Dave's Technology

Installing RSAT on the command line

2025-03-04T13:15:00.004+11:00

I bet I have written this up ten times, I am sick of needing to remember it.

Windows 10:

Get-WindowsCapability -Name RSAT* -Online | where State -EQ NotPresent | Add-WindowsCapability –Online

Windows 11:

Get-WindowsCapability -Name RSAT* -Online | Where-Object { $_.State -eq 'NotPresent' } | ForEach-Object { Add-WindowsCapability -Online -Name $_.Name }

Microsoft Graph, Intune, All intune apps and who/what has them installed.

2025-03-04T09:28:00.000+11:00

All Intune apps and who/what has them installed.

This is much better, it is using the REST API so can get rate limited (HTTP 429), but insert a delay and get a coffee. This pulled out a ~150,000 line CSV.

Huge shout out to a mate of a mate, who created https://graphxray.merill.net/ as this allowed me to find the undocumented endpoints and command lines, the traditional PowerShell did not work, but the REST APIs work well.

Thanks Eunice, Dhruv, Clement, Monica & @merill.

## Script starts

#ApplicationProfile
$tenantId = 'xxx'
$appId = 'xxx' # Application (client) ID
$appSecret = 'xxx' #Value

# Obtain an access token using client credentials
$body = @{
    grant_type    = "client_credentials"
    scope         = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# Retrieve applications
$appUri = "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps"
$applications = Invoke-RestMethod -Uri $appUri -Method Get -Headers @{Authorization = "Bearer $token"}

# Prepare output collection
$output = @()

# Loop through each application
foreach ($checkApp in $applications.value) {
    $ApplicationId = $checkApp.id
    $ApplicationName = $checkApp.displayName

    # Request URI and parameters for the report
    $uri = "https://graph.microsoft.com/beta/deviceManagement/reports/retrieveDeviceAppInstallationStatusReport"
    $params = @{
        select = @("DeviceName", "UserPrincipalName", "DeviceId")
        skip = 0
        top = 5000 ### Max number of users/computers allocation to the app
        filter = "(ApplicationId eq '$ApplicationId')"
        orderBy = @()
    }

    # Make the POST request
    $response = Invoke-RestMethod -Uri $uri -Method Post -Headers @{Authorization = "Bearer $token"} -Body ($params | ConvertTo-Json) -ContentType "application/json"

    # Check if Values contain data
    if ($response.Values) {
        foreach ($value in $response.Values) {
            # Split the concatenated string to extract the relevant fields
            $fields = $value -split ' '

            # Assuming the format is consistent, map the fields
            $outputObject = [PSCustomObject]@{
                ApplicationName = $ApplicationName
                ComputerName    = $fields[1] # Assuming this is DeviceName
                UserUPN         = $fields[2] # Assuming this is UserPrincipalName
                ## There are more here, I just didnt need them

            }
            $output += $outputObject
        }
    } else {
        Write-Host "No installation data found for Application ID $ApplicationId ($ApplicationName)." -ForegroundColor Yellow
    }
    Start-Sleep -Seconds 6 # Adjust the number of seconds as necessary, this is to stop HTTP 429 rate limiting.
}

# Output to screen
$output | Format-Table -AutoSize
$output.Count

# Export to CSV
$output | Export-Csv -Path "ApplicationInstallStatusReport.csv" -NoTypeInformation

Microsot Graph, AppProfile, PowerShell, Dynamic Groups applied to OS version

2025-02-13T15:47:00.001+11:00

This is a quick and dirty to see why my groups are no longer applying to Windows 11

Creating the AppProfile - App Registration for intune

2025-02-10T12:04:00.002+11:00

App Registration for Microsoft Graph

* Think Service Account, not user account *

Permissions Requested

Required API Permissions

Directory.Read.All
User.Read.All
Group.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementConfiguration.Read.All
DeviceManagementApps.ReadWrite.All
DeviceManagementApps.Read.All
DeviceManagementManagedDevices.PrivilegedOperations.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementRBAC.Read.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementConfiguration.Read.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceManagementServiceConfig.Read.All

Steps for Setup
This example is the app registration has the permission, not the user connecting. This is for Azure AD and Intune. You can add others if needed. But you need to download the token again if you change permission (scopes).

