Chances are if you manage users in your organization, you’re going to need to Check Password Expirations In Active Directory to see who’s account is in need of a password change.  This can be especially useful if you would like to notify those users several days in advance so they’re not calling the help desk on the day of.

We want to automate as much of this as possible and luckily, we have Powershell to do all the heavy lifting.

Powershell Script to Check Password Expirations in Active Directory

<#
#requires -Module ActiveDirectory


.SYNOPSIS
    Checks to see if the account is X days within password expiration.
    For updated help and examples refer to -Online version.
 
.DESCRIPTION
    In this example if the $emailDate is set to -80 and $expiredDate is set to -90 it will show all users whos passwords are within 10 days of expiration.
    For updated help and examples refer to -Online version.
 
.NOTES
    Name: Get-PasswordExpiredUsers.ps1
    Version: 1.0
    Author: The Sysadmin Channel
    Date of last revision: 3/18/2017
 
.LINK
    https://thesysadminchannel.com/powershell-script-check-password-expirations-in-active-directory -

#>

Import-Module ActiveDirectory

#Set the number of days within expiration.  This will start to send the email x number of days before it is expired.
$DaysWithinExpiration = 10

#Set the days where the password is already expired and needs to change. -- Do Not Modify --
$MaxPwdAge   = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
$expiredDate = (Get-Date).addDays(-$MaxPwdAge)

#Set the number of days until you would like to begin notifing the users. -- Do Not Modify --
$emailDate = (Get-Date).addDays(-($MaxPwdAge - $DaysWithinExpiration))

#Filters for all users who's password is within $date of expiration.
$ExpiredUsers = Get-ADUser -Filter {(PasswordLastSet -lt $emailDate) -and (PasswordLastSet -gt $expiredDate) -and (PasswordNeverExpires -eq $false) -and (Enabled -eq $true)} -Properties PasswordNeverExpires, PasswordLastSet, Mail | select samaccountname, PasswordLastSet, @{name = "DaysUntilExpired"; Expression = {$_.PasswordLastSet - $ExpiredDate | select -ExpandProperty Days}}, @{name = "EmailAddress"; Expression = {$_.mail}} | Sort-Object PasswordLastSet

$ExpiredUsers

Copy and Paste the contents of this file and save it as Get-PasswordExpiredUsers.ps1. Make sure you run the script as an administrator.  When you run the file it should look something like this.

This will filter all users and only show the samaccountname, PasswordLastSet, DaysUntilExpired and the EmailAddress

Great!! We have the script, but what good does that do us if we don’t notify them.  After all, that was the point to begin with right?  Of course it was.  We want to automate the milk out of this so we can basically set it and forget.

Send Email to Notify Users of Password Expiration

Now we just have to append this part to the rest of the script so we can notify our users automatically.  Here is the rest of the script.

Start-Sleep 5

Foreach ($User in $ExpiredUsers) {
	# Creating .NET Objects
	$msg = new-object Net.Mail.MailMessage

	# Setting up the email parameters.
	$msg.From = "admin@" + ($env:userdnsdomain).ToLower()
	$msg.To.Add($User.EmailAddress)
	$msg.Subject = "Your Password Will Expire in " + $User.DaysUntilExpired + " days"
	$msg.Body = "Hello,`n`nThis email is to notify you that your password will expire in " + $User.DaysUntilExpired + " days.`n`nPlease consider changing it to avoid any service interruptions.`n`nThank you,`nThe I.T. Department."


	# Send an email with an alert
	$smtpServer = "mailhost"
	$smtp = new-object Net.Mail.SmtpClient($smtpServer)
	$smtp.Send($msg)
	
	Start-Sleep 2
	Remove-Variable msg
	Remove-Variable smtp
	Remove-Variable smtpServer
}

The post Script: How To Check Password Expirations In Your Domain appeared first on the Sysadmin Channel.

SCCM-Create Device Collections Based on your Active Directory OU Structure.

• We’ll start off by creating a sub folder under the device collections and call it Active Directory OU Structure.

• Next we’ll Create a Device Collection and go through the wizard.
• Fill out the information that suits you.

• Let’s edit the query statement.

• For the Attribute class select System Resource and for the Attribute select System OU Name

• Set the Operator to is equal to and the Value to the OU of your choice.

• Select OK multiple times to complete the query and when you get back to the SCCM Console, you should see your Collection populated with multiple computers.

SCCM-Create Device Collections Based on AD OUs Demo.

