Differences

This shows you the differences between two versions of the page.

--- ladm [2026/06/01 10:24] – [5 Troubleshooting users and groups] kalaschnikow
+++ ladm [2026/06/10 10:56] (current) – [7 Managing organizational units] kalaschnikow
@@ Line 1: / Line 1: @@
+====== Learn Active Directory Management in a Month of Lunches ======
+A book by Richard Siddaway
+===== PART 1 MANAGING ACTIVE DIRECTORY DATA =====
+==== 1 Before you begin ====
+=== 1.1 AD core deliverables ===
+  * Active Directory provides a centralized service that links all machines in an organization and allows a user to log on and access any of them they have been granted permission to do so.
+== 1.1.1 Authentication ==
+  * Authentication, in AD terms, is the act of proving that you are who you say you are.
+  * You’re logging on to the domain, not an individual computer.
+  * Active Directory uses the Kerberos protocol for authentication.
+  * Time synchronization within your Active Directory is important because the time stamp is used during the authentication process.
+== 1.1.2 Authorization ==
+  * Authorization is the act of granting users appropriate access to resources—such as file shares, databases, applications, and mailboxes—once they’ve authenticated themselves to Active Directory. The concept of authorization is simply one of proving you have permission to do something.
+  * To simplify the process, when you log on a token is created on your local machine that contains your group memberships, privileges, and rights. This is presented to resources that you’re trying to access. The system will check the token to see if your permissions allow you access to the file or other resource, and either grant or deny access based on the data presented in your token.
+  * Important: access tokens are never transmitted across the network from one machine to another.
+  * Authentication and authorization are combined into the concept of identity management.
+== 1.1.3 AD definitions ==
+  * **FOREST**
+    * The //forest// is the whole of your Active Directory. It can //contain one or more domains arranged in trees// (that’s why it’s called a forest). The forest is named after the first domain created in the forest (known as the root domain, which can’t be changed).
+    * All domains in a forest share a **common Configuration container** and a **common schema**.
+    * The domains are linked together by **transitive trusts** that are automatically created when the domains are created.
+      * NOTE: Transitive means that if A trusts B and B trusts C, then A also trusts C.
+  * **DOMAIN**
+    * A domain is a container for the objects you’ll work with—users, computers, groups, and so on.
+    * The domain provides a number of __boundaries__ within the organization:
+      * It’s an //**administration boundary**//. Domain administrators don’t have permissions in other domains.
+      * It’s a **//security administration boundary//**. Permissions applied within the domain can’t affect objects outside the domain.
+      * It’s a //**policy application boundary**//. Best practice is to limit the application of Group Policy to a single domain. Applying policies across domains will slow processing and make administration much harder.
+    * A domain has a fully qualified Domain Name System (DNS) name as its unique identifier.
+    * Domains can be arranged in a hierarchy (trees) with parent-child relationships.
+      * But it has no administrative connotation. (An admin in parent domain is NOT an admin in child domain)
+  * **ORGANIZATIONAL UNIT**
+    * An organizational unit (OU) is a container within a domain that can be used to hold user, computer, group, and other OU objects.
+    * There are two main reasons to create an OU:
+      * 1 To control the delegation of administrative privileges (a certain group of administrators can only control the users, groups, and computers in a certain OU).
+      * 2 To control the application of Group Policy.
+  * Containers
+    * There are a number of these, but the ones you’re most likely to come across are
+      * Built-in, which stores a number of the default groups.
+      * ''Users'', which stores other default groups, especially the Domain Admins, Enterprise Admins, and Schema Admins. It’s also the default location for the creation of new users if a specific OU isn’t given.
+      * ''Computers'', which is empty when the domain is created but is the default location for the creation of computer accounts when a new machine is joined to the domain.
+    * The major differences between a container and an OU are that Group Policy cannot be applied to a container and child OUs can’t be created within a container.
+  * NOTE
+    * Think of the AD structures outlined in this section as analogous to a Russian nesting doll. Forests contain domains, which contain OUs, which contain users, groups, and computers.
+=== 1.2 Is this book for you? ===
+...
+=== 1.3 How to use this book ===
+...
+=== 1.4 Creating your lab environment ===
+...
+=== 1.5 Being immediately effective ===
+...