Logon to Azure AD (Entra) as a Global Admin, go to app registrations
Create (Register) and new app
Give it a name, the redirect is not applicable but needs a URI to continue
Go to the app permissions and add in, see following
Graph access
User accounts in Azure AD

See above for all permissions

See the status has changed, if you add permission you may need this again
Go to Managed Applications and grant access to the end user account using this API
Add user
Select ‘none selected’ – great interface naming

Find your users
Create a secret for the client to connect
Create one, this can be replaced and re-shared if it has leaked

Give it the time frame for renewal

Copy the VALUE now of you will need to re-create it as it is hidden when you return    Creation:
Future:

Testing
Connect to the API    # Tenant ID for your Azure AD instance
$tenantId = 'xxx'

# Your application (client) ID
$appId = 'xxxx' # Application (client) ID

# Your application (client) secret value
$appSecret = 'xxx' #Value

# scope list for access token (for user delegated permissions)
# $scopes = "User.Read.All Mail.Read Files.read.all User.Read"

# the user I am looking at for the onedrive details etc (not the logged on user)
$userId = 'Dave.Colvin@workplace.onmicrosoft.com'

$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)

(get-mgcontext).Scopes

Permissions for Intune API

Intune permission scopes

Perform user-impacting remote actions on Microsoft Intune devices

DeviceManagementManagedDevices.PrivilegedOperations.All

Read and write Microsoft Intune devices    DeviceManagementManagedDevices.ReadWrite.All

Read Microsoft Intune devices    DeviceManagementManagedDevices.Read.All

Read and write Microsoft Intune RBAC settings    DeviceManagementRBAC.ReadWrite.All

Read Microsoft Intune RBAC settings    DeviceManagementRBAC.Read.All
Read and write Microsoft Intune apps    DeviceManagementApps.ReadWrite.All

Read Microsoft Intune apps    DeviceManagementApps.Read.All

Read and write Microsoft Intune Device Configuration and Policies    DeviceManagementConfiguration.ReadWrite.All
Read Microsoft Intune Device Configuration and Policies    DeviceManagementConfiguration.Read.All

Read and write Microsoft Intune configuration    DeviceManagementServiceConfig.ReadWrite.All

Read Microsoft Intune configuration    DeviceManagementServiceConfig.Read.All

Permissions Explained

DeviceManagementApps.Read.All
•    Enable Access setting: Read Microsoft Intune apps
•    Permits read access to the following entity properties and status:
o    Client Apps
o    Mobile App Categories
o    App Protection Policies
o    App Configurations
DeviceManagementApps.ReadWrite.All
•    Enable Access setting: Read and write Microsoft Intune apps
•    Allows the same operations as DeviceManagementApps.Read.All
•    Also permits changes to the following entities:
o    Client Apps
o    Mobile App Categories
o    App Protection Policies
o    App Configurations
DeviceManagementConfiguration.Read.All
•    Enable Access setting: Read Microsoft Intune device configuration and policies
•    Permits read access to the following entity properties and status:
o    Device Configuration
o    Device Compliance Policy
o    Notification Messages
DeviceManagementConfiguration.ReadWrite.All
•    Enable Access setting: Read and write Microsoft Intune device configuration and policies
•    Allows the same operations as DeviceManagementConfiguration.Read.All
•    Apps can also create, assign, delete, and change the following entities:
o    Device Configuration
o    Device Compliance Policy
o    Notification Messages
DeviceManagementManagedDevices.PrivilegedOperations.All
•    Enable Access setting: Perform user-impacting remote actions on Microsoft Intune devices
•    Permits the following remote actions on a managed device:
o    Retire
o    Wipe
o    Reset/Recover Passcode
o    Remote Lock
o    Enable/Disable Lost Mode
o    Clean PC
o    Reboot
o    Delete User from Shared Device
DeviceManagementManagedDevices.Read.All
•    Enable Access setting: Read Microsoft Intune devices
•    Permits read access to the following entity properties and status:
o    Managed Device
o    Device Category
o    Detected App
o    Remote actions
o    Malware information
DeviceManagementManagedDevices.ReadWrite.All
•    Enable Access setting: Read and write Microsoft Intune devices
•    Allows the same operations as DeviceManagementManagedDevices.Read.All
•    Apps can also create, delete, and change the following entities:
o    Managed Device
o    Device Category
•    The following remote actions are also allowed:
o    Locate devices
o    Disable Activation Lock
o    Request remote assistance
DeviceManagementRBAC.Read.All
•    Enable Access setting: Read Microsoft Intune RBAC settings
•    Permits read access to the following entity properties and status:
o    Role Assignments
o    Role Definitions
o    Resource Operations
DeviceManagementRBAC.ReadWrite.All
•    Enable Access setting: Read and write Microsoft Intune RBAC settings
•    Allows the same operations as DeviceManagementRBAC.Read.All
•    Apps can also create, assign, delete, and change the following entities:
o    Role Assignments
o    Role Definitions
DeviceManagementServiceConfig.Read.All
•    Enable Access setting: Read Microsoft Intune configuration
•    Permits read access to the following entity properties and status:
o    Device Enrollment
o    Apple Push Notification Certificate
o    Apple Device Enrollment Program
o    Apple Volume Purchase Program
o    Exchange Connector
o    Terms and Conditions
o    Cloud PKI
o    Branding
o    Mobile Threat Defense
DeviceManagementServiceConfig.ReadWrite.All
•    Enable Access setting: Read and write Microsoft Intune configuration
•    Allows the same operations as DeviceManagementServiceConfig.Read.All_
•    Apps can also configure the following Intune features:
o    Device Enrollment
o    Apple Push Notification Certificate
o    Apple Device Enrollment Program
o    Apple Volume Purchase Program
o    Exchange Connector
o    Terms and Conditions
o    Cloud PKI
o    Branding
o    Mobile Threat Defense

