It is the updated version [v2.1] of the script that will create users in nested OU. If you do not know how to use this script, you can see here.
I made some update changes so users ‘Names’ do not need to be unique in domain level but only in each OU. Continue reading “Updated v2.1: Create Users in New AD Domain with Old Users’ Domain Info”
Category: Powershell
Create Users in New AD Domain with Old Users’ Domain Info
It has been nearly 2 years that I wrote the script to create new AD users with the automatic nested OU creation. The original idea is to create the users from the csv file in which AD users properties are defined. The script now supports extracting the current users and OU information from old domain and use in the new domain. The script will prompt for the new domain name & passwords (optional) to put in the csv file. Continue reading “Create Users in New AD Domain with Old Users’ Domain Info”
Find who reset my password: The Powershell Script to Audit User Accounts Changes
Getting the account management activity is an essential process for auditing purpose. We can check it at the windows event log if the auditing for account management is enabled. To automate this tiresome job, I wrote this powershell script to make life easier.
This script will show you all the changes that admin made to the user/system account, such as the time when the password was reset and who reset the password; who added user to specified group; which attributes of user account was changed. Before running this script, you’ll have to enable auditing of account management to ‘Success’ in local security policy, for the enough of the time so that required events are collected. Don’t worry I have included the user’s option to enable from within this script. Continue reading “Find who reset my password: The Powershell Script to Audit User Accounts Changes”
Script to Log TCP Connections by Powershell
Logging TCP connection is useful for troubleshooting or for auditing purpose. You can use TCPView to view the real-time the incoming and outgoing TCP connections between servers and clients. To save the log into file, you need to use TCPLogView. But, the limitation is the duration of TCP capture, or based on log file size without actually doing the custom scripting. Windows has a built-in netstat command which can capture the TCP/UDP connection. So, with the help of powershell, I loop the execution of netstat command & capture the new TCP connection based on previous connections. With this script, you can capture new TCP connections to a specific time or until the log file size is reached to avoid the disk space consumption. Continue reading “Script to Log TCP Connections by Powershell”
A Quick Start Guide: How to Manage Veeam Backup & Replication 9 with Powershell
Most enterprise backup software has come with powershell support to make backup administrators life easier. In this post, we will play some veeam powershell
commands to backup/restore VMs or for listing current backup jobs. The veeam powershell has more cmdlets for advanced Vss aware backup (such as SQL, Exchange) which I do not cover here. Here, I will show only VM level backup/restore with powershell. Continue reading “A Quick Start Guide: How to Manage Veeam Backup & Replication 9 with Powershell”
Batch/Powershell: How to check Pending Computer Restart after Installing Windows Update
Some windows updates require a system restart after installation because it needs to change some system files which are currently used by running processes, or changes in registry. You’ll be prompted with the yellow icon shield like in fig-1.
Powershell: How to Shift Time Offset of a Movie’s Subtitle
I usually go through my holidays with good movies. Some of the subtitles I downloaded do not have a correct timing with the video soundtrack. And it makes me re-adjust the subtitle whenever I re-play old movies. Since I do not want to install extra software or use websites to change my file whenever I get this problem, I decided to make it work in powershell. Continue reading “Powershell: How to Shift Time Offset of a Movie’s Subtitle”
Find all SNMP Settings of Windows Machine in Powershell
SNMP has a long history with Microsoft Windows. And Microsoft now said that it has been deprecated (moreover, snmp v1 or v2 is less secure than the latest snmp v3, but windows natively doesn’t support version 3 till now) and recommend using CIM for managing hardware and software layers. In this article, we will find the SNMP community string by batch method and powershell method. Continue reading “Find all SNMP Settings of Windows Machine in Powershell”
Set Windows Service Permission to Non-Administrator Accounts
Service related operations such as start/stop/restart windows services are usually assigned to Administrators. Sometimes, you might need to delegate these tasks to non-admin users. In this article, I will show the 4 methods to set the service’s permission to any user account/service account. I will use SQL service (MSSQLSERVER) in domain environment.