+==== 2 Creating user accounts ====
+Computer accounts are a specialized form of user account.  In most organizations they’re put into separate organizational units (OUs) to make the Group Policy Object (GPO) application simpler.
+**IDEA:** - make user groups to make administration of GPOs for our OUs simpler.
+  * User accounts:
+    * "general" user account
+    * group or other specialized mail boxes
+    * service accounts
+=== 2.1 Creating new user accounts ===
+  * A user account can be created using GUI tools or PowerShell.
+  * AD management tools which can create user
+    * AD Administration Center (ADAC)
+    * AD Users and Computers (ADUC)
+    * PowerShell
+== 2.1.1 Creating a new user with ADAC ==
+  * To create a new user, follow these steps:
+    * 1 Open ADAC and navigate to the Users container.
+    * 2 Choose New from the Tasks pane.
+    * 3 Choose User.
+    * 4 Complete dialog box.
+== 2.1.2 Creating a new user with ADUC ==
+  * Creating a user account with ADUC is a similar process to that experienced with ADUC:
+    * 1 Open ADUC.
+    * 2 Right-click the required container—I used the Users container again.
+    * 3 Choose New > User from the context menus.
+    * 4 A screen similar to figure 2.3 will be displayed—complete the fields.
+== 2.1.3 Creating a new user with PowerShell ==
+The following code can be used to create a new user:
+<code PowerShell>
+$secpass = Read-Host "Password" -AsSecureString
+New-ADUser -Name "GREEN Dave" -SamAccountName dgreen
+➥ -UserPrincipalName "dgreen@manticore.org" -AccountPassword $secpass
+➥ -Path "cn=Users,dc=Manticore,dc=org" -Enabled:$true
+</code>
+=== 2.2 User creation from a template ===
+One way to reduce the amount of work you need to perform and reduce the chance of an error occurring is to use a **template**. This is a fully configured account that’s copied to form a new account.
+  * The usual starting point is to create each new user account from scratch. This can be performed using GUI tools or PowerShell. One alternative, used in many organizations, is to use a template from which to create new user accounts. The template could be a standard user account or a specially created account that’s used only as a template.
+  * If you’re creating a single account from template you can use: ADUC or PowerShell. (ADAC has no possibility to copy accounts)
+  * Using PowerShell involves the –Instance parameter of New-ADUser, as follows:
+<code>
+$secpass = Read-Host "Password" -AsSecureString
+$user = Get-ADUser -Identity jgreen -Properties memberof, office
+New-ADUser -Name "GREEN Bill" -SamAccountName bgreen
+➥ -UserPrincipalName "bgreen@manticore.org"
+➥ -AccountPassword $secpass -Path "cn=Users,dc=Manticore,dc=org"
+➥ -Enabled:$true -Instance $user
+</code>
+  * BUT(!): This technique (using PowerShell to copy users from template) doesn’t copy group memberships or other multivalue attributes. I recommend using ADUC for copying accounts.
+=== 2.3 User creation in bulk ===
+  * Any administrative action that has to be repeated should be automated.
+<code PowerShell>
+$secpass = Read-Host "Password" -AsSecureString
+Import-Csv names.csv |
+foreach {
+$name = "$($_.LastName) $($_.FirstName)"
+New-ADUser -GivenName $($_.FirstName) -Surname $($_.LastName) `
+-Name $name -SamAccountName $($_.SamAccountName) `
+-UserPrincipalName "$($_.SamAccountName)@manticore.org" `
+-AccountPassword $secpass -Path "cn=Users,dc=Manticore,dc=org" `
+-Enabled:$true
+}
+</code>
+=== 2.4 Creating managed service accounts ===
+  * Managed service accounts are used to run services such as SQL Server, Exchange, and IIS on systems within your domain.
+  * The recommended approach is to use the ''New-ADServiceAccount'' PowerShell cmdlet.
+... (not really important for me at this time)
+=== 2.5 Lab ===
+... (not really important for me at this time)
+=== 2.6 Ideas for on your own ===
+  *  Create the process documentation for account creation, or revise previously existing documentation. This should include the way the business requests an account and how the communication of information is performed.
+==== 3 Managing user accounts ====
+User account management can be summed up as CRUD (create, read, update, delete).