Mircosoft Graph, AppProfile, Powershell, intune - export apps installed on computers

2025-02-10T11:48:00.001+11:00

So I may be wrong, but I cant see the API allowing me to get the apps installed on the computer, I need to ask which are the computers this apps is installed on.

So this script on a fleet of 4000 computers outputs a XLS of about 200,000 lines. I had to break it down and do a few different runs to stop the token timing out (just more then 5 users, then less then 5 users).

# You need an appProfile with intune permissions
$tenantId = 'xxxxxxxxxxxx' # You Tenant ID
$appId = 'xxxxxxxxxxxxx' # Application (client) ID
$appSecret = 'xxxxxxxxxxxxxx' #Value

$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)
#disConnect-MgGraph

#(get-mgcontext).Scopes
# (get-mgcontext)
   if (get-mgcontext) {write-host "Connected to O365" -ForegroundColor Green}
   else { write-host "Disconnected from O365" break}

$AllApps = Get-MgDeviceManagementDetectedApp -Top 200
#$AllApps = Get-MgDeviceManagementDetectedApp -all
#$AllApps.Count

$allDetectedApps.count
#$allDetectedApps | Format-Table

# Just focus on the common Windows apps
$Over5allDetectedApps = $Allapps | Where-Object { $_.Platform -eq "windows" -and $_.DeviceCount -ge 5 }
$Over5allDetectedApps.Count
#Write-Host ($allDetectedApps[3] | Format-List | Out-String)


# Initialize an array to store the output data
$outputData = @()

foreach ($app in $Over5allDetectedApps) {
    # Retrieve all managed devices for the current app
    $managedDevices = Get-MgDeviceManagementDetectedAppManagedDevice -DetectedAppId $app.Id

    # Iterate through each managed device associated with the app
    foreach ($device in $managedDevices) {
        # Create a custom object for each app-device combination
        $outputData += [PSCustomObject]@{
            AppID         = $app.Id
            ComputerName = $device.DeviceName
            AppDisplayName = $app.DisplayName
        }
    }
}

# Export the collected data to a CSV file
$outputData | Export-Csv -Path "DetectedApps.csv" -NoTypeInformation -Delimiter ";"

Write-Host "Exported"

Microsoft Graph, AppProfile, PowerShell, intune to get devices OS versions dump

2025-02-10T11:21:00.004+11:00

# You need an appProfile with intune permissions
$tenantId = 'xxxxxxxxxxxx' # You Tenant ID
$appId = 'xxxxxxxxxxxxx' # Application (client) ID
$appSecret = 'xxxxxxxxxxxxxx' #Value

$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)
#disConnect-MgGraph

#(get-mgcontext).Scopes
# (get-mgcontext)
   if (get-mgcontext) {write-host "Connected to O365" -ForegroundColor Green}
   else { write-host "Disconnected from O365"
   break}


# Retrieve all devices
$devices = Get-MgDevice -All

# Check if devices were retrieved
if ($devices -ne $null) {
    # Create an array to store device details
    $deviceDetails = @()


# Filter devices where the OperatingSystem property contains "Windows"
$devices.Count
    $windowsDevices = $devices | Where-Object {   $_.OperatingSystem -like '*Windows*'   }

# Display the count of devices
$devices.Count
    #Write-Host ($devices[44] | Format-List | Out-String)
$windowsDevices.Count
    #Write-Host ($windowsDevices[44] | Format-List | Out-String)

