Richard Siddaway's Blog

Archive for the ‘Active Directory’ Category

Manning Deal of the Day 19 July 2016

without comments

Deal of the Day July 19: Half off my book Learn Active Directory Management in a Month of Lunches. Use code dotd071916au at


For more information on Manning’s Deal of the Day see -

Written by richardsiddaway

July 18th, 2016 at 10:50 am

Time to stock up your book collection?

without comments

Manning are offering 40% off everything – print & ebooks – They have a very extensive set of PowerShell books – now would be the time to add to your collection

Written by richardsiddaway

July 12th, 2014 at 5:26 am

Rename a user account to the display name

without comments

I had a question left on my blog about renaming all of the user accounts in an OU had their name changed to match the display name.  I started by creating a few dummy accounts:

PS s> Get-ADUser -Filter * -SearchBase "OU=Test,DC=Sphinx,DC=org"  -Properties DisplayName | Format-Table DisplayName, Name -AutoSize

DisplayName Name
———– —-
Green Fred  Fred Green
Green Jo    Jo Green
Green Dave  Dave Green


In the case of the first account the goal is to change the Name to match the display name.

One thing to be aware of with AD names – NEVER, NEVER, NEVER and I mean NEVER use a comma between the first and last parts of the name.


CN=Fred Green,OU=Test,DC=sphinx,DC=org

is good

CN=Green Fred,OU=Test,DC=sphinx,DC=org

is good

CN=Green, Fred,OU=Test,DC=sphinx,DC=org


The reason is that the comma is a delimiter between the parts of the distinguished name. LDAP doesn’t expect a comma between parts of an element so it errors.  You have to escape the comma so its treated as a literal character. I can guarantee that you will forget. Been there, done that & designed the T-Shirt.


Don’t use commas – its fair simpler and you’ll have less errors.


The only option to rename an object is to use Rename-ADObject

PS > Get-ADUser -Filter * -SearchBase "OU=Test,DC=Sphinx,DC=org"  -Properties DisplayName | foreach {Rename-ADObject -Identity $_.DistinguishedName -NewName $_.Displayname -PassThru}


You’ll get a display showing the new names.

If you want to check run the original test

PS > Get-ADUser -Filter * -SearchBase "OU=Test,DC=Sphinx,DC=org"  -Properties DisplayName | Format-Table DisplayName, Name -AutoSize

DisplayName Name
———– —-
Green Fred  Green Fred
Green Jo    Green Jo
Green Dave  Green Dave


Job done

Written by richardsiddaway

June 11th, 2014 at 3:20 pm

Learn Active Directory Management in a MoL on offer

without comments

Learn Active Directory Management in a MoL is 43% off through April 3, 2014 with code pbradm at

Written by richardsiddaway

March 16th, 2014 at 6:36 am

Automatically create folder for home drive

without comments

In this post

I showed how to modify the user’s home folder setting in Active Directory.

A comment was recently left asking about automatically creating the folder on the fileserver and creating the share that is associated with it.

This isn’t a simple exercise – you will need a script to:

You can create the folder using New-Item

New-Item -Path c:\test -Name anyolduser -Type Directory

You can share it

$max = [uint32]5

$type = [uint32]0

Invoke-CimMethod -ClassName Win32_Share -MethodName Create -Arguments @{Name=’anyolduser’; Path=’c:\test\anyolduser’;
Type=$type; MaximumAllowed=$max; Description=’anyolduser – homedrive’}

And then you have to set share and NTFS permissions according to your organization’s policies

Written by richardsiddaway

February 28th, 2014 at 2:34 pm

Learn AD Management in a Month of Lunches–ebook available

with 2 comments

The ebook – PDF format – for Learn AD Management in a Month of Lunches has been published –

If you bought the ebook as part of your MEAP you should be able to down load it – you’ll get or have got an email with the link. The printed version is at the printers and will be available on 12 March.

If you want the ebook in Kindle or epub versiosn they will be available 20 March.


Written by richardsiddaway

February 27th, 2014 at 2:20 pm

LastLogoff timestamp

without comments

I was recently asked if there was any way to fill in the LastLogoff timestamp


The short answer is no.  The values in the attributes related to logons are maintained by Active Directory during the logon process.


I wouldn’t want them to be programmable as that as would create a potential loop hole in my logging process.


As far as I can tell LastLogoff isn’t currently used in Active Directory though if you have access to the Exchange cmdlets you could use Get-mailboxStatistics to discover logon and loggoff times to the mailbox which would be close

Written by richardsiddaway

December 23rd, 2013 at 10:03 am

Posted in Active Directory

A new version of ADMT

without comments

A new version of the AD Migration Tool (ADMT) has been announced –

While not ready for download just yet at least we know its in the pipeline and supports the newer versions of Windows

Written by richardsiddaway

December 16th, 2013 at 2:30 pm

Posted in Active Directory

Final MEAP for AD Lunches

without comments

The final MEAP for AD Management in a Month of Lunches has been released. The book is on a half price offer today so still time for a Christmas bargain if you’re quick

Written by richardsiddaway

December 11th, 2013 at 1:57 pm

December 11–Deal of the Day AD Month of Lunches

without comments

Deal of the Day December 11:

Half off my book Learn Active Directory Management in a Month of Lunches.

Use code dotd1211au at


Also available:

Learn SQL Server Administration in a Month of Lunches (

Learn SCCM 2012 in a Month of Lunches (

Written by richardsiddaway

December 10th, 2013 at 8:46 am