joeware - never stop exploring... :)

I saw a posting that had a piece on AdFind at ActiveDir.org that made me want to post something to my blog here for anyone who doesn’t read ADOrg…

Basically one of the posters came up with a good way of setting local admin passwords on machines and part of the solution was to use adfind to get the list of machines. I was thrilled to see that but the command line was a little longer than needed but I don’t blame the poster… That is actually an issue with AdFind because there are soooo many options, sometimes you don’t see the cool option that you need. So in case anyone else is doing anything similar… here is some help for you

Basically the command used was

adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -nolabel -nodn | grep -iv “Objects returned” | grep -iv “Directory” | grep -iv “Using Server” | grep -iv “^$” > d:\servers.txt

The goal here is to get a list of computer names that doesn’t have my “shameless” AdFind Banner in the listing… I actually have an option explicitly to help with that when listing a single attribute… that option is called… -list

So instead of the command above using the grep’s to filter out some of the output, you can instead do something like

adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -list > d:\servers.txt

Much simpler, much cleaner, more pretty. 🙂

And in the spirit of perl… there is more than one way to slice this orange… You could also do something like

adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “objectcategory=computer” cn -nodn -nocsvheader -csv > d:\servers.txt

Granted that isn’t as elegant but it does quote the server names for you if you need them quoted.

Probably the one functional change I would make overall would be to dump the dNSHostName attribute instead of the cn/name. Why you ask? Well my dear reader, because you don’t have to rely on short hostname resolution… I would also change the filter to be an AND of the computer objectcategory tied together with dNSHostName having a value. If that attribute isn’t populated on the computer, it means the computer hasn’t successfully spoken to AD yet, why waste time on it? So how about…

adfind -b ou=prodservers,ou=computers,dc=contoso,dc=com -f “&(objectcategory=computer)(dnshostname=*)” dnshostname -list > d:\servers.txt

    joe

I was talking with a good friend this evening and he asked a question which I would normally consider trivial but the way he put it made me go, oh wow, put that way, that is kind of interesting… It should work the way you would intuit it to work…

The question was, how do I make another Domain Controller a Global Catalog??? Of course everyone who uses AD is like, well just go to dssite.msc (oh ok you probably said go to Sites and Services) and drill down to the DC in question and then go down one more level to NTDS Settings and then right click and select properties and then select the Global Catalog check box…

As I went to say that I thought about it, the guy asking is very good with computers, it has been his business for as long as I have been alive so was a little slow to respond and then he said something that made me go… yeah, that is how it should be… Basically he said, I went to ADUC and looked in the Domain Controllers OU and opened the properties for the Domain Controller and expected to see something that told me it was a GC or not and I could select it to be one… I then said, oh it isn’t there but I can see why you would think it should be… because it probably should be… Why isn’t it there? Just because that info is kept in the config doesn’t mean it shouldn’t be exposed in ADUC for the domain controller properties. ADUC isn’t a raw LDAP editor, it is a tool used to manage the environment and if DCs are going to be exposed in it, it should allow you to view/manipulate the GC status from there as well. I never thought about it before because I always think of AD as an LDAP Server and then visualize the tools as LDAP tools… But ADUC shouldn’t be an LDAP tool… it is a domain/forest management tool. So why doesn’t it allow you to get the full details on a DC and set/clear the fact that a specific DC is a GC. Be a lot better than fishing around in dssite.msc…

Again this guy is a very good computer guy, he is a fellow DEC PDP-11 lover like myself. Very smart. He just doesn’t work in large environments where turning on GCs or making DCs isn’t a real regular occurrence. In fact the last couple of years he spent a lot of time learning Java and making a parametric search engine for the company he works for product search tools. Today he was hooking up a UPS system to a PBX and all of the supporting equipment. Next week he could be working on their Exchange server or one of their Linux servers or their think client solution… Sort of a normal small company IT guy, not an AD specific person and I think he made a great point.