# whats available
Write-Host ($windowsDevices[10] | Format-List | Out-String)

# Loop through each device and extract details
foreach ($device in $windowsDevices) {
    # Use the correct property name for last sync date
    $formattedDate = if ($device.ApproximateLastSignInDateTime -ne $null) {
        $device.ApproximateLastSignInDateTime.ToString("yyyy-MM-dd")
    } else {   "N/A"   }

    # Write the output with the formatted date
    Write-Host "Name;$($device.DisplayName);OS;$($device.OperatingSystemVersion);LastSync;$formattedDate;DeviceID;$($device.Id)"
        }

}

Microsoft Graph, AppProfile, PowerShell to dump list of devices and last sync to Intune

2025-02-10T11:15:00.003+11:00

# You need an appProfile with intune permissions
$tenantId = 'xxxxxxxxxxxx' # You Tenant ID
$appId = 'xxxxxxxxxxxxx' # Application (client) ID
$appSecret = 'xxxxxxxxxxxxxx' #Value

$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)
#disConnect-MgGraph

# (get-mgcontext).Scopes
# (get-mgcontext)
   if (get-mgcontext) {write-host "Connected to O365" -ForegroundColor Green}
   else { write-host "Disconnected from O365" -ForegroundColor Red break}

# Get-MgDeviceManagementManagedDevice
$devices = Get-MgDeviceManagementManagedDevice -all # Can be long

# Filter devices where the OperatingSystem property contains "Windows"
    $devices.Count
    $windowsDevices = $devices | Where-Object { $_.OperatingSystem -like '*Windows*' }
    $windowsDevices.Count

    # Write-Host ($windowsDevices[22] | Format-List | Out-String) # Check one

$windowsDevices | ForEach-Object {
    # Format the LastSyncDateTime as YYYYMMDD
    $formattedDate = $_.LastSyncDateTime.ToString("yyyy-MM-dd")

    # Write the output with the formatted date
    Write-Host 'PCName;'$($_.DeviceName)';OS;'$($_.OSVersion)';LastSync;'$formattedDate';UserUPN;'$($_.UserPrincipalName)';Model;'$($_.model)';DeviceID;'$($_.Id)
}

Microsoft Graph, AppProfile, PowerShell, intune to export list of .EXE intune installed apps

2025-02-10T11:05:00.004+11:00

Base script

# You need an appProfile with intune permissions
$tenantId = 'xxxxxxxxxxxx' # You Tenant ID
$appId = 'xxxxxxxxxxxxx' # Application (client) ID
$appSecret = 'xxxxxxxxxxxxxx' #Value

$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)
#disConnect-MgGraph

# (get-mgcontext).Scopes
# (get-mgcontext)
   if (get-mgcontext) {write-host "Connected to O365" -ForegroundColor Green}
   else {   write-host "Disconnected from O365"
   break}

# Retrieve all mobile apps
$Allapps = Get-MgDeviceAppManagementMobileApp
$Allapps.Count

# Filter apps where the installCommandLine contains ".exe"
$exeApps = $Allapps | Where-Object {
    $_.AdditionalProperties['installCommandLine'] -match '\.exe'
                                    }

# Display the filtered apps
$exeApps | ForEach-Object {

    $formattedDate = if ($_.LastModifiedDateTime -ne $null) {   $($_.LastModifiedDateTime).ToString("yyyy-MM-dd") }
    else {   "N/A"   }
    Write-Host "DisplayName;$($_.DisplayName);LastMod;$formattedDate;CommandLine;$($_.AdditionalProperties['installCommandLine']);AppID;$($_.Id)"

                          }

List of Azure (Entra) AD Groups used for deployment

$exeApps | ForEach-Object {
    # Retrieve assignments for each app
    $assignments = Get-MgDeviceAppManagementMobileAppAssignment -MobileAppId $_.Id

    # Extract group display names from assignments
    $groupNames = $assignments | ForEach-Object {
        # Check if the target is a group
        if ($_.Target.GroupId -ne $null) {
            # Retrieve group details
            $group = Get-MgGroup -GroupId $_.Target.GroupId
            $group.DisplayName
        }
    } | Sort-Object | Get-Unique

    # Format the list of group names
    $groupNamesFormatted = if ($groupNames -ne $null) {
        $groupNames -join ", "
    } else {
        "No groups assigned"
    }

    # Format the last modified date
    $formattedDate = if ($_.LastModifiedDateTime -ne $null) {
        ($_.LastModifiedDateTime).ToString("yyyy-MM-dd")
    } else {
        "N/A"
    }

    # Output the information
    Write-Host "DisplayName;$($_.DisplayName);LastMod;$formattedDate;AppID;$($_.Id);Groups;$groupNamesFormatted"
}