Method-1: Using Powershell Module (from TechNet Script Repository, easiest but modules are not trusted by Microsoft)
Method-2: Using subinacl.exe (from Official Microsoft Download, need to install executable locally on computer, an easy method)
Method-3: Using built-in security configuration template in MMC console (do not need to install executable, easy with GUI but more steps are needed)
Method-4: Using built-in service control manager command line (difficult, prone-to-errors if manually configured)
Method-1: Using Powershell Module
Edit: As of Aug,2021, I found that PowershellAccessControl module is no longer available on microsoft gallery. So, alternatively you can download it from github. Extract the zip file and rename the folder name PowerShellAccessControl-master to PowerShellAccessControl and move it to C:\Program Files\WindowsPowerShell\Modules. Before we start, let’s see the SQL service restart option is gray-out for ‘myuser’. See Fig-1.
Open the powershell and check the current service permission for ‘myuser’. To do this, make Get-service and pipeline into Get-EffectiveAccess. Type the following command.
Get-Service MSSQLSERVER | Get-EffectiveAccess -Principal contosomyuser
You can also check the service permission for domain admin account.
Get-Service MSSQLSERVER | Get-EffectiveAccess -Principal contosoadministrator
See Fig-2.
Now, give the user start/stop permission of MSSQLSERVER. See Fig-3.
Get-Service MSSQLSERVER | Add-AccessControlEntry -ServiceAccessRights Start,Stop -Principal contosomyuser
You can see that the ‘myuser’ now has the start/stop/restart permission on SQL service. See Fig-4.
Method-2: Using subinacl.exe
As of Aug,2021, I found that Server 2003 Resource kit is no longer available from Microsoft downloads. So, I suggest you to use other three methods instead of this.
subinacl.exe is a command-line tool that is included in Server 2003 Resource kit. You can separately download it from Microsoft website here.
Install the subinacl.msi. See Fig-5.
After install is completed, go to the install directory and use subinacl.exe. For help, type subinacl.exe /?. See Fig-7.
Since we are going to check/assign/revoke permission to sql service. We will use only these commands:
subinacl.exe /service <myservice> /accesscheck=<username>
subinacl.exe /service <myservice> /<grant/revoke>=<username>=<access>
Fig-8 shows how to check the current permission of sql service for ‘myuser’ and ‘contosoadministrator’ by using this command.
subinacl.exe /service mssqlserver /accesscheck=contosomyuser
Since we’re going to give start/stop permission. Use /grant parameter with username. See fig-9.
We also re-check if the permission is correctly assigned.
subinacl.exe /service mssqlserver /grant=contosomyuser=TO
From table, we can see that we have use TO alias in <access> parameter for starting & stopping the service. A full list of ACE aliases can be found here.
|
Alias
|
Description
|
|
F
|
Full Control
|
|
R
|
Generic Read
|
|
W
|
Generic Write
|
|
X
|
Generic eXecute
|
|
L
|
Read controL
|
|
Q
|
Query Service Configuration
|
|
S
|
Query Service Status
|
|
E
|
Enumerate Dependent Services
|
|
C
|
Service Change Configuration
|
|
T
|
Start Service
|
|
O
|
Stop Service
|
|
P
|
Pause/Continue Service
|
|
I
|
Interrogate Service
|
|
U
|
Service User-Defined Control Commands
|
Now, you can start/stop the SQL service !
If you want to revoke the permission. You can use with the subinacl.exe command with /revoke switch. See Fig-10.
subinacl.exe /service mssqlserver /revoke=contosomyuser
Method-3: Using built-in security configuration template in MMC console
You can also use local security configuration to assign necessary permissions. These are steps:
-
Create new security template (in which security settings of service is defined)
-
Create new security database with newly created security template
-
Analysis the current configuration with the security database and find the conflicts
-
Apply the security configuration
1) Create new security template
Create “Security Template” folder under C: where we can save our own security templates.
Open MMC console >> Add/Remove Snap-in >> Choose Security Templates >> Add >> OK
Right-click and “New Template Search Path”. See Fig-11.
Select the location to our newly created folder(C:Security Templates). The path will be listed in console as shown in Fig-12.
Then, right-click the new node and choose “New Template”. See Fig-12.