That’s it.  Do this for the rest of your OUs in Active Directory or just the ones you want to keep a collection for.  Also, if you’re looking to further your knowledge in SCCM,  Be sure to check out Learn SCCM in a month of Lunches.

The post SCCM: Create Device Collections Based On AD OUs appeared first on the Sysadmin Channel.

Install RSAT on Windows 10 1709:

• Navigate to Microsoft’s page to Download RSAT Tools for Windows 10 1709 and save it to the location of your choice.
• Run the KB2693643 installer.

• Accept the EULA.

• Let the installer finish and close when done. You may or may not be prompted to restart.

• Navigate to Windows Administrative Tools folder and you should now see your newly installed RSAT Tools on your Windows 10 1709 machine.

Watch as I Install RSAT Tools on Windows 10 1709

The post How to Install RSAT on Windows 10 1709 appeared first on the Sysadmin Channel.

Tired of the old point and click method of creating AD user accounts?  So was I until I learned how to Create User Accounts in Powershell.  I love it!!  With the simple click of a button I have the PS window prompt me for the username and any other relevant information and poof! two seconds later my account is created.

In this article I am going to share the exact script I use to create regular active directory user accounts. All with the power of automation.

Before we’re able to run any Powershell scripts,  you’re going to need to set your execution policy. Check out the link for the refresher on how to do that.

Script to Create AD User Accounts

Now lets get to the good stuff.  The script I use is only for automating the creation of active directory user accounts.  This is not used for mail enabled accounts, or accounts in Office 365.  I’ll post a link to each with its own script at the end of the article.

<# 
.SYNOPSIS
Creates a user account in active directory with information entered in by the user.

.DESCRIPTION
This will create a user in Active Directory automatically with Powershell.

.NOTES
Name: AD-CreateUserNoMailbox.ps1
Version: 1.0
Author: The Sysadmin Channel
Date of last revision: 12/18/2016

.LINK
https://thesysadminchannel.com/script-create-user-accounts-in-powershell/ -
#>


#Checking if the shell is running as administrator.
#Requires -RunAsAdministrator
#Requires -Module ActiveDirectory
$title = "Create a User Account in Active Directory"

$host.ui.RawUI.WindowTitle = $title

Import-Module ActiveDirectory -EA Stop

sleep 5
cls


Write-Host
Write-Host
#Getting variable for the First Name
$firstname = Read-Host "Enter in the First Name"
Write-Host
#Getting variable for the Last Name
$lastname = Read-Host "Enter in the Last Name"
Write-Host
#Setting Full Name (Display Name) to the users first and last name
$fullname = "$firstname $lastname"
#Write-Host
#Setting username to first initial of first name along with the last name.
$i = 1
$logonname = $firstname.substring(0,$i) + $lastname
#Setting the employee ID.  Remove the '#' if you want to use the variable
#$empID = Read-Host "Enter in the Employee ID"
#Setting the Path for the OU.
$OU = "OU=Users,OU=Home,DC=ad,DC=thesysadminchannel,DC=com"
#Setting the variable for the domain.
$domain = $env:userdnsdomain
#Setting the variable for the description.
$Description = Read-Host "Enter in the User Description"


cls
#Displaying Account information.
Write-Host "======================================="
Write-Host 
Write-Host "Firstname:      $firstname"
Write-Host "Lastname:       $lastname"
Write-Host "Display name:   $fullname"
Write-Host "Logon name:     $logonname"
Write-Host "OU:             $OU"
Write-Host "Domain:         $domain"

#Checking to see if user account already exists.  If it does it
#will append the next letter of the first name to the username.
DO
{
If ($(Get-ADUser -Filter {SamAccountName -eq $logonname})) {
        Write-Host "WARNING: Logon name" $logonname.toUpper() "already exists!!" -ForegroundColor:Green
        $i++
        $logonname = $firstname.substring(0,$i) + $lastname
        Write-Host
        Write-Host
        Write-Host "Changing Logon name to" $logonname.toUpper() -ForegroundColor:Green 
        Write-Host
        $taken = $true
        sleep 10
    } else {
    $taken = $false
    }
} Until ($taken -eq $false)
$logonname = $logonname.toLower()

cls
#Displaying account information that is going to be used.
Write-Host "======================================="
Write-Host 
Write-Host "Firstname:      $firstname"
Write-Host "Lastname:       $lastname"
Write-Host "Display name:   $fullname"
Write-Host "Logon name:     $logonname"
Write-Host "OU:             $OU"
Write-Host "Domain:         $domain"



