Active Directory Cleaner User Guide 1. Active Directory Cleaner User Guide

Transcription

1 Active Directory Cleaner User Guide 1 Active Directory Cleaner User Guide

2 Active Directory Cleaner User Guide 2 Table of Contents 1 Introduction Benefits of Active Directory Cleaner Features Categories Actions on Users Report Actions on Computer Reports Report Generation Active Directory User Reports General Reports All Users Users With Empty Attributes Users without Managers Users in more than One Group Recently Created Users Recently Modified Users Dial-in Deny Access Users with Logon Script Users without Logon Script All Deleted Users Recently Deleted Users Account Status Report Disabled Users Locked Out Users Account Expired Users Recently Account Expired Users Logon Reports Inactive Users Recently Logged on Users Users Never Logged On Enabled Users Password Reports Recently Bad Logged on Users Users whose Password Never Expires Password Expired Users Soon-to-Expire User Passwords Password Changed Users Password Unchanged Users Active Directory Computer Reports General Reports All Computers Workstations Domain Controllers OS Based Computers Trusted for Delegation Recently Modified Computers Managed Computers Unmanaged Computers All Deleted Computers Recently Deleted Computers Account Status Reports Inactive Computers Disabled Computers...12

3 Active Directory Cleaner User Guide 3 1 Introduction Active Directory Cleaner (ADC) is a simple tool used for maintaining your AD clean and secure. ADC enables IT organizations to extract vital data from Active Directory in seconds after installation. Armed with this information, organizations can quickly make strategic and tactical security decisions that involve their Active Directory and Windows environment. Active Directory Cleaner retrieves and reports information efficiently from the active directory while hiding the complexities of the native Active Directory tools. 2 Benefits of Active Directory Cleaner Active Directory Cleaner allows an administrator to accurately retrieve required information about Active Directory Infrastructure and Objects quickly and displays it in a clear and logical format. Active Directory Cleaner s interface accurately extracts data, saving time involved in troubleshooting, controlling and managing attributes of the active directory objects such as: Users Computers 3 Features Search Helps to locate a specific Active Directory Object quickly and accurately. Actions Helps to do actions like delete, restore, move, disable, enable and reset objects in bulk. Restore User can restore the deleted user and computers in the active directory. Add/Remove Columns Helps to customize the displayed columns. Scope This view generation can be limited to Organizational Units (OU) in a domain, facilitating an OU based administration. Sort Users can sort the columns of their interest. Export Reports Reports can be exported to PDF, CSV and Excel formats. 4 Categories Active Directory Cleaner s has the following categories Active Directory Users Active Directory Computers

4 Active Directory Cleaner User Guide 4 5 Actions on Users Report Once the list of users generated based on a criteria, user can perform the following actions on the user objects Enable Disable Delete Restore Move Reset Unlock 6 Actions on Computer Reports Once the list of computers generated based on a criteria, user can perform the following actions on the computer objects Enable Disable Delete Restore Move 7 Report Generation This section lists the reports available in each of the categories. And provide the filter used and PowerShell command for each of the report category. 7.1 Active Directory User Reports General Reports All Users It provides the details of all the users in the selected scope. (&(objectcategory=person)(objectclass=user)(!samaccounttype= )) Users With Empty Attributes It provides the list of users whose specified attributes are empty. User can either check against all the specified attributes as empty or even one of the specified attribute.

5 Active Directory Cleaner User Guide 5 "(&(objectcategory=person)(objectclass=user)(&(!attribute1=*)(!attribute2=*)))" The above filter is used to check against all the specified attributes as empty. "(&(objectcategory=person)(objectclass=user)( (!attribute1=*)(!attribute2=*)))" The above filter is used to check even one of the specified attributes as empty Users without Managers It provides the list of users who do not have any managers assigned to them. (! manager=*))" Manager Based Users It provides the list of users that directly report to the selected user (Manager). The users listed in report are those who have the manager property set to this selected user. "(& (objectcategory=person)(objectclass=user)(!samaccounttype= ) (manager=managerdn))" Users in more than One Group It provides the details of users who belong to more than one group. (memberof=*))" Recently Created Users It provides the details of the user accounts created recently. (createtimestamp>=giventime))" Recently Modified Users This report generates the lists of user accounts modified recently. (modifytimestamp>=giventime))"

6 Active Directory Cleaner User Guide Dial-in Allow Access This report generates the list of users who have access to dial-in. (msnpallowdialin=true))" Dial-in Deny Access This report generates the list of users who don t have access to dial-in. ( (msnpallowdialin=false)(!msnpallowdialin=*)))" Users with Logon Script This report generates the list of users who have logon scripts. Logon scripts are those which run automatically when the user logon. (scriptpath=*))" Users without Logon Script This report generates the list of users who don t have logon scripts. Logon scripts are those which run automatically when the user logon. (! scriptpath=*))" All Deleted Users This report generates the list of all deleted users in the domain. "(&(objectclass=user)(!objectclass=computer)(isdeleted=true))" Recently Deleted Users This report generates the list of all user account deleted recently in the domain. "(&(objectclass=user)(!objectclass=computer)(isdeleted=true) (whenchanged>=giventime))"

7 Active Directory Cleaner User Guide Account Status Report Disabled Users This report generates the list of all disabled user accounts. (useraccountcontrol: :=2))" Locked Out Users This report generates the list of all user accounts that have been locked out. (lockouttime>=1))" Account Expired Users This report generates the list of all user accounts that have expired. (! accountexpires=0)(!accountexpires= ) (accountexpires<=currenttime))" Recently Account Expired Users This report generates the list of all user accounts that have expired in the given number of days. (! accountexpires=0)(!accountexpires= )(accountexpires<=currenttime) (accountexpires>=giventime))" Soon-to-Expire User Accounts This report generates the list of all user accounts that will expire within the given number of days. (! accountexpires=0)(!accountexpires= )(! accountexpires<=currenttime)(accountexpires<=giventime))" Account Never Expire Users This report generates the list of all user accounts which will never expire.

