Google Classroom - How to get a list of all classes/classrooms

You can use the GAM utility to easily export the details of all Google Classrooms in your domain by following the commands below. In this example we'll be exporting the details to a CSV file

(Be sure to update the path to gam.exe and the output CSV file location)

$allclasses = C:\admin\gam\gam.exe print courses > "C:\Admin\Google Classroom\allclasses.csv"

This works well, but if you look at your CSV file you'll notice that firstly, it isn't formatted into columns properly, and secondly, there are a heap of fields called "coursematerial" that aren't required. We can filter out those fields by using the command below

$allclassesfiltered = import-csv "C:\Admin\GoogleClassroom\allclasses.csv" | select-object * -ExcludeProperty "courseMaterial*"

We can then re-export the CSV file with the command below which will actually export it correctly as a CSV file with data separated into columns correctly

$allclassesfiltered | export-csv "C:\Admin\Google Classroom\allclasses-filtered.csv" -NoTypeInformation

Microsoft Teams - Add Members from Active Directory Group to Team

Teams may often need to be populated with the members of an existing Active Directory security or distribution group. You can use the powershell commands below to easily do this.

Firstly, we need to get the members of our Active Directory group - and pipe the result to the get-aduser cmdlet so we can include the mail property as this is the identifying field we need to use to add users to Teams.

$grpmembers = Get-ADGroupMember -identity | Get-ADUser -properties mail

We will then enable connect to Microsoft Teams to enable the cmdlets, cycle through the list of members and add them to the team. Make sure you update the $teamgrpid to be the unique group ID for the team you wish to add the users to.

Connect-MicrosoftTeams

$teamgrpid = "123456"

foreach ($grpmember in $grpmembers)
    {
    Add-TeamUser -groupid $teamgrpid -user $($grpmember.mail) -role user
    }

You can change the role variable from user to member if you wish to add the users as members instead.

Install Active Directory Powershell Module in Windows 10

For whatever reason, Microsoft has now changed the way the powershell module for Active Directory Domain Services and Lightweight Directory Services tools.

Most documentation suggests you install this from the "Turn Windows features on or off" menu located under Programs and Features within Control Panel - but in later Windows 10 releases, the feature is no longer available. It was previously called "Role Administration Tools".

Role Administration Tools is no longer visible under Turn Windows Features on or off

Likewise, the previously used powershell command is no longer recognised

Enable-WindowsOptionalFeature -Online -FeatureName RSATClient-Roles-AD-Powershell

You now get an error when running this command

Enable-WindowsOptionalFeature : Feature name RSATClient-Roles-AD-Powershell is unknown.

So, how do you do it? Follow the steps below

1. Click the Start button then select Settings
2. Select Apps
3. Select Optional Features
4. Click Add a Feature
5. Search for "RSAT" and select the option for RSAT: Active Directory Domain Services and Lightweight Directory Services Tools. 
   
   
   
   

   

   Select the option for RSAT: Active Directory Domain Services and Lightweight Directory Services

   
   
6. Click Install

If you get an error saying the install failed, make sure you aren't using a WSUS server as windows will try and install it from there by default if you are.

To check, open regedit and go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU and set the UseWUServer key to 0

Automatically Disable Expired Accounts in Active Directory with Powershell

Active Directory has the ability to set an expiration date on accounts so that the account becomes inactive and can't be accessed/logged into once this date has passed. The problem with the way this works, is that technically the account is still "enabled" - as it's not actually "disabled" - it's simply expired. Disabled accounts are easily identified within Active Directory Users & Computers  by a slightly different icon next to the account name. Expired accounts however, do not have any visual indication that they are expired, making them harder to identify.

I have created a powershell script which I run on a daily basis to automatically identify, and then disable any Active Directory accounts that have expired.

$report = @()

$expiredusers = get-aduser -Filter * -Properties AccountExpirationDate | where {$_.AccountExpirationDate -lt (get-date) -and $_.AccountExpirationDate -ne $null -and $_.enabled -eq $true}

if ($expiredusers)

    {

    set-aduser -identity $($user.samaccountname) -enabled $false -description $newdesc

    $report += new-object psobject -property @{Username=$($user.userprincipalname);AccountExpirationDate=$($user.accountexpirationdate);DN=$($user.distinguishedname)}

    }

The $report = @() line creates a new/blank array that we will use later on to store the results of any expired 

Next we perform a search using the get-aduser cmdlet to search all Active Directory accounts for those with an expiration date prior (less than) the current date and whose current account status is Enabled

An If statement is then run if any expired accounts are found which disables the account, and adds the account into the $report variable/array we declared earlier.

