Update on the MIM Script from Last Post

On PowerShell Power Users LinkedIn group, Tim Clapper posted a way to speed up the main script.  Here two snippets from the the script I posted:

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenname,sn | Measure-object

While ($results.count -eq 1) 

#this checks if there is an account with the first name and last name.  If $results.count is zero, the while loop is exited.

{

       $tempLastName = $LastName + $counter

       #This command now looks for a first name and last name+counter.

       $results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenName,sn | measure-object

       $counter++

}

Tim recommended I make the following changes to speed up the script:
1. Instead of using the where-object statement, move the conditions to the -filter switch
2. Instead of using 'sn', use 'surname'

The changes would look like the following:

$results = get-aduser -filter(givenName -eq $FirstName -and surname -like $tempLastName) | select-object givenName,surname | measure-object

Within the While loop

While ($results.count -eq 1) 

#this checks if there is an account with the first name and last name.  If $results.count is zero, the while loop is exited.

{

       $tempLastName = $LastName + $counter

       #This command now looks for a first name and last name+counter.

       $results = get-aduser -filter(givenName -eq $FirstName -and surname -like $tempLastName) | select-object givenName,surname | measure-object

       $counter++

}

I've tested the code and it does run faster since the code isn't searching all of Active Directory with the Where-Object command.

Test the change for yourself and let me know what you think. You can find the full code and MIM activity screen shot at https://github.com/mikeegan400/MIM-Test-for-Unique-First-and-Last-Name

A huge thank you to Tim Clapper.  He is one of the many PowerShell fans in the LinkedIn PowerShell group.  I highly recommend you join!

Until next time...

Triumphant Return and a MIM Script

 I'M BACK!!  It has been way too long but I am back.

I will be posting more scripts that we create and use in the company I work for.  They will be mostly GET- scripts against Active Directory, as well as the PowerShell commands we use in our Microsoft Identity Management (MIM) environment.

So, let's get started with a MIM script that we use to look for unique first name and last name within the MIM portal.

As you may or may not know, the MIM portal has PowerShell version 2.0 embedded in the portal.  In order to use the get-ADuser, you need to be running PowerShell version 3.0. I was able to find a workaround so that the main script can be executed using PowerShell 3.0.

I created two scripts, the main scripts and the script that runs inside the activity.

This is the code that is running within the PowerShell activity:

 As you can see, the command that starts with $templastname runs the PowerShell command but it runs it under version 3.0.  This was how I was able to work around the PowerShell 2.0 limit within the MIM portal.

PARAM(

[parameter(mandatory=$true)]$FirstName

,[parameter(mandatory=$true)]$LastName

)

$tempLastName = powershell -version 3.0 -command "c:\scripts\test_unique_lastname.ps1 $firstName $lastname"

$tempLastName

This is the main script.

#This makes the variables available to the script.

PARAM(

[parameter(mandatory=$true)]$FirstName

,[parameter(mandatory=$true)]$LastName

)

#This loads the module in case it isn’t already loaded

import-module activedirectory

#This sets the counter for

[int]$counter = 2

$tempLastName = $LastName

#This command looks for an account that contains the first name and last name similar to what was entered in the portal

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenname,sn | Measure-object

While ($results.count -eq 1) 

#this checks if there is an account with the first name and last name.  If $results.count is zero, the while loop is exited.

{

       $tempLastName = $LastName + $counter

       #This command now looks for a first name and last name+counter.

       $results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenName,sn | measure-object

       $counter++

}

#This value is returned to the PowerShell activity in the portal
$tempLastName

 

The scripts and the screenshots of the PowerShell activity are available in my GitHub account, https://github.com/mikeegan400/MIM-Test-for-Unique-First-and-Last-Name.  Please feel free to contact me if you have any questions or comments.

Long time, no see

 I have been doing a lot of PowerShell scripting in my current job.  The best part is that most of the team are PowerShell enthusiasts.  So, I am getting a lot of ideas and suggestions for new scripts...which I will share with you folks.

