Active Directory « BrakertechBrakertech

active directory cheatsheet

posted this in Active Directory, Windows on December 28th, 2012

Active Directory Cheat Sheet

This page contains my Active Directory Cheat Sheet. A list of collected one liners and vb scripts. Enjoy and feel free to add some yourself via comments!

Active Directory One Liners

This isn’t so much a script as an awesome way to reset an active directory user’s password.

How to Reset . . . → Read More: active directory cheatsheet

Apache Active Directory Authentication howto

posted this in Active Directory, Redhat Centos on July 16th, 2012

Apache Active Directory Authentication howto

Modules Needed

mod_authz_ldap

Install mod_authz_ldap

yum install mod_authz_ldap

1	yum install mod_authz_ldap

Verify Apache Config has Needed Modules

LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so

LoadModule auth_basic_module modules/mod_auth_basic.so

LoadModule authz_host_module modules/mod_authz_host.so

LoadModule authz_user_module modules/mod_authz_user.so

LoadModule authz_owner_module modules/mod_authz_owner.so

LoadModule authz_groupfile_module modules/mod_authz_groupfile.so

LoadModule authz_dbm_module modules/mod_authz_dbm.so

LoadModule authz_default_module modules/mod_authz_default.so

Apache Group LDAP Configuration (Active Directory Group Level Auth)

        AuthBasicProvider ldap 
	AuthzLDAPAuthoritative On
	AuthLDAPURL ldap://10.128.28.3:3268/dc=xx,dc=com?sAMAccountName
	AuthLDAPBindDN cn=anonbinduser,dc=xx,dc=com
	AuthLDAPBindPassword secret
	AuthType Basic
	AuthName "Authorization required"
	require ldap-group cn=elite,ou=xx,dc=xx,dc=com
	AuthzLDAPLogLevel debug

AuthBasicProvider ldap

AuthzLDAPAuthoritative On

AuthLDAPURL ldap://10.128.28.3:3268/dc=xx,dc=com?sAMAccountName

AuthLDAPBindDN cn=anonbinduser,dc=xx,dc=com

AuthLDAPBindPassword secret

AuthType Basic

AuthName "Authorization required"

require ldap-group cn=elite,ou=xx,dc=xx,dc=com

AuthzLDAPLogLevel debug

Apache OU LDAP Configuration (Alternative OU Level Configuration)

      AuthName "Authorized Access Only"
      AuthType Basic
      AuthzLDAPMethod ldap
      AuthzLDAPServer 10.0.0.0:389
      AuthzLDAPBindDN "cn=anonbinduser,dc=xx,dc=com"
      AuthzLDAPBindPassword secret
      AuthzLDAPUserBase "OU=someOUwithUsersToAuthenticateAgainst,OU=xx,DC=xx,DC=com"
      AuthzLDAPUserKey sAMAccountName
      AuthzLDAPUserScope subtree

      require valid-user
      AuthzLDAPLogLevel debug

AuthName "Authorized Access Only"

AuthType Basic

AuthzLDAPMethod ldap

AuthzLDAPServer 10.0.0.0:389

AuthzLDAPBindDN "cn=anonbinduser,dc=xx,dc=com"

AuthzLDAPBindPassword secret

AuthzLDAPUserBase "OU=someOUwithUsersToAuthenticateAgainst,OU=xx,DC=xx,DC=com"

AuthzLDAPUserKey sAMAccountName

AuthzLDAPUserScope subtree

require valid-user

AuthzLDAPLogLevel debug

Reset Active Directory Password Script

posted this in Active Directory, Windows on May 14th, 2012

This isn’t so much a script as an awesome way to reset an active directory user’s password.

Requirements You must have admin rights to domain controller psexec How to Reset Active Directory User’s Password from Command Line

In this case you would need to be on the domain controller to run this:

DSQUERY USER -samid enter_username_here | dsmod user -pwd enter_new_pw_here -mustchpwd no

1	DSQUERY USER -samid enter_username_here \| dsmod user -pwd enter_new_pw_here -mustchpwd no

Remotely Reset . . . → Read More: Reset Active Directory Password Script

getdn.bat

posted this in Active Directory, Windows on May 14th, 2012

To return the distinguished name for all users in an active directory domain create a new file called getdn.bat

Content:

del c:\activeUsers.txt
DSQUERY.exe * -limit 0 -filter "(&(objectCategory=Person)(objectClass=User)(!userAccountControl:1.2.840.113556.1.4.803:=2))" >"c:\activeUsers.txt"
C:\WINDOWS\NOTEPAD.EXE c:\activeUsers.txt

del c:\activeUsers.txt

DSQUERY.exe * -limit 0 -filter "(&(objectCategory=Person)(objectClass=User)(!userAccountControl:1.2.840.113556.1.4.803:=2))" >"c:\activeUsers.txt"

C:\WINDOWS\NOTEPAD.EXE c:\activeUsers.txt

active directory disable users older than x days

posted this in Active Directory, powershell, Windows on February 29th, 2012

Script Details

This is example will show you how to disable folks that have a password older than x number of days AND / OR have not logged in for X number of days

Requirements ActiveRoles Management Shell (free) Powershell Server 2003 or Higher Domain Controller Example Script

Filename: C:\1audit\scripts\disable_accounts_password_age_greater_91_days.ps1 Description: (Disable users that have . . . → Read More: active directory disable users older than x days

Export All Users from OU

posted this in Active Directory, Windows on January 24th, 2012

How can you export all users from an OU in active directory on server 2003?

Create a file called exportusers.vbs and paste in this text: Dim ObjWb Dim zz Set objRoot = GetObject(“LDAP://RootDSE”) strDNC = objRoot.Get(“DefaultNamingContext”) Set objDomain = GetObject(“LDAP://” & strDNC) ‘ Bind to the top of the Domain using LDAP using ROotDSE Set . . . → Read More: Export All Users from OU

find username email address active directory

posted this in Active Directory, Windows on July 20th, 2011

need to find username email address active directory ?

place this in a .bat file and run it:

dsquery.exe * -limit 0 -filter "(&(objectCategory=person)(objectClass=user)(mail=*))" -attr sAMAccountName name mail >"c:\PrimaryEmailAddresses.txt"
notepad "c:\PrimaryEmailAddresses.txt"

1 2	dsquery.exe * -limit 0 -filter "(&(objectCategory=person)(objectClass=user)(mail=*))" -attr sAMAccountName name mail >"c:\PrimaryEmailAddresses.txt" notepad "c:\PrimaryEmailAddresses.txt"

active directory password reset tool

posted this in Active Directory, Windows on March 31st, 2011

Wise soft has create a great free active directory password reset tool -> download here

Password Control Overview

Password Control is a tool designed to allow helpdesk staff and other IT support personnel to reset user passwords. It has a simple and intuitive interface that many users find more productive than a custom MMC console. . . . → Read More: active directory password reset tool

howto write active directory scripts

posted this in Active Directory, Windows on March 31st, 2011

I just came across this tool that makes writing active directory scripts a breeze

It is called ADSI scriptomatic. http://www.microsoft.com/downloads/en/confirmation.aspx?FamilyID=39044e17-2490-487d-9a92-ce5dcd311228&DisplayLang=en

Brakertech

active directory cheatsheet

Apache Active Directory Authentication howto

Reset Active Directory Password Script

getdn.bat

active directory disable users older than x days

Export All Users from OU

find username email address active directory

active directory password reset tool

howto write active directory scripts

Search Brakertech

dEFENSE

Hacking

Security

Search Brakertech

dEFENSE

Hacking

Tags

Security