You can then export the $report variable to a CSV file, email it to yourself etc.

Active Directory User Account Audit including Status with Powershell

Here is a script I have created that searches for all users within an Active Directory domain and provides a report (.csv file) showing all account names and their status. The status is determined from the useraccountcontrol property contained within each account.

The useraccountcontrol property is stored as a number/integer - the most common numbers/values I've translated to their meanings as part of this script - eg. Enabled, Disabled, Password Expired etc.

You only need to change the value for $outfile variable if required - the script should work in it's current form on any windows/active directory domain

$report = @()
$outfile = "C:\temp\UserAudit.csv"

$searcher = New-Object DirectoryServices.DirectorySearcher 
$searcher.filter = "(&(objectCategory=person)(objectClass=user))"

$userlist =  $searcher.FindAll()

foreach ($user in $userlist)
    {
    $name = $($user.properties.displayname)
    $dn = $($user.properties.distinguishedname)
    $status = $($user.properties.useraccountcontrol)
        if ($status -eq "66050"){$status = "Disabled, password never expires"}
        elseif ($status -eq "66048"){$status = "Enabled, password never expires"}
        elseif ($status -eq "512"){$status = "Enabled Account"}
        elseif ($status -eq "514"){$status = "Disabled Account"}
        elseif ($status -eq "66080"){$status = "Enabled, password never expires, user cannot change password"}
    
    $report += new-object psobject -property @{Name=$name;DN=$dn;Status=$status}
    }
    
$report | select Name, Status, DN | export-csv -path $outfile -notype

The script could be further customized to include other values/properties from the account as required. In it's current form it includes the users display name, distinguished name and status.

How to easily view/find the distinguished name for an Active Directory user account

The distinguished name for a user account is often required for scripting or other management/administrative tasks when working with Active Directory. It represents the unique identifier for every user account so is one of the best ways to work with user accounts (as opposed to just working off first name, last name etc).

They are difficult to remember, and nearly impossible to type using the correct format/syntax - so here's some simple instructions on how to quickly/easily obtain the distinguished name for a user account from Active Directory Users & Computers;

1. Open Active Directory Users & Computers
2. Ensure "Advanced Features" are enabled (go to View > Advanced Features)
3. Open the Active Directroy User object you wish to view the DN for
4. Select the Attribute Editor tab
5. Scroll down to the locate the Distinguished Name value
6. You can double click the entry then copy it to the clipboard from the "Value" field as per the screenshot below
   
   

Copy Active Directory User Group Memberships to Another User with Powershell

I have developed the below script to allow you to easily copy Active Directory user group memberships from one user to another. This can be handy if a user is a member of a large number of groups and you don't wish to manually copy them over.

This script is also beneficial in that it doesn't require the Active Directory modules to be installed in powershell for it to work.

In order for the script to work, you will first need to know the distinguished name (DN) for both the source and target user accounts. This can be easily obtained from Active Directory Users & Computers using the steps below;

1. Open Active Directory Users & Computers
2. Ensure "Advanced Features" are enabled (go to View > Advanced Features)
3. Open the Active Directroy User object you wish to view the DN for
4. Select the Attribute Editor tab
5. Scroll down to the locate the Distinguished Name value
6. You can double click the entry then copy it to the clipboard from the "Value" field as per the screenshot below
   
   

Once you have the source and target user distinguished names, replace the values for the $srcuserdn and $dstuserdn variables. Be sure to leave the quotes ("") in place

$srcuserdn = "CN=Mike,CN=Users,DC=morrissey,DC=local"
$dstuserdn = "CN=Peter,CN=Users,DC=morrissey,DC=local"
$dstuserldap = "LDAP://$dstuserdn"

$grouplist = dsquery user $srcuserdn | dsget user -memberof

foreach ($group in $grouplist)
    {
    if ($group)
        {
        $group = $group.substring(1,$group.length-2)
        $ldapcon = "LDAP://$group"
        $ldapgroup = [ADSI] $ldapcon
        $ldapgroup.add($dstuserldap)
        }
    }