Get the groups names out too

# Function to get group name from group ID
function Get-GroupNameFromId($groupId) {
    try {
        $group = Get-MgGroup -GroupId $groupId
        return $group.DisplayName
    } catch {
        return "Unknown Group"
    }
}

# Loop through each app
$exeApps | ForEach-Object {
    # Retrieve assignments for each app
    $assignments = Get-MgDeviceAppManagementMobileAppAssignment -MobileAppId $_.Id

    # Prepare to store group and assignment type information
    $assignmentInfo = @()

    # Loop through each assignment and gather necessary details
    $assignments | ForEach-Object {
        $assignmentDetails = "Assignment ID: $($_.Id); Intent: $($_.Intent)"

        # Check if the target is present and add its properties to details
        if ($_.Target -ne $null) {
            $groupId = $_.Target.AdditionalProperties["groupId"]
            $groupName = Get-GroupNameFromId -groupId $groupId
            $assignmentDetails += "; Group Name: $groupName"
        } else {              $assignmentDetails += "; No target details available."          }

        # Add the collected details to the main assignment info array
        $assignmentInfo += $assignmentDetails
    }

    # Format the list of assignment information
    $assignmentInfoFormatted = if ($assignmentInfo.Count -gt 0) {
        $assignmentInfo -join " | "
    } else {          "No assignments"      }

    # Format the last modified date
    $formattedDate = if ($_.LastModifiedDateTime -ne $null) {
        ($_.LastModifiedDateTime).ToString("yyyy-MM-dd")
    } else {          "N/A"      }

    # Output the information in a single line
    Write-Host "DisplayName: $($_.DisplayName); Assignments: $assignmentInfoFormatted "# ;LastMod: $formattedDate; AppID: $($_.Id)"
}

Two simple PS scripts to track Windows 10 -> 11 upgrade removing applications

2025-02-10T10:58:00.009+11:00

TBH we have not found any yet, but as a part of a 4000 computer fleet we need to know if any are. So two simple scripts that show changes, PRE upgrade and POST upgrade.

Just put the files in C:\TEMP.

PRE

# Run this script on Windows 10 before upgrading

$computerInfo = @{
    Name   = (Get-WmiObject Win32_ComputerSystem).Name
    Type   = (Get-WmiObject Win32_ComputerSystem).SystemType
    Serial = (Get-WmiObject Win32_BIOS).SerialNumber
}

$installedPrograms = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Select-Object DisplayName, DisplayVersion, Publisher |
    Where-Object { $_.DisplayName -ne $null -and $_.DisplayName -ne "" }

$result = @{
    ComputerInfo = $computerInfo
    InstalledPrograms = $installedPrograms
}

$jsonResult = $result | ConvertTo-Json -Depth 4

Set-Content -Path "C:\temp\Windows10.json" -Value $jsonResult
Write-Host "Done for $($computerInfo.Name)"

POST

# Load previous details from JSON
$previousDetails = $null
$previousDetails = Get-Content -Path "C:\temp\Windows10.json" | ConvertFrom-Json
# $previousDetails.InstalledPrograms[5].DisplayName

# Extract previous installed programs
$previousPrograms = $previousDetails.InstalledPrograms
write-host $previousDetails.InstalledPrograms.Count "Applications detected" -ForegroundColor Green

# Output loaded JSON for debugging
Write-Host "Loaded JSON content:"
Write-Output ($previousDetails | ConvertTo-Json -Depth 4)

# Extract computer information
$previousComputerInfo = $previousDetails.ComputerInfo
$serialNumber = $previousComputerInfo.Serial
$computerName = $previousComputerInfo.Name
$computerType = $previousComputerInfo.Type

# Get current computer details
$newName = (Get-WmiObject Win32_ComputerSystem).Name
$newType = (Get-WmiObject Win32_ComputerSystem).SystemType
$newSerial = (Get-WmiObject Win32_BIOS).SerialNumber

# Print and compare computer details
Write-Output "Comparing Computer Details:"

if ($computerName -ne $newName) {
    Write-Host "Name has changed: $computerName -> $newName"
} else {
    Write-Host "Name check pass: $newName" -ForegroundColor Green
}

if ($computerType -ne $newType) {
    Write-Host "Type has changed: $computerType -> $newType"
} else {
    Write-Host "Type check pass: $newType" -ForegroundColor Green
}

if ($serialNumber -ne $newSerial) {
    Write-Host "Serial has changed: $serialNumber -> $newSerial"
} else {
    Write-Host "Serial number check pass: $newSerial" -ForegroundColor Green
}