#Setting minimum password length to 12 characters and adding password complexity.
$PasswordLength = 12

Do
{
Write-Host
    $isGood = 0
    $Password = Read-Host "Enter in the Password" -AsSecureString
    $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
    $Complexity = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

    if ($Complexity.Length -ge $PasswordLength) {
                Write-Host
            } else {
                Write-Host "Password needs $PasswordLength or more Characters" -ForegroundColor:Green
        }

    if ($Complexity -match "[^a-zA-Z0-9]") {
                $isGood++
            } else {
                Write-Host "Password does not contain Special Characters." -ForegroundColor:Green
        }

    if ($Complexity -match "[0-9]") {
                $isGood++
            } else {
                Write-Host "Password does not contain Numbers." -ForegroundColor:Green
        }

    if ($Complexity -cmatch "[a-z]") {
                $isGood++
            } else {
                Write-Host "Password does not contain Lowercase letters." -ForegroundColor:Green
        }

    if ($Complexity -cmatch "[A-Z]") {
                $isGood++
            } else {
                Write-Host "Password does not contain Uppercase letters." -ForegroundColor:Green
        }

} Until ($password.Length -ge $PasswordLength -and $isGood -ge 3)


Write-Host 
Read-Host "Press Enter to Continue Creating the Account"
Write-Host "Creating Active Directory user account now" -ForegroundColor:Green

#Creating user account with the information you inputted.
New-ADUser -Name $fullname -GivenName $firstname -Surname $lastname -DisplayName $fullname -SamAccountName $logonname -UserPrincipalName $logonname@$Domain -AccountPassword $password -Enabled $true -Path $OU -Description $Description -Confirm:$false

sleep 2


Write-Host

$ADProperties = Get-ADUser $logonname -Properties *

Sleep 3

cls

Write-Host "========================================================"
Write-Host "The account was created with the following properties:"
Write-Host 
Write-Host "Firstname:      $firstname"
Write-Host "Lastname:       $lastname"
Write-Host "Display name:   $fullname"
Write-Host "Logon name:     $logonname"
Write-Host "OU:             $OU"
Write-Host "Domain:         $domain"
Write-Host
Write-Host

This is the result of the script that outputs all the information of the user account.

So there you have it,  the user account has been created with the click of a single button.  You can even scale this to create multiple accounts at once.

Watch as I Create User Accounts in Powershell

The post Script: How to Automate your AD User Accounts with Powershell appeared first on the Sysadmin Channel.

PS C:\> Get-ExecutionPolicy
Restricted

If you’ve never set your execution policy this is what you will be seeing.  Now in order to change this to allow scripts you create locally, we’ll need to set it to RemoteSigned (or AllSigned, if you only want to run Signed Scripts). Since we don’t have any SSL Certificates on hand, I’m going to set my execution policy to remote signed.

Set Execution Policy in Powershell

To do this run Powershell as administrator and type in the following command:

PS C:\> Set-ExecutionPolicy RemoteSigned

Note: You only have to set the execution policy once if you select Yes to All.

Press A to apply it to all.  If you want to learn a little more about execution policy.  Feel free to check out the MS Documentation.

That’s it!!

The post Set Execution Policy in Powershell appeared first on the Sysadmin Channel.

Reverse lookup is not enabled by default so this means that anytime you try and do a ping -a in your command prompt, it will not give you the corresponding host name.  This makes troubleshooting that much harder and when it comes to DNS, you need all the help you can get.

Setup and Configure DNS Reverse Lookup Zones

• On your Domain Controller, open up DNS Manager
• Right click Reverse Lookup Zones and click New Zone

• Select the appropriate zone for your scenario.

Since I’m setting a brand new domain, i’ll be creating a primary zone.

• Select the appropriate zone scope for your scenario.

In my case I’ll want to replicate to all domain controllers in my domain.

• Enter in the Network ID,  for instance if your network is 192.168.1.0 with a subnet mask of 255.255.255.0. You will use 192.168.1 your network ID.

Since I’m on the 172.16.10 /24 network, i’ll be using this as my Network ID

• Since we’re using Active Directory, I’ll leave this as the default.

• Going forward you should now be able to ping an IP on that network and have it resolve to a hostname.

Note that I am doing a ping -a and the reply is responding with the hostname of the device.