+=== 3.1 Modifying user account properties ===
+  * The AD attributes you’ll need to modify fall into two broad groups—single value and multiple value.
+== 3.1.1 Using GUI tools to modify user accounts ==
+...
+== 3.1.2 Using PowerShell to modify user accounts ==
+  * Modifying a single value is a simple matter of replacing the value that’s currently present with a value that you supply:
+<code PowerShell>
+Set-ADUser -Identity "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org" `
+-OfficePhone "01234 567895"
+</code>
+  * Modifying a property containing multiple values:
+<code PowerShell>
+Set-ADUser -Identity "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org" -Replace @{otherTelephone="01234 567896","01234 567897"}
+</code>
+  * Modifying the additional phone numbers uses a slightly different approach. Use ''Set-ADUser'' again, but instead of the named parameter, use one of the generic parameters:
+    * ''Add'' - adds one or more values to a property
+    * ''Clear'' - clears all values of a property
+    * ''Remove'' - removes one or more values from a property
+    * ''Replace'' - replaces the values of a property with the values you supply
+  * When you use the ''Add'', ''Remove'', ''Replace'', and ''Clear'' parameters together, the operations will be performed in the following order:
+    * 1 ''Remove''
+    * 2 ''Add''
+    * 3 ''Replace''
+    * 4 ''Clear''
+== 3.1.3 Copying attributes from another account ==
+Copying attributes with GUI tools is a bit long-winded, and you’ll soon get bored if you have to do this for a number of users.
+A little bit of PowerShell can make your life much easier:
+<code PowerShell>
+$source = Get-ADUser -Identity bgreen -Properties OfficePhone, otherTelephone
+Set-ADUser -Identity "CN=GREEN Dave,CN=Users,DC=Manticore,DC=org"
+➥ -OfficePhone $($source.OfficePhone)
+➥ -Replace @{otherTelephone = $($source.otherTelephone)}
+</code>
+  * **TIP**: Notice that the samAccountName is used in Get-ADUser, but the distinguished name is used in Set-ADUser. Either can be used with the identity parameter (you’ll see both used throughout the book). Details of other attributes that can be used with the -Identity parameter are given in appendix A.
+=== 3.2 Enabling or disabling user accounts ===
+Disable with PowerShell:
+<code PowerShell>
+Disable-ADAccount -Identity dgreen
+</code>
+Enable with PowerShell:
+<code PowerShell>
+Enable-ADAccount -Identity dgreen
+</code>
+=== 3.3 Deleting user accounts ===
+  * With GUI Tools
+    * ... (usually something like: right click -> Delete)
+    * ...
+  * With PowerShell:
+<code PowerShell>
+Remove-ADUser -Identity dgreen -Confirm:$false
+</code>
+Leave off the ''-Confirm:$false'' if you want a message to force you to confirm the action. Not a bad idea with deletes!
+=== 3.4 Lab ===
+...
+=== 3.5 Ideas for on your own ===
+...
+==== 4 Managing groups ====
+  * **AD groups** are objects that act as containers for users, computers, and other groups. Groups are used to make the management of users easier, especially when it comes to granting permissions to access resources. ... For now, just remember that you should apply permissions to groups, not users.
+  * AD groups provide a way to make your day-to-day work more efficient. You allocate permissions to a group, and all of the users in the group get those permissions. You do the task once for the group instead of individually for the tens or hundreds of users in the group.
+  * Two **categories of groups**:
+    * security groups
+    * distribution lists
+  * These categories can span a number of **scopes**:
+    * Domain Local
+    * Global
+    * Universal.
+=== 4.1 Group types ===
+  * Groups can be split into //__two categories__//:
+    * **Security groups**
+      * The subject of this chapter; primarily used to assign permissions
+    * **Distribution lists**
+      * Used in Exchange to send emails to multiple recipients
+  * An AD group can have one of //__three scopes__//:
+    * **Domain Local**
+      * Membership from: any domain in forest
+      * Apply in: domain where it is
+      * Nestable in: local domain groups from same domain
+    * **Global**
+      * Membership from: domain in which it is
+      * Apply in: any domain in forest
+      * Nestable in:
+        * global groups from same domain
+        * any domain local or universal group
+    * **Universal**
+      * Membership from: any domain in the forest
+      * Apply in: any domain in the forest
+      * Nestable in: any domain local or universal group
+  * The official Microsoft way to use groups is shown in figure 4.1.
