EmailRSS

Monthly Archives: January 2018

A Year with Adaxes – Web Consoles and Self-Service

Posted on by

Welcome back to our year with Adaxes series! In this part, we are going to explore two key features that I personally love. First, we will look at the web consoles available in Adaxes and how you can customize them for your environment. These web based tools have the ability to replace Active Directory Users and Computer (ADUC) as well Active Directory Administrative Center (ADAC). We will then look at the self-service tools available for online and offline use. These tools automate away most of the routine object work that you are probably already doing in AD. Specifically, they can eliminate attribute changes, group membership changes, and password resets.

Using Web Consoles to Manage Active Directory 

In the earlier articles of this series, we quickly mentioned the different management methods that Adaxes allows. Along with an expanded local administration console, three web interfaces are available after initial installation. To make access a bit easier, I actually took the shortcut files provided in the install and deployed those with Group Policy.

Of the two management web consoles, the Administrators version is most similar to ADAC/ADUC. The Help Desk version is a good starting point for HR (or in our case, media specialist use). In larger organizations, it would make a great tool for tier 1 helpdesk. Both can include the familiar and navigable AD tree of OUs. These console excels by bringing common tasks to the forefront. Think about easy ADAC made resetting passwords by including that tool on the start page. Now think about how easy other tasks could be if you had a simple button available at the very beginning. In the screenshot below, you can see our administrators console with common tasks brought to the homepage.

The three consoles are really well thought out. If you need to change them, it is very simple to create a copy and to edit the new page. A few years ago, one of my favorite tools was a modified ADUC MMC with a bunch of scripts builtin to the side pane.  The Administrators web console, which I spend most of my time in, is a more powerful version of that modified MMC. It is also a lot easier to manage and scale out. You can see some of these customization in the console above. For example, we often prestage computer accounts in AD before imaging them and have added the Create Computer button directly to the homepage.

Continue reading →

Delete Unused Home Folders with PowerShell

Posted on by

I have a bit of an efficiency obsession! Power bills, navigation, and drive space are a few of my focuses. As this is a tech blog, I won’t tell you what to set your heat on in the winter (58) or the quickest way to the line of totality in 2024 (yes, I’m counting down). I will tell you that you should automatically be decommissioning old user accounts and the personal content that they created.

We have covered the first part before. It is fairly easy to add a remove-object line to any decommissioning scripts that you use. In an existing environment, you may have a lot of home folders that have been orphaned. These folders sit on a share but they do not have a corresponding user account attached to them. To fix that, we can use the script below to compare folder names on a home folder/folder redirection share against AD user accounts. If the account does not exist, we can remove the folder (or move it to an offline location).

#This should point to the root of a home folder/FR share. Subfolders in this folder match AD account usernames. 
$Folders = get-childitem \\SERVER\SHARE\FOLDER\

$NamesToIgnore = "Jmoody"


$FoldersToBeRemoved = @()
foreach ($Folder in $Folders){
    $Username = $Folder.Name

    if ($NamesToIgnore -notcontains $Username){

        $UsernameCheck = Get-ADUser -Identity $Username  -Properties * -ErrorAction SilentlyContinue
        if ($? -eq $false -and $Username -notlike $NamesToIgnore){
            
            $FoldersInformation = @{"Folder Name"=$Username;"Folder Path"=$Folder.FullName;"Last Write Time"=$Folder.LastWriteTime}
            $FoldersToBeRemoved += New-Object -TypeName psobject -Property $FoldersInformation
            

            Write-Host $Username
            pause
            Remove-Item $Folder.FullName -Recurse -Force -Verbose -WhatIf
        }
    }
}

$FoldersToBeRemoved | Out-GridView

This script does have a few safety features. First, it will allow you to mark out some folder names (in case you have shared FR folders). Second, it will display the home folder that will be deleted and prompt you to continue the script. Finally, the remove-item line contains a -whatif parameter. Once you are comfortable with this script and have a valid backup, remove the -whatif parameter. When you run this script, you will see errors from Get-ADUser when it can’t find a user account. I left these errors visible as I wanted to see the search being performed.

Enjoy the efficiency!