# $previousDetails.InstalledPrograms.Count

# Create a hashtable for quick lookup of previous program versions
$previousProgramVersions = @{}
foreach ($program in $previousPrograms) {
    if ($program.DisplayName -ne $null) {
        $previousProgramVersions[$program.DisplayName] = $program.DisplayVersion
    } }

# Get current list of installed programs
$currentInstalledPrograms = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Select-Object DisplayName, DisplayVersion, Publisher |
    Where-Object { $_.DisplayName -ne $null -and $_.DisplayName -ne "" }

# Compare programs
Write-Output "Comparing Installed Programs:"
foreach ($currentProgram in $currentInstalledPrograms) {
    $currentName = $currentProgram.DisplayName
    $currentVersion = $currentProgram.DisplayVersion

    if ($currentName -ne $null -and $previousProgramVersions.ContainsKey($currentName)) {
        $previousVersion = $previousProgramVersions[$currentName]
        if ($previousVersion -eq $currentVersion) {
            Write-host "$currentName has the same version: $currentVersion"   -ForegroundColor Green
        } else {
            Write-host "$currentName has changed versions: OLD=$previousVersion, NEW=$currentVersion"   -ForegroundColor yellow
        }
    } elseif ($currentName -ne $null) {
        Write-host "$currentName is a new APP in the AFTER state with version: $currentVersion"   -ForegroundColor Red
    } }

# Identify programs that were removed or missing in the current list
$removedPrograms = $previousProgramVersions.Keys | Where-Object { -not ($currentInstalledPrograms | Select-Object -ExpandProperty DisplayName) -contains $_ }
foreach ($removedProgram in $removedPrograms) {
    Write-host "Program '$removedProgram' was installed before but is now removed or missing."
}

Example Output

Microsoft Graph, AppProfile, Powershell, intune to export user and computer details

2025-02-10T10:39:00.006+11:00

Do with what you will, use the handy # Write-Host ($SpecificVar | Format-List | Out-String) # to see what is available.

# You need an appProfile with intune permissions
$tenantId = 'xxxxxxxxxxxx' # You Tenant ID
$appId = 'xxxxxxxxxx' # Application (client) ID
$appSecret = 'xxxxxxxxxxx' #Value
$body = @{
    grant_type    = "client_credentials"
    scope = "https://graph.microsoft.com/.default"
    client_id     = $appId
    client_secret = $appSecret
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$token = $response.access_token

# connecting as the application with the permission on the service
Connect-MgGraph -AccessToken ($Token |ConvertTo-SecureString -AsPlainText -Force)
#disConnect-MgGraph
#(get-mgcontext).Scopes
# (get-mgcontext)
if (get-mgcontext) {write-host "Connected to O365" -ForegroundColor Green}
else { write-host "Disconnected from O365" break}

$allMGusers = get-mguser -Top 200
# $allMGusers = get-mguser -All # This can take time in a big environment.

$allMGusers.Count
# $allMGusers[222] # Lets just see what 222 looks like?

$SpecificUser = $allMGusers | Where-Object { $_.UserPrincipalName -like 'David.Colvin1*' }
$SpecificUser.Count

# Write-Host ($SpecificUser | Format-List | Out-String) # dump it all to look at it.
Write-Host $SpecificUser.UserPrincipalName $SpecificUser.Id # Some things I am interested in

# A UPN can also be used as -UserId.
$UserDevices = Get-MgUserOwnedDevice -UserId $SpecificUser.Id

foreach ($device in $UserDevices) {
    $deviceDetails = get-mgdevice -DeviceId $device.Id
    write-host $deviceDetails.DisplayName';'$deviceDetails.Id';'$deviceDetails.OperatingSystemVersion';'$SpecificUser.UserPrincipalName';'$SpecificUser.Id
    # Write-Host ($deviceDetails | Format-List | Out-String) # dump it all to look at it.
                                    }

To check if you are a local administrator

2024-01-31T14:53:00.006+11:00

To check if you are a local administrator on a Windows machine using the command line, you can use the following methods:

### Method 1: Using the `net user` command

You can check the groups that your user account belongs to with the `net user` command followed by your username and the `/domain` flag if you are on a domain:

Cmd.exe

net user yourusername

Or if you are checking for the account that's currently logged in:

cmd .exe

net user %USERNAME%

Look for the "Local Group Memberships" section in the output. If you see `Administrators` listed there, your account is a member of the local Administrators group.

Using the `whoami /groups` command

This command will list all the groups that the current user is a member of, along with their security identifiers (SIDs):

Cmd.exe

whoami /groups

Search for a group named `BUILTIN\Administrators` or look for the SID `S-1-5-32-544`, which corresponds to the Administrators group. If the group has the attribute `Enabled group`, it means your account is currently acting with administrative privileges.

Using the `net localgroup` command

You can also list all members of the Administrators group using the `net localgroup` command:

Cmd.exe

net localgroup Administrators

Check if your username is listed in the output. If it is, then your account is a member of the local Administrators group.

Choose the method that you find most convenient. It is worth noting that even if your user account is a member of the Administrators group, User Account Control (UAC) may require you to explicitly run programs "as administrator" to perform tasks that require elevated privileges.

Using PowerShell

If you prefer to use PowerShell, you can run the following command to check if the current user is part of the Administrators group:

powershell.exe

$currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())

$currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

This will return `True` if you are running as an administrator, and `False` otherwise.

Quickly create some accounts in Active Directory for testing

2023-12-16T09:33:00.004+11:00

# Define the password for the accounts
$password = ConvertTo-SecureString -AsPlainText "Password11" -Force

# Create 100 user accounts (user001 to user100)
1..100 | ForEach-Object {
    $username = "computer{0:D3}" -f $_
    #$username = "user{0:D3}" -f $_
    #New-ADUser -Name $username -SamAccountName $username -UserPrincipalName "$username@enron.com.au" -AccountPassword $password -Enabled $true -Path "CN=Users,DC=enron,DC=com,DC=au" -PassThru
    New-ADComputer -Name $username -SamAccountName $username -UserPrincipalName "$username@enron.com.au" -AccountPassword $password -Enabled $true -Path "CN=Computers,DC=energy,DC=com,DC=au" -PassThru
}

Need to rename an Active Directory (2019 and later) and dont want the life story?

2023-12-16T09:32:00.005+11:00

Here is a bullet point list of the commands to run in order based on the provided text:

On the DC, from an Admin Command Prompt:

rendom /list
Edit the Domainlist.xml file it created to replace all existing domain names with the new domain name, including the NetBIOS name if it’s changed.

rendom /showforest
rendom /upload

Ensure replication is complete, optionally using

repadmin.exe /syncall /d /e /P /q DomainNamingMaster-HostName

rendom /prepare
rendom /execute

After domain controllers restart, log on using the new domain name.
Restart the pretty much everything twice after all domain controllers are back online.

Update GPO linkages with the new domain name using gpfixup . If FQDN is changed:

gpfixup /olddns:old-domain.local /newdns:new-domain.com

If NetBIOS name is changed:

gpfixup /oldnb:OLD-NetBIOS /newnb:NEW-NetBIOS

If needed, synchronise group policy changes with repadmin.exe /syncall /d /e /P /q DC-HostName NewDomainDN

Rename domain controllers with netdom commands:

netdom computername old.computer.name /add:new.computer.name

followed by

netdom computername old.computer.name /makeprimary:new.computer.name

Reboot domain controllers.
Reboot all domain member computers, workstations, and servers twice.

If using domain-based DFS namespaces, update any orphaned paths.
Run rendom /clean to clean up old domain references and unfreeze the forest configuration.

rendom /clean

Open DNS Manager create the new zone, reboot and after you can delete the old domain DNS zone.

Remove the Active Directory Domain Services role from Control Station if applicable.

The domain rename process is complex and can have far-reaching effects on your network. It should not be undertaken lightly and requires thorough planning and testing.

Time and date on Server 2019 (timedate.cpl or tzutil)

2020-08-13T11:43:00.004+10:00

It is 2020 and Microsoft still believe everyone is in the USA (or covid central as it is now known). So we always have to change, normally an Administrator can do this, but in Server 2019, not even normal admin users can do this, you need to elevate the control.

You can change the time zone in the control panel, and it will fail with a notification that you do not have the permissions to perform this task and that you should contact the administrator.

If you try and change it in the 'settings app' you do not even get an error message; the dialog simply resets itself to the original time zone after exiting.

But they way to do it is starting the control panel's "timedate.cpl" applet directly, elevated with administrative rights.

You can also use the timezone utility, 'tzutil /s "AUS Eastern Standard Time"'

Creating and Moving to Group Managed Service Accounts (GMSA)

2020-05-27T10:23:00.000+10:00

Group managed service accounts are better for the following reasons:

No Password Management, no need to store the key in a vault
Supports being shared across multiple hosts
You cant steal the password from the LSA
The Microsoft Key Distribution Service (KDC) manages the passwords for the gMSA

If your domain supports it (AD Schema 2012 and better).