My plan is to post one day a week.  The topics will vary from cool scripts to resources to helpful tips.

I am excited to get back to this blog.  I hope you will all find it helpful.

Until next time,
Mike

Monitor Changes in a Folder

I receive a daily email from Powershell.com (www.powershell.com).  When I saw this script I said to myself, "There were times I really could have used this.".  Particularly when I wanted to know what files were affected when running an update.  I saved this file as Run-fileWatcher.ps1:


In this example, I created a folder called Test_Folder

# Change the $folder variable to the folder you want to monitor

$folder = "C:\Test_Folder"
$filter = '*'  # looks for all changes


 try
{
   $fsw = New-Object System.IO.FileSystemWatcher $folder , $filter -ErrorAction Stop # the FileSystemWatcher component watches for changes in the LastWrite and LastAccess properties of a file.
}


catch [System.ArgumentException] # checks for errors
{
   Write-Warning "Oops: $_"
   return
}

$fsw.IncludeSubdirectories = $true
$fsw.NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'

do
{
   $result = $fsw.WaitForChanged([ System.IO.WatcherChangeTypes]::All, 1000)
   if ($result.TimedOut) { continue }
 
   $result


   Write-Host "Change in $($result.Name) - $( $result.ChangeType)"

} while ($true)


While the script was running, I created a file called Test.txt.  Inside the file, I entered "This is a test."  I saved the file to c:\test_folder, and the output was:



When I deleted the file, the output was:



It should be possible to write the output to a file, but I haven't tested that yet.  I will put that on my list, as well as adding modification time and date.


I hope you found this helpful.  Again, go to www.powershell.com and sign up for their email.  Some of their scripts I use regularly.


Later,
Mike E

Finding Items in Group Policies

I have had occasion to look for specific information within a client's group policies.  In particular, what drives are being mapped for a group of users.  This client a quite a few organizational units (OUs) and, thus, quite a few groups policies (GPOs).  To simplify this process, I looked for a Powershell solution to help me.  This is what I found:

Param

    (

        # This section is the -StringToFind parameter

        [Parameter(Mandatory=$true,

                   ValueFromPipelineByPropertyName=$true,

                   Position=0)]

        [String]

        $StringToFind

    )

    Begin

    {

    $GPOsToCheck = get-gpo -all |Sort-Object -property displayname # gather all GPO information and sort by displayname

    Write-Host " Checking through" $GPOsToCheck.count "GPO's"

    }

    Process

    {

   

$ListOFAffectedGPOs = @()

$count = 1

$GPOsToCheckCount = $GPOsToCheck.count

foreach ($item in $GPOsToCheck) # go through the list of group policies

{

$Result = Get-GPOReport -name $item.DisplayName -ReportType XML   

if ($Result -match $StringToFind) # check if Result variable information matches the string

{

$ListOFAffectedGPOs += $item.DisplayName

}

else

{

}

Write-Host "$count of $GPOsToCheckCount"

$count++ 

}

Write-Host "List of GPO's that contain $StringToFind"  -ForegroundColor Green

$ListOFAffectedGPOs

    }

    End

    {

    }




The syntax of the script is:
Get-GPOThatContains.ps1 -StringToFind password

Here is the output based on my home AD domain:

PS C:\scripts> .\Get-GPOsThatContain.ps1 -StringToFind password
 Checking through 9 GPO's
1 of 9
2 of 9
3 of 9
4 of 9
5 of 9
6 of 9
7 of 9
8 of 9
9 of 9
List of GPO's that contain password
Default Domain Policy
testdest
TestSource
Windows 7 Screen Lock

The script finds all GPOs, evaluates each policy for the string to find (in this case 'password'), and lists the policies that have that string.

I have found this script very useful when we need to quickly find a GPO entry or when onboarding a new client.

I hope you have found this helpful.  Please let me know if you have any questions.


Mike