Watch as I show you how to setup and configure DNS reverse lookup zones

And you there have it guys!!  I hope this video and article enables you to be a better sysadmin.  Just remember… It’s always DNS.

The post Setup and Configure DNS Reverse Lookup Zones appeared first on the Sysadmin Channel.

ESXi 5.5 Hardware Requirements.

• ESXI 5.5 requires that you have at least 4GB of RAM.
• ESXI 5.5 only supports a host machine with a minimum of two cores.
• ESXi 5.5 must have at least 1 or more Gigabit or 10Gigabit Ethernet adapters.
• ESXi 5.5 requires the NX/XD bit to be enabled for the CPU in the BIOS

If you would like to know a little more on the hardware specs, check out VMWare’s site here.

Now that we have the hardware out of the way, we’re going to need the install media and probably a USB stick to boot to media.  You can buy USB sticks on Amazon for super cheap these days but most of us already have one laying around.  Once we have our flash drive, we’ll use it to create a bootable ISO of ESXi 5.5.  If you haven’t found it yet, you can download ESXi version 5.5 here.

Install and Configure ESXi 5.5

Alright now that we have all the pre-requisites out of the way boot to USB and you’ll be presented with 2 options.

Press Enter on the ESXi-5.5.0 Installer and let it load.  This process should take several minutes.

During this process you will be prompted to reboot several times.  Follow the prompts on screen until you’re presented to create your root password.

One you get passed all of the reboots and you’re ready to configure your brand new ESXi install, you’ll be presented with the following options.  Click on “Configure Management Network” to statically assign your IP addresses.

Enter in your static IP so DHCP doesn’t change your IP in the future.

In my case I’m going to use 172.16.10.105 /24.

Another important piece of the puzzle is the need to enter in our DNS servers and set our Hostname.

90% of time your DNS servers will be your Active Directory Domain Controllers.

Next we’re going to set our DNS suffix.  This is set to your domain name.

In my case, I’m setting the DNS suffix to thesysadminchannel.com

The initial configuration portion of your ESXi 5.5 host is now complete.  For our final step we’re going to go to our favorite browser and enter in the IP we set in the previous steps.  You will be presented with an unsafe connection,  no need to worry about this since we don’t have the SSL certificates installed.

If you see this screen, congratulations!! You have just installed ESXi as your bare metal hypervisor.

Video on How To Install and Configure ESXi 5.5

So whats the best way to learn VMWare? Practice Practice Practice!! If you want to learn more about virtualization, sure reading books is a definite boost in knowledge, but what really cements that learning is getting the hands on practice you need.

Start out by building a small home lab and installing it on your own. I have listed several eBay listings for Dell R710 and HP DL380 servers to give you that extra edge you’re looking for.

I hope this step by step guide on How to Install and Configure ESXi 5.5 has helped you.  If you have any question don’t hesitate to leave a comment and I’ll get back you!!

The post How To Install and Configure ESXi 5.5 – Step by Step Guide appeared first on the Sysadmin Channel.

Enable Remote Desktop via Group Policy

The biggest problem you could be potentially faced with, is actual permissions to modify any GPOs. I’m going to assume you have the permissions so we’ll just continue on with a bullet list that’s easy peasy for you to understand.

• Open up Group Policy Management Console (GPMC).
• Create a New Group Policy Object and name it Enable Remote Desktop.
• Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound Rules and Create a New Rule. Screenshot below.

• Select Port in the New Inbound Rule Wizard.
• Ensure TCP and Specific Local Port : 3389

• Allow the Connection and only select Domain and Private Profiles.
• Name this rule – Inbound Rule for RDP Port 3389

Now that we have added the local ports, we’ll need to enable the Remote Desktop Session Host policies.

• Go to Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections
•  Allow users to connect remotely by using Remote Desktop Services to Enable.

• Now we’re going to enable Network Level Authentication.  This is highly recommended and has many security advantages.  However, that’s out of the scope of this article so I won’t go in to the details now.
• Go to Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security
• Set Require user authentication for remote connections by using Network Level Authentication to Enable.

• Last but certainly not least, we need to apply the newly created GPO to an Organizational Unit so it actually works.
• Close out of GPMC.  There aren’t any more settings to configure.

Enable Remote Desktop using Group Policy (GPO) Video Demo

 
Last but certainly not least be sure to check out our YouTube Channel for awesome How-To’s and other Sysadmin related content.

The post How To Enable Remote Desktop Via Group Policy (GPO) appeared first on the Sysadmin Channel.