Ввод в домен рабочей станции

Для Windows: запустить powershell и ввести команду
Add-computer -domainName "domain.lan" -Restart

Circle Back to Loopback

February 8, 2013 by Jonathan Stephens, MSFT // 24 Comments

• 0
• 0

Hello again!  Kim Nichols here again.  For this post, I’m taking a break from the AD LDS discussions (hold your applause until the end) and going back to a topic near and dear to my heart – Group Policy loopback processing.

Loopback processing is not a new concept to Group Policy, but it still causes confusion for even the most experienced Group Policy administrators.

The AD Recycle Bin: Understanding, Implementing, Best Practices, and Troubleshooting

August 27, 2009 by NedPyle [MSFT] // 11 Comments

• 0
• 0

Ned here again. Starting in Windows Server 2008 R2, Active Directory now implements a true recycle bin. No longer will you need an authoritative restore to recover deleted users, groups, OU’s, or other objects. Instead, it is now possible to use PowerShell commands to bring back objects with all their attributes, backlinks, group memberships, and metadata. AD Recycle Bin (ADRB) was a long time coming and it definitely has its idiosyncrasies, but I think you are going to love it.

Today I am going to talk about a few aspects of this new system:

• Understanding how ADRB works under the covers.
• What the requirements are and how to turn ADRB on.
• Using ADRB, along with some best practices.
• Troubleshooting common issues people run into with ADRB.

Armed with this information, you should be able to speak with authority on the AD Recycle Bin and perhaps, save your company from a disaster someday.

Let’s get cranking, IT super hero.

How to Enable Active Directory Recycle Bin (Server 2016)

By Robert Allen | April 7, 2018 | 3 

In this tutorial, you will learn how to enable the Active Directory Recycle bin on Windows Server 2016.

I’ll show you how to enable it through the GUI as well as with Powershell.

The AD recycle bin comes in handy when you accidentally delete an AD object and need to restore it.

Considering updating your Domain functional level from Windows 2003? Read this!

The Exchange TeamFebruary 13, 20158

• 0
• 0

---

Now that Windows Server 2003 end of life (July 14th, 2015) is on the horizon, many customers are updating their Active Directory (AD) Domain Controllers (DC) from 2003. The first item to consider is which Windows Server Operating System (OS) you will be moving to for your DC’s. There are several options to consider today: 2008, 2008R2, 2012, or 2012R2 operating systems. However, no matter which newer OS you move your DC’s to, coming from 2003, the krbtgt account will reset its’ password when you update the Domain Functional Level (DFL), which is the concern that could break Exchange.

Как удалить контроллер домена

Вариант номер 0. Передать FSMO роли.Удалить AD с сервера, удалить комп из домена.
Если вариант 0 не может быть использован, тогда удаляем его принудительно используя варианты 1 или 2.

Вариант номер 1. Открыть dsa.msc и удалить котроллер домена. Открыть dssite.msc и удалить сервер.

Вариант номер 2. Запустить cmd с правами администратора домена.
ntdsutil
metadata cleanup
remove selected server <servername>
quit
quit

Процедура удаления

Если удаляется контроллер домена с fsmo ролями, то сначала нужно захватить эти роли. А потом делать

Захват ролей FSMO

Установка контроллера домена

На базе Windows:

1) Если первый контроллер домена:

Install-WindowsFeature AD-Domain-Services

$domain='test'

Import-module ActiveDirectory

Install-ADDSForest -DomainName $domain -InstallDns

#reboot

Import-module ActiveDirectory

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target $domain

2) Если нужно добавить контроллер домена в существующий домен:

Import-module ActiveDirectory

Install-ADDSDomainController -DomainName 'test' -InstallDNS

Настройка MSA и gMSA

Настройка Managed Service Account:
Import-Module ActiveDirectory
$AccountName='Network1cAccount'
$domain='example.com'
$fqdn=$AccountName+'.'+$domain
$computer='s1c-1'
New-ADServiceAccount -Name $AccountName -Enabled $true
Add-ADComputerServiceAccount -Identity $computer -ServiceAccount $AccountName
Invoke-Command -ComputerName $computer {if ((Get-WindowsFeature rsat-ad-powershell).InstallState -ne [Microsoft.Windows.ServerManager.Commands
.InstallState]::Installed) {Install-WindowsFeature rsat-ad-powershell}}
nvoke-Command -ComputerName $computer {Import-Module ActiveDirectory; Install-ADServiceAccount -Identity $AccountName}

Источник
Настройка group Managed Service Account:
while (!(Get-KDSRootKey)) {
     Add-KDSRootKey –EffectiveImmediately
     Start-Sleep -Seconds 86400 #Ждём пока ключ создастся в AD
}
$AccountName='Network1cAccount'
$domain='example.com'
$fqdn=$AccountName+'.'+$domain
$ADGroupName='servers1c'
New-ADServiceAccount -name $AccountName -DNSHostName $fqdn -PrincipalsAllowedToRetrieveManagedPassword $ADGroupName
$AccountADPath= ('ad:'+(Get-ADServiceAccount $AccountName).DistinguishedName)
<#$acl=get-acl $AccountADPath
$group=Get-ADGroup $ADGroupName
$sid=[System.Security.Principal.SecurityIdentifier]$group.SID
$adRights = [System.DirectoryServices.ActiveDirectoryRights] "Read"
$type = [System.Security.AccessControl.AccessControlType] "Allow"
$inheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "All"
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $identity,$adRights,$type,$inheritanceType
$acl.AddAccessRule($ace)
Set-acl -aclobject $acl $AccountADPath#>

Источник

LDAP запрос на отбор незаблокированных пользователей определённой компании

(&(company=ООО "Рога и копыта")(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))