+    * User accounts (or computers or other allowed groups) are added to a Global group.
+    * Global groups are added to Domain Local groups,
+    * which are then added to Access Control Lists (ACLs). The ACLs control access and rights to resources such as shares, folders, files, and printers
+...
+=== 4.2 Group lifecycle ===
+  * AD groups have a very simple lifecycle:
+    * 1 Creation
+    * 2 Use and modification of membership
+    * 3 Deletion
+== 4.2.1 Creating groups ==
+  * You can create a group using the GUI tools or with PowerShell. You need the following information to create a group:
+    * 1 Container or OU where you’re creating the group
+    * 2 Group name
+    * 3 Group samAccountName
+      * Ensure you supply the samAccountName with non-Microsoft cmdlets or scripts, because Active Directory will create one for you if you don’t. The samAccountName will be random characters of the form ''$K46000PFVI6U20JC9D'', which isn’t easy to remember!
+  * CREATING A GROUP WITH ADAC
+    * ...
+  * CREATING A GROUP WITH ADUC
+    * ...
+  * CREATING A GROUP WITH POWERSHELL
+<code PowerShell>
+New-ADGroup -Name PStest -Path "CN=Users,DC=Manticore,DC=org"
+➥ -GroupCategory Security -GroupScope Global
+➥ -Description "Test group for AD Lunches"
+</code>
+  * The group cmdlets are used to manage the group lifecycle:
+    * ''New-ADGroup'' — creates a group
+    * ''Set-ADGroup'' — modifies group properties
+    * ''Remove-ADgroup'' — deletes a group
+    * ''Get-ADGroup'' — searches for groups
+  * A similar set of cmdlets is used to modify group membership:
+    * ''Add-ADGroupMember'' — Adds a member to a group
+    * ''Remove-ADGroupMember'' — Deletes a member from a group
+    * ''Get-ADGroup'' — Lists the members of a group
+== 4.2.2 Changing group scope ==
+  * Changing a group’s scope is slightly more complicated because there are a number of restrictions on the possible changes, as shown in table 4.3.
+    * ...
+  * A Universal group can be changed to a Global or Domain Local group, as shown in table 4.3. A Global group can’t be changed into a Domain Local group directly — it has to first be made into a Universal group. Changing from a Domain Local to a Global group also has to be via a Universal group.
+  * Change group scope with PowerShell:
+<code PowerShell>
+Set-ADGroup -Identity ADL-group1 -GroupScope Universal
+Set-ADGroup -Identity ADL-group3 -GroupScope Universal
+Set-ADGroup -Identity ADL-group3 -GroupScope DomainLocal
+</code>
+== 4.2.3 Deleting a group ==
+  * Deleting a group is a task you need to perform when the group is no longer required. In GUI tools, right-click the group and choose Delete.
+  * With PowerShell, use this code:
+<code PowerShell>
+Remove-ADGroup -Identity ADL-Test3 -Confirm:$false
+</code>
+  * NOTE Protect from Accidental Deletion will prevent deletion if it’s enabled. Remember to remove the protection before deletion.
+=== 4.3 Managing group membership ===
+== 4.3.1 Using GUI tools to manage group membership ==
+  * In GUI tools, the group membership dialog is accessed by right-clicking the group and choosing Properties.
+== 4.3.2 Using PowerShell to manage group membership ==
+<code PowerShell>
+Get-ADGroupMember -Identity ADL-group1 | select Name, DistinguishedName
+Add-ADGroupMember -Identity ADL-group1 -Members "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org"
+#  Remember, you can search for the user to add to the group:
+Add-ADGroupMember -Identity ADL-group1 -Members (Get-ADUser -LDAPFilter "(Name=Green Bill)")
+Remove-ADGroupMember -Identity ADL-group1 -Members bgreen -Confirm:$false
+</code>
+=== 4.4 Lab ===
+...