Give the new template name and click OK. See Fig-13.
You will see a bunch of security options (the same one you see in Local Security Policy Editor). Since we want to modify the security setting of SQL service, right-click SQL Server (MSSQLSERVER) and click Properties. See Fig-14.
Enable the check box to define the policy. Click Edit Security for more options.
You can see that “System” and “Administrators” already have full permissions. Add ‘myuser’ as new user and select ‘Start, stop and pause’ permission. See Fig-15.
You need to save this modified security template. Right-click the template node and save. And the file will be saved as .inf file in your template directory. See Fig-16.
2) Create new security database with newly created security template
From current MMC console >> Add/Remove Snap-in >> Security Configuration and Analysis >> Add >>OK. See Fig-17.
Right-Click the “Security Configuration and Analysis” node and click open database…
Choose the location you want to save the security database file (I use the default directory “C:Users<myusername>DocumentsSecurityDatabase”). I give the name of the database as “ModifySQLServicePermission”. See Fig-18.
Then you will need to import the template. Choose your saved template which is stored at C:Security TemplateAssign MSSQLSERVER Start_Stop Permission to MyUser. See Fig-19.
3) Analysis the current configuration with the security database and find the conflicts
Now, we can analyze your computer security’s setting whether it matches with our newly created security database.
Right-click the “Security Configuration and Analysis” and click Analyze Computer Now….See Fig-20.
You will see the result tree after analysis is finished.
Go to SQL service and check the result and there you will see the red cross icon which indicates that it conflicts with your current (unmodified) security settings. See Fig-21.
4) Apply the security configuration
You can now apply the security settings.
Click Configure Computer Now… as shown in Fig-22. You will see the progress status as in Fig-23.
Now, you can start/stop the SQL service with our normal user account.
Method-4: Using built-in service control manager command line
In this method, we edit the Security Descriptor of windows service in SDDL (Security Descriptor Definition Language) language. it is a bit difficult to understand if you’re not already familiar to SDDL descriptions. But there is an easy method to do this, which will be explained here. (I have written the another blogpost to explain the details of modifying these access control lists with example).
Here, you need to use sc.exe to check/get/set the service permissions. Its syntax is:
sc.exe sdshow <myservice> Find the current security settings
sc.exe sdset <myservice> <securitySettingsInSDDLformat> Set the security settings
So, we will check the current permission of SQL service by the following command.
sc sdshow myssqlserver
Then, you need to generate the new security descriptor using the same method as we do in previous method with MMC console.
- Open MMC Console
- Add “Security Templates” and “Security Configuration and Analysis” Snap-ins (Fig-11)
- Set the template path, create new template with desired settings and save the template (Fig-12,13,14,15,16)
There is an .inf file in your saved location. Open the file and you will see entries as the below one. See Fig-25.
“MSSQLSERVER”,2,”D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;RPWPDTRC;;;S-1-5-21-2647241702-1957647361-952520019-1197)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)”
You will see there is an extra entry compared to our initial result which I highlighted in red color. This is the added user permission to start/stop the SQL service followed by user’s SID.
Note: You can also get the user name back from this SID by the following command (optional, just for knowledge)
wmic useraccount where sid=”S-1-5-21-2647241702-1957647361-952520019-1197″ get name,sidNow, I can set this new permission with sc.exe sdset <newSDDL> command. See Fig-26.
The command completes successfully. And user now has start/stop permission on SQL service. See Fig-27.
Active Directory Recycle Bin: Restore Deleted Objects or Wipe Off your Bin ?
Active Directory Recycle Bin is available from Server 2008R2 but it is disabled by default and it is one of the most useful feature for system admins in that he can restore any directory objects (user/computer or system accounts) that he mistakenly deleted.
You need Active Directory Administrative Center Console and forest functional level 2008R2 as a minimum to use this.
For the restore process, you can use GUI or powershell. For permanent deletion, powershell is the way to go. Also, there is tombstone lifetime and deleted object lifetime depending on how long you want to keep the deleted objects. Continue reading “Active Directory Recycle Bin: Restore Deleted Objects or Wipe Off your Bin ?”