8 Active Directory Cleaner User Guide 8 ( (accountexpires=0)(accountexpires= )))" Logon Reports Inactive Users This report generates the list of all users who have not logged on for the past 'n' days. The inactive users are determined based on their last logon time. All the domain controllers are scanned for the last logon time to ensure accuracy. If any of the DC's could not be contacted while report generation, the report generation will fail. ( (! lastlogon=*)(lastlogon<=giventime)))" Recently Logged on Users This report generates the list of all users who have logged during the past 'n' days. The recently logged on users are determined based on their last logon time. All the domain controllers are scanned for the last logon time to ensure accuracy. If any of the DC's could not be contacted while report generation, the report generation will fail. (lastlogon>=giventime)) Users Never Logged On This report generates the list of all users who have not logged on to the domain. The Users never logged on are determined based on their last logon time. All the domain controllers are scanned for the last logon time to ensure accuracy. If any of the DC's could not be contacted while report generation, the report generation will fail. ( (lastlogon=0)(!lastlogon=*)))" Enabled Users This report generates the list of all enabled user accounts. 13 (!user AccountControl: :=2))" PowerShell Command: Export-ADReport -Type EnabledUsers -FilePath "C:\Reports\EnabledUsers.pdf"

9 Active Directory Cleaner User Guide Password Reports Recently Bad Logged on Users This report generates the list of all users who tried to logon with bad password. (badpasswordtime>=giventime))" Users whose Password Never Expires This report generates the list of all users whose password never expires. (useraccountcontrol: :=65536))" Password Expired Users This report generates the list of all users whose passwords are expired. "(&(objectcategory=person)(objectclass=user)(!(samaccounttype= ))(! useraccountcontrol: :=65536)(!pwdlastset=0)(pwdlastset<=time based on maximum password age))" Soon-to-Expire User Passwords This report generates the list of all users whose passwords will expire in n days. "(&(objectcategory=person)(objectclass=user)(!(samaccounttype= ))(! useraccountcontrol: :=65536)(!pwdlastset<={0})(pwdlastset< =time based on maximum password age and the given time))" Password Changed Users This report generates the list of all users whose passwords are modified during the given n days (! pwdlastset=0)(!pwdlastset<=giventime))"

10 Active Directory Cleaner User Guide Password Unchanged Users This report generates the list of all users whose passwords are not modified during the given n days (! pwdlastset=0)(!pwdlastset>=giventime))" 7.2Active Directory Computer Reports General Reports All Computers This report generates the list of all computers within the selected scope. "(&(objectcategory=computer)(objectclass=computer))" Workstations This report generates the list of all workstations within the selected scope. Workstations are all computers except Servers and Domain Controllers. The report is generated by querying the Directory Service for all computers with useraccountcontrol=ads_uf_workstation_trust_account. The filter is "(&(objectcategory=computer)(objectclass=computer)(useraccountcontrol: :=4096))" Domain Controllers This report generates the list of all Domain Controllers within the selected scope. The report is generated by querying the Directory Service for all computers with useraccountcontrol=ads_uf_server_trust_account. The filter is "(&(objectcategory=computer)(objectclass=computer)(useraccountcontrol: :=8192))" OS Based This report provides the details of the computers based on the given Operating System type. The report is generated by querying the Directory Service for all computers with the attributes operatingsystem and operatingsystemservicepack.

11 Active Directory Cleaner User Guide Computers Trusted for Delegation This report generates the list of all computers that are trusted for delegation. The report is generated by querying the Directory Service for all computers with useraccountcontrol=ads_uf_trusted_for_delegation. The filter is "(&(objectcategory=computer)(objectclass=computer)(useraccountcontrol: :=524288))" Recently Modified Computers This report generates the list of all computers that are modified recently. "(&(objectcategory=computer)(objectclass=computer)(modifytimestamp>=giventime ))" Managed Computers This report generates the list of all computers that are managed by any of the user. "(&(objectcategory=computer)(objectclass=computer)(managedby=*))" Unmanaged Computers This report generates the list of all computers that are not managed by any of the user. "(&(objectcategory=computer)(objectclass=computer)(!managedby=*))" All Deleted Computers This report generates the list of all deleted computers. "(&(objectclass=computer)(isdeleted=true))" Recently Deleted Computers This report generates the list of all computers which are deleted during the last n days. "(&(objectclass=computer)(isdeleted=true)(whenchanged>=giventime))"

12 Active Directory Cleaner User Guide Account Status Reports Inactive Computers This report generates the details of the inactive computers for the given number of days. The inactive computers are determined based on their last logon time. All the domain controllers are scanned for the last logon time to ensure accuracy. If any of the DC's could not be contacted while generating report, the report generation will fail. "(&(objectcategory=computer)(objectclass=computer)( (!lastlogon=*)(lastlogon< =giventime)))" Disabled Computers This report generates the list of all computers that are disabled. The report is generated by querying the Directory Service for all computers with useraccountcontrol= ADS_UF_ACCOUNTDISABLE. The filter is "(&(objectcategory=computer)(objectclass=computer)(useraccountcontrol: :=2))"