+== 4.4.1 Complete the TRY IT NOW sections ==
+== 4.4.2 Create six new groups ==
+== 4.4.3 Change group scope ==
+== 4.4.4 Add group members ==
+== 4.4.5 Remove a user from group ==
+== 4.4.6 Nest groups ==
+== 4.4.7 Delete user account ==
+== 4.4.8 Add computer account to group ==
+=== 4.5 Ideas for on your own ===
+  * In many organizations there isn’t a naming convention for groups—think about establishing one if your organization doesn’t have one.
+  * If your groups don’t have descriptions, think about adding them as you’re working with individual groups.
+  * Don’t sit and do all groups in one pass. Add them as you manage them.
+  * An activity that comes up from time to time is copying the group membership from one user to another. How could you do that?
+==== 5 Troubleshooting users and groups ====
+=== 5.1 Troubleshooting first steps ===
+  * AD-related problems for users usually come down to two things:
+    * They can’t log on.
+    * They can’t access a resource.
+  * Your working assumption is that there’s a problem with his account. You need to investigate his account. You could do that in a number of ways:
+    * Searches using the GUI tools (=> not really good)
+    * Manual inspection using the GUI tools (good if you know the user name of particular user)
+    * PowerShell scripts (most easier way)
+== 5.1.1 Step 1: Is the account disabled? ==
+  * This is indicated by a small downward-pointing arrow superimposed on the bottom right of the icon representing
+the user.
+  * Alternatively, use PowerShell:
+<code PowerShell>
+# This code will display a list of disabled accounts.
+Search-ADAccount -AccountDisabled | select Name, samAccountName
+# If your user is in the list, enable the account like this:
+Get-ADUser -Identity dgreen | Enable-ADAccount
+</code>
+== 5.1.2 Step 2: Check account status ==
+  * ... (Check account status using ADAC) ...
+  * ... (Check account status using ADUC) ...
+== 5.1.3 Step 3: Has the account expired? ==
+  * ADUC supplies a date picker popup, but ADAC expects you to type in the date.
+  * PowerShell can be used to search for expired accounts, as follows:
+<code PowerShell>
+Search-ADAccount -AccountExpired | Format-Table Name, SamAccountName, DistinguishedName, AccountExpirationDate -AutoSize
+</code>
+  * Once you’ve identified the expired account, a new date can be set like this:
+<code PowerShell>
+Get-ADUser -Identity dgreen | Set-ADAccountExpiration -DateTime (Get-Date).AddDays(30)
+# Alternatively, you could set a specific date using code like this:
+Get-ADUser -Identity dgreen | Set-ADAccountExpiration -DateTime ([datetime]'11/25/2013')
+# WARNING: If you use this technique, the date must be presented as month/day/year.
+</code>
+  * Remove the expiry date entirely:
+<code PowerShell>
+Get-ADUser -Identity dgreen | Clear-ADAccountExpiration
+</code>
+=== 5.2 Password expiry ===
+  * AD passwords need to be changed every 42 days by default.
+  * Neither of the GUI tools supply a direct way to see if the password has expired.
+  * The Search-ADAccount cmdlet can provide information on accounts with expired passwords:
+<code PowerShell>
+Search-ADAccount -PasswordExpired
+</code>
+=== 5.3 Password reset ===
+  * Passwort reset with GUI tools
+    * ...
+  * Performing a password reset in PowerShell is a bit more difficult:
+<code PowerShell>
+$password = Read-Host -Prompt "Password" -AsSecureString
+$id = "dgreen"
+Set-ADAccountPassword -Identity $id -NewPassword $password -Reset
+Set-ADUser -Identity $id -ChangePasswordAtLogon:$true
+</code>
+=== 5.4 Unlocking a user account ===
+  * If you open ADAC and look at the properties of the user, you’ll see the padlock symbol. ADUC shows at "Account" Tab a check box named as "Unlock account".
+  * PowerShell
+    * cmdlet to find locked accounts: ''Search-ADAccount -LockedOut''
+    * to unlock: ''Search-ADAccount -LockedOut | Unlock-ADAccount''
+=== 5.5 Group membership ===
+  * Groups are used to give access to resources such as file shares and applications. You’ll get calls such as “I can’t access file share X.” That usually means the user isn’t in the right group.