Check if it is enabled: Get-KdsRootKey

If GMSA are supported it will return the DC that is the KDS, and you are golden, just run this command to make a new GMSA for the servers you need:

New-ADServiceAccount -Name 'yourServiceAccountName' -DNSHostName (Get-ADDomainController (Get-KdsRootKey).domaincontroller).hostname -PrincipalsAllowedToRetrieveManagedPassword 'yourserver1$', 'yourserver2$', 'yourserver3$', 'yourserver4$'

If GMSA are not yet setup run the following commands (in large environments wait for replication after this):

Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))

Then you can run the NEW-ADServiceAccount command above.

On the server you want to be able to use the GSMA run the following:

Install-ADServiceAccount -Identity 'yourServiceAccountName'

Then change the Windows Service change to the \Domain\ServiceAccounts\'yourServiceAccountName' without a password and you are done.

Quickly get the Domain Controllers via Powershell

2019-07-15T13:48:00.003+10:00

I use this all the time, and get-adDomainControllers is a broken command, so this quickly grabs the DCs and can get other info if needed.

$AllDCS=[system.directoryservices.activedirectory.Forest]::GetCurrentForest().domains | %{$_.DomainControllers.name}

$AllDCS | foreach {

Get-ADdomaincontroller $_.trim() | select Hostname, IPv4Address

}

NETDC02.nsw.gov.au 20.48.31.116

NETDC04.nsw.gov.au 20.48.31.117

Backup of Active Directory and move to new test environment

2019-01-14T15:18:00.002+11:00

Export

#export schema

ldifde -f PRODSchema.ldif -d CN=Schema,CN=Configuration,DC=ORG,DC=int

Export the organizational units from the source domain

#ldifde -f exportOu.ldf -s Server1 -d "dc=ORG,dc=int" -p subtree -r "(objectCategory=organizationalUnit)" -l "cn,objectclass,ou"

ldifde -f ProdOu.ldf -d "dc=dec,dc=int" -p subtree -r "(objectCategory=organizationalUnit)"

Export the user accounts from the source domain

#ldifde -f Exportuser.ldf -s Server1 -d "dc=ORG,dc=int" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))" -l "cn,givenName,objectclass,samAccountName"

ldifde -f Produser.ldf -d "dc=dec,dc=int" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))"

Search and replace ORG.int to the new AD name ORGtest.int

Import

#schema

ldifde -i -f D:\TEMP\DiffSchema.ldf

#ou structure

ldifde -i -k -f D:\TEMP\ProdOu.ldf

#Users

ldifde -i -k -f D:\TEMP\Produser2.ldf

Copy the Active Directory schema between two forests?

2018-09-19T15:16:00.002+10:00

So you have a DEV Active Directory environment and you need the schema from PROD, but you don't know what it is or where it came from?

On the server you want to copy the schema open ADSI edit (this is the lazy way to get the Distinguished name of the schema DN)

Select the schema on the DC

Select properties.

Take a copy of the DN

The on the OLD and NEW AD servers export the schema.

ldifde -f newAD.ldf -d "CN=Schema,CN=Configuration,DC=newad,DC=nsw,DC=gov,DC=au”

ldifde -f oldAD.ldf -d "CN=Schema,CN=Configuration,DC= oldAD,DC=nsw,DC=gov,DC=au"

EG:

On any DC install ADLDS (to get the schema compare tool)

Find the tool

Load the target schema

Load the base schema (the blank schema)

Mark the non-present elements you want for the new deployment.

There they are, the 157 differences, it is not unusual to have thousands.

Export the file to import.

Not the dc=x in the output file.

The as an Admin import the schema.

ldifde -i -f Difference.ldf -c DC=x "DC=NEWad,DC=nsw,DC=gov,DC=au"

This error means you are not a schema admin.

Ad yourself to schema admins, logout, login again.

Bingo !

DONE !

Powershell - Create local reboot scheduled task/Check scheduled task

2018-08-20T13:53:00.001+10:00

There are two scripts here, one creates several scheduled tasks on a remote computer, as local system account, the reason was before changing domain I could use a old\domain account, but mid-migration the computers were not quiet in the new domain, so a local scheduled task as local system would reboot to finish the process.

The second script checked to see if the identically named scheduled task existed as you can create a new one if the old name is in use, equally I could not delete them if found (bug maybe).

First script

$computers = Import-Csv C:\temp\computerlist.txt

ipconfig /flushdns

foreach ($computers in $computers){

#change for each migration date.

#$date="26/03/2018"

$time1="11:45"

$time2="11:55"

#$time3="14:55"

$ThisComputer=$computers.computername.trim()

$ThisComputer=$ThisComputