "</tr>","" -replace "<b>","" -replace "</b>","" -replace "<td class=""le"">","" -replace "<table>","" -replace "</table>","" -replace "<br />","" -replace "<hr />","" -replace "<body>","" -replace "</body>","" -replace "<html>","" -replace "</html>","" -replace "<table width=""%""><td width=""%"">","" -replace "<td class=""lastupd"">Senaste ändring <b class=""date"">  okt  av lbtekn@svenska.gu.se</a>.","" -replace "<!doctype html public ""-//wc//dtd html . transitional//en"">","" -replace "<head>","" -replace "</head>","" -replace "<h>","" -replace "</h>","" -replace "<title>","" -replace "</title>","" -replace "<tr class=""headrow"">","" -replace "   <meta http-equiv=""Content-Type"" content=""text/html; charset=iso--"">","" -replace "   <link rel=""STYLESHEET"" href=""/css/statistik.css"" type=""text/css"">","" -replace "Vanliga förnamn, ordnade efter frekvens.","" -replace "       Rang   Pojknamn           Frekvens   Rang   Flicknamn          Frekvens","" -replace "\s{3,}", " " -replace " efternamn,frekvensordning Vanliga efternamn, i frekvensordning Rang Namn Frekvens ",""
    $lNames = $lNames -split (" ")

    foreach ($lName in $lNames) {

        $lName | where {$_.length -gt "2"} | Out-File $lNameFile -append
    }
    }
} 

# Creating the "root" Lab OU
$search = [System.DirectoryServices.DirectorySearcher]"[ADSI]LDAP://$labDomain"
$search.Filter = "(&(name=$labOU)(objectCategory=organizationalunit))"
$result = $search.FindOne()

if ($result -eq $null) {
    $labADSIDomain = [ADSI]"LDAP://$labDomain"
    $objOU = $labADSIDomain.Create("OrganizationalUnit", "ou=" + $labOU)
    $objOU.SetInfo()
    Write-Host $labOU "created"
}
else
{
    Write-Host $labOU "exists"
}

# Creating all OUs in the Lab OU
$labDomainOU = [ADSI]"LDAP://ou=$labOU,$labDomain"
foreach ($labUnit in $labOUs) {
    $search = [System.DirectoryServices.DirectorySearcher]$labDomainOU
    $search.Filter = "(&(name=$labUnit)(objectCategory=organizationalunit))"
    $result = $search.FindOne()
    if ($result -eq $null) {
        $objOU = $labDomainOU.Create("OrganizationalUnit", "ou=" + $labUnit)
        $objOU.SetInfo()

        Write-Host $labUnit "created"
    }
    else
    {
        Write-Host $labUnit "exists"
    }

}

getFNames $fNameFile
getLNames $lNameFile

gc $fNameFile | where {$_ -ne ""} > $fNameFileFixed
gc $lNameFile | where {$_ -ne ""} > $lNameFileFixed

del $fNameFile
del $lNameFile

for($i = 0;$i -lt $nrOfUsers ;$i++) {
    $firstName = Get-Content $fNameFileFixed | Get-Random -ErrorAction SilentlyContinue
    $lastName = Get-Content $lNameFileFixed | Get-Random -ErrorAction SilentlyContinue

    $mylabOUs = $labOUs | Get-Random

    $userFirstName = $firstName -creplace('å','a') -creplace('ä','a') -creplace('ö','o') -creplace('Å','A') -creplace('Ä','A') -creplace('Ö','O')  -creplace('ü','u') -creplace('Ü','U') -creplace('é','e') -creplace('É','E')
    $userFirstName = $userFirstName.ToLower()
    $userShortFirstName = $userFirstName.Substring(0,$lettersUNamefName)

    $userLastName = $lastName -creplace('å','a') -creplace('ä','a') -creplace('ö','o') -creplace('Å','A') -creplace('Ä','A') -creplace('Ö','O') -creplace('ü','u') -creplace('Ü','U')  -creplace('é','e') -creplace('É','E')
    $userLastName = $userLastName.ToLower()
    $userShortLastName = $userLastName.Substring(0,$lettersUNamelName)

        $userNumber = Get-Random -Minimum 10000 -Maximum 99999

    $userSAM = $userShortFirstName + $userShortLastName + $userNumber
    

    $userLastTele = Get-Random -Minimum 1000 -Maximum 9999
    $userTele = "+468-440 " + $userLastTele

    $myUserCountry = $userCountry | Get-Random

    switch ($myUserCountry)
    {
        'Sweden' {$userCoutryCode = "se"}
        'Denmark' {$userCoutryCode = "dk"}
        'Finland' {$userCoutryCode = "fi"}
        'Norway' {$userCoutryCode = "no"}
        default {$userCoutryCode = "local"}
    }

    $userEmail = $userFirstName + "." + $userLastName + "@poweradmin." + $userCoutryCode

    $userDescription = $firstName + " " + $lastName + " at " + $mylabOUs + " in " + $myUserCountry

    $userPrincipalName = $userFirstName + "." + $userLastName + "@poweradmin.local"

    $displayName = $LastName + ", " + $FirstName

    # Creating the User
    $objOU = new-object DirectoryServices.DirectoryEntry("LDAP://OU=$myLabOUs,OU=$labOU," + $labDomain)
    $objUser = $objOU.Create("user", "cn=$FirstName $LastName")
    $objUser.Put("sAMAccountName", $userSAM)
    $objUser.Put("userPrincipalName",$userPrincipalName)
    $objUser.Put("displayName",$displayName)
    $objUser.put("mail", $userEmail)
    $objUser.put("department", $myLabOUs)
    $objUser.put("company","Power Admin Corp")
    $objUser.put("employeeNumber", $userNumber)
    $objUser.put("telephoneNumber", $userTele)
    $objUser.put("wWWHomePage", "http://www.poweradmin.se/blog")

    $objUser.SetInfo()
    Write-Host "Created - " $firstName $lastName "($userSAM) in" $mylabOUs 

    $objUser.Put("givenName", $firstName)
    $objUser.Put("sn", $lastName)
    $objUser.Put("description", $userDescription)
    $objUser.SetInfo()

    # Password
    $objUser.psbase.invoke("setpassword", "myH@rdP@ssw0rd99!")
    $objUser.SetInfo()

    # Enable the account
    $objUser.psbase.invokeset('accountdisabled', $false)
    $objUser.SetInfo()

    # Change password at next login
    $objUser.PwdLastSet = 0
    $objUser.Setinfo()

}

The script is as allways provided as is and you should test this in a lab environment…

No related posts.

Recently, I did an experiment of how well the ADCS wizard handles an administrator who “destroys” the Public Key Services container were ADCS and ADDS stores all PKI related information. I did many different tests and one of the was how the install wizards handles a damaged or even missing Public Key Services container!

People who knows me, knows that I am a fan of the extreme, so I started by simply deleting the entire Public Key Services container from Active Directory using ADSI Edit.

Note that the entire Public Key Services container is missing.

Now we can start the ADCS wizard and try to install an Enterprise Root.

Now things starts to get interesting! The ADCS wizard can not create a Enterprise CA even though the test machine is joined to the domain. (Well, technically the test machine is a domain controller .)

Now, lets create the Public Key Services container manually using ADSI Edit then!

We create a empty container (with no child containers) under Services with the exact name “Public Key Services”.

Now, lets try the wizard again!

Now we can clearly install an Enterprise Root again.

But the quite soon we face a problem.

The wizard does not complete successfully!

Of course, I had to find out what was wrong!

A quick investigation of the  container revealed that the ADCS wizard had very nicely recreated all child containers in the Public Key Services container and all objects within them such as Certificate Templates, etc., except the pKIEnrollmentService object for the CA in the Enrollment Services container!

Now lets try this one more time. We uninstall the ADCS role and remove the Public Key Services container again. But this time, we do not only create the Public Key Services  but also the Enrollment Services container as a child container as well.

We just create two containers this time, Public Key Services and the Enrollment Services container.

Lets try to install the CA a final time!

Looks good!

Lets confirm the installation with ADSI Edit.

And a quick view in ADSI Edit confirms this time that the CA was correctly installed in all containers (and the NTAuth Certificate object), including the Enrollment Services container!

I am a little bit sad about that the ADCS wizard could not populate the Enrollment Services container if it was not previously created. The installation wizard can create both create the container and populate it, but it can not do the both things at the same time!

However, it does manage to both recreate and populate all the other containers, including the CDP container which even have a child container that is holding the cRLDistributionPoint objects!

Lets just call this a bug that has a workaround!

// Fredrik “DXter” Jonsson

No related posts.

Have you ever wonder how­ to remove, uninstall or delete a specific CA from Active Directory in an easy way? Well, for some time now, I have been playing with a little PowerShell script I have created for easy decommission of CA’s in Active Directory.

I started first by creating a wrapper around certutil and the ADDS cmd-lets that comes with Windows Server 2008 R2. However, quite fast I decided to write my own mechanisms for removal in native .NET  since all the CA and PKI information are simply just objects in Active Directory. (The only thing in the script that calls certutil is the removal of the CA from NTAuth Certificates).

The tool does a complete removal of a specific CA from AD in a single command, including the specific CA’s LDAP CDP in Active Directory and it’s certificate in NTAuth Certificates. The tool is a simple PowerShell script that expects two parameters.

-caname: The common name of the certificate of the CA you want to decommission.

-caserver: The server name parameter is the name of the computer object hosing the CA.

When the script is executed with the two necessary parameters (it won’t execute without them), it will delete all the PKI related objects for the CA in Active Directory immediately. If you want to remove/uninstall/delete a CA (completely) from Active Directory, this script does everything you want!

When executed, the script reveals what objects that are being deleted.

The script can be run multiple times for confirmation reasons. If the CA objects are already deleted, the script will say so.

The most common situation is that a CA decommission is being done after the uninstallation of the ADCS role from the CA. When this is being done, the ADCS wizard removes the CA’s object in the Enrollment Services container so clients does not to request certificates from it and so PKI View does not monitor that CA/PKI structure anymore. If you run the script to remove a CA that has been correctly uninstalled it will delete all remaining objects except the object in Enrollment Services since it is already deleted.

In this case, the script removes everything except the object in Enrollment Services since it is already deleted.

EDIT: I want to give many thanks to my very intelligent colleague/developer Kerim! He brought it to my attention that the script had NO verification check if certutil was installed or not. I added that now! Thanks a lot buddy! (When I get enough time, I will replace the NTAuthCertificates removal part with my own code instead of having a dependency on certutil only for that small part.)

Now the script prompts a warning if certutil can not be found on the machine.

The script can be found in the download section.

Enjoy!

// Fredrik “DXter” Jonsson

No related posts.

I have noticed that some people have tried to do a CA decommission with the dsdel option in certutil.

However, there is just a little, little problem with it: it does not remove everything!

 

Now, what is wrong with this picture?

Is someone forgetting the NTAuthCertificates store?

 

The NTAuthCertificates store is different from the other containers in Public Key Services.

First of all, is is not a container unlike the rest of the stuff in Public Key Services, it is an container object. Secondly, it is an object that stores the certificates in the multivalued attribute cACertificate, which stores octet strings of ASN-encoded certificates.

 

This means that CA still exists in the NTAuth store in Active Directory!

 

However, we can solve this problem very easy. One way is to remove it using pkiview.msc according to the screenshot above. Another way is to simply delete the entire container object NTAuthCertificates if it is not needed anymore, which might be the case if we have decommissioned our very last CA and for example, are not using any third party PKI’s for smartcard logon.

Worried about deleting the object? Don’t be!

The object is automatically updated by the Active Directory Certificate Services wizard when an Enterprise CA is installed and if it does not exist, it will be created during the installation of the CA.

Another way to “force” a creation of the object again is to publish a CA certificate to the NTAuthCertificates store using certutil.

As I have said before – certutil is my best friend!

 

// Fredrik “DXter” Jonsson

No related posts.

Yesterday I created this little script and I wanted to share it with you guys.

Now that PKI View is removed from KB889250, some people has asked me how to remove all references to old PKI structures in Active Directory in a easier way than just LDAP. Even though AD cleanup is a standard procedure regarding CA decommission, many people are not aware of that and some people seems to just remove the ADCS role and think “that’s it!”.

So yesterday I created a little script to do this AD cleanup automatically. It is using the Active Directory PS-Drive and the Remove-ADObject cmd-let that is provided by the Active Directory PowerShell Module that comes with Windows Server 2008 R2. Since the Active Directory PowerShell Module is using the Active Directory Management Gateway Service, make sure that at least one of your DC’s have it installed or is running on Windows Server 2008 R2. The idea of the script is to use it after a decommission of a single Enterprise Root or if you want to make sure that no old PKI stuff exists in Active Directory before you install a new PKI structure.  This script removes ALL existing references to internal PKI’s and CA’s, so use it very carefully! I think that people should use it only after you have decommissioned your last CA or before you install your first.

The first screen is presenting what the script will do.

A final warning before continuing to delete stuff.  
 

The script is prompting for credentials using the Get-Credential cmd-let.

The script is searching the Public Key Services container in the Configuration partition (for the current domain) for specific PKI related objects that has object classes such as “certificationAuthority”, “pKIEnrollmentService”, “msPKI-PrivateKeyRecoveryAgent”, etc…

 
All objects that are found are presented and the person that is executing the script has a option to remove the objects that are being presented. The Remove-ADObject cmd-let is doing the deletion of the objects with the credentials that was provided earlier to the credential prompt in the beginning of the script.

A simple way to verify that everything is deleted correctly is simply to run the script again. If all PKI related objects are gone, the script will say so.

     
If you think this sounds cool and want to test this in your test environment, the script is available from the download section on http://poweradmin.se/blog/download/?did=4
 

// Fredrik “DXter” Jonsson

No related posts.