+<code PowerShell>
+$target = Get-ADUser -Identity mgreen -Properties memberof
+foreach ($member in $target.memberof){
+  Remove-ADGroupMember -Identity $member -Members $target -Confirm:$false
+}
+$source = Get-ADUser -Identity dgreen -Properties memberof
+foreach ($member in $source.memberof){
+  Add-ADGroupMember -Identity $member -Members $target -Confirm:$false
+}
+</code>
+=== 5.6 Lab ===
+== 5.6.1 Complete any TRY IT NOW sections ==
+...
+== 5.6.2 Account expiry ==
+...
+== 5.6.3 Account lockout ==
+...
+== 5.6.4 Disable an account ==
+...
+=== 5.7 Ideas for on your own ===
+  * check what can be made better in your organization
+==== 6 Managing computer accounts ====
+  * ...
+  * The computer needs to join the domain, which may happen with a preexisting account, or the account can be created as the machine joins the domain.
+  * ...
+=== 6.1 Creating an AD computer account ===
+== 6.1.1 Creating a computer account using ADAC ==
+  * Computers container is the default location for computer accounts, but you can create an account in any OU.
+  * ...
+== 6.1.2 Creating a computer account using ADUC ==
+  * ...
+== 6.1.3 Creating a computer account using PowerShell ==
+  * ADAC is built on top of PowerShell.
+    * Note: The Windows PowerShell History window is normally minimized. You open it by clicking on the upward-pointing arrow at the bottom-right corner of the ADAC GUI.
+  * The code that ADAC generates can be overly verbose. A simplified version would be:
+<code PowerShell>
+New-ADComputer -Enabled $true -Name ADLComp3 `
+-Path "CN=Computers,DC=Manticore,DC=org" `
+-SamAccountName ADLCOMP3
+</code>
+  * The other way to generate a computer account is to create one as the system joins the domain.
+=== 6.2 Joining a computer to the domain ===
+  * A number of prerequisites needs to be in place before you can join the computer to the domain:
+    * The machine should be configured with the address of at least one DNS server that manages the DNS zone for your Active Directory.
+    * You need local administrator permissions on the machine.
+    * You need the account name and password of a user account that has permissions to join the machine to the domain.
+    * Ideally, the machine should have been renamed to the name you want it to have in Active Directory.
+== 6.2.1 Using GUI tools to join a machine to the domain ==
+  * That can be done using Control Panel on the computer (which should join the domain). The computer account will be created in the default location, usually the Computers container.
+== 6.2.2 Using PowerShell to join a machine to the domain ==
+  * The following code can be used to join a machine to the domain:
+<code PowerShell>
+$cred = Get-Credential
+Add-Computer -Credential $cred -DomainName Manticore `
+-OUPath "OU=Security Servers,OU=Servers,DC=Manticore,DC=org" -Force
+Restart-Computer
+</code>
+  * NOTE: this code should be executed on the machine, which should join the domain.
+=== 6.3 Managing the secure channel ===
+  * All computers (Windows 2000 and later) in an AD domain communicate with a domain controller. They authenticate over that channel every time the machine is restarted.
+  * A password is used to authenticate the machine. This password is automatically reset every 30 days—you don’t have to do anything, it just happens. The secure channel is a robust mechanism and usually doesn’t go wrong.
+  * A simpler approach to test secure channel is to use the PowerShell that the secure channel is the cause of the problem is the ''Test-ComputerSecure-Channel'' cmdlet.
+  * You can test and fix in one go:
+<code PowerShell>
+if (-not(Test-ComputerSecureChannel)){
+  Test-ComputerSecureChannel -Repair –Verbose
+}
+</code>
+=== 6.4 Deleting a computer account ===
+  * You can run the following PowerShell snippet to discover inactive (haven’t logged on to the domain) computer accounts:
+<code PowerShell>
+Search-ADAccount -AccountInactive -ComputersOnly | Format-Table Name, DistinguishedName, LastLogonDate, ObjectClass -Autosize
+</code>
+  * This script has some drawbacks:
+    * ...
+  * Better version (search for computer accounts that have been inactive for 90 days):
+<code PowerShell>
+Search-ADAccount -AccountInactive -ComputersOnly -TimeSpan "90:00:00"|
+where ObjectClass -eq "Computer" |
+Format-Table Name, DistinguishedName, LastLogonDate, ObjectClass -Autosize
+</code>
+  * ...
+  * In a situation where you have many objects to delete, this can be achieved using a PowerShell script:
+<code PowerShell>
+Import-Csv -Path C:\Scripts\ADLunches\computersTodelete.txt |
+foreach {
+Remove-ADComputer -Identity $_.Name -Confirm:$false
+}
+</code>
+=== 6.5 Lab ===
+== 6.5.1 Create computer accounts ==
+...
+== 6.5.2 Create computer accounts in bulk ==
+...
+== 6.5.3 Searching for computer accounts ==
+...
+== 6.5.4 Managing the secure channel ==
+...
+== 6.5.5 Deleting computer accounts ==
+...
+=== 6.6 Ideas for on your own ===
+   * Use the scripts in this chapter to create a mechanism for removing expired accounts. Hint: make it a two-stage process to find the expired accounts and examine them to determine which to delete. Then perform the deletion.
+   * Create a process for the bulk creation of computer accounts.
+   * Create a script that tests the service-pack level of your computers. You can then proactively start reporting which machines need to be service packed.
+==== 7 Managing organizational units ====
+=== 7.1 OU concepts ===
+  * An OU is a container within a domain that can be used to hold user, computer, group, and other OU objects.
+  * Two main reasons to create an OU:
+    * To control the delegation of administrative privileges—that is, a certain group of administrators can only control the users, groups, and computers in a certain OU
+    * To control the application of Group Policy
+   * OUs can’t be assigned permissions, so you can’t use them in place of groups.
+   * In your Active Directory you’ll also find objects called containers that are created with the domain. There are a number of these, but the ones you’re most likely to come across are:
+     * **Builtin**, which stores a number of the default groups.
+     * **Users**, which stores other default groups, especially the Domain Admins, Enterprise Admins, and Schema Admins. It’s also the default location for the creation of new users if a specific OU isn’t given.
+     * **Computers**, which is empty when the domain is created, but is the default location for the creation of computer accounts when a new machine is joined to the domain.
+  * The major differences between a container and an OU are:
+    * that Group Policy cannot be applied to a container
+    * and that child OUs can’t be created within a container.
+  * OUs hirarchy can be "too deep", because too many GPOs can make problems (e.g. longer log on process for users etc). So keep maximum depth under 6 or so.
+=== 7.2 Creating an OU with the GUI tools ===
+== 7.2.1. Creating an OU with ADAC ==
+== 7.2.2 Creating an OU with ADUC ==
+=== 7.3 Creating an OU with PowerShell ===
+=== 7.4 Protecting OUs from accidental deletion ===
+=== 7.5 Managing OUs ===
+Renaming an OU 84 ■ Adding a description to the OU 84
+Changing the Managed By setting 85 ■ Deleting an OU 86
+xii CONTENTS
+=== 7.6 Moving objects between OUs ===
+=== 7.7 Lab ===
+Creating OUs 88 ■ Renaming OUs 88 ■ Setting
+descriptions and Managed By 89 ■ Moving objects between
+OUs 89 ■ Deleting an OU 90
+=== 7.8 Ideas for on your own ===
+===== PART 2 MANAGING GROUP POLICY =====
+==== 8 Creating Group Policies ====
+==== 9 Managing Group Policies ====
+==== 10 Fine-grained password policies ====
+===== PART 3 MANAGING THE ACTIVE DIRECTORY SERVICE =====
+==== 11 Creating domain controllers ====
+==== 12 Managing domain controllers ====
+==== 13 Protecting AD data ====
+==== 14 Security: Default groups and delegation ====
+==== 15 Managing DNS ====
+==== 16 Managing sites and subnets ====
+==== 17 AD replication ====
+==== 18 Managing AD trusts ====
+===== PART 4 MAINTENANCE AND TROUBLESHOOTING =====
+==== 19 Troubleshooting your AD ====
+==== 20 Maintaining and monitoring Active Directory ====
+==== 21 Future work and final exam ====
+==== 22 Into the cloud ====
+===== MY NOTES =====
+  * 2.2 User creation from template
+    * use templates to create users can be a good idea
+  * 5.5 Group membership
+    * it is possible to get/set groups using PowerShell script
+      * Q: is it really good to do it in our case?
+      * Q: if it is good in our case, maybe it will be good to define groups not directly in script, but to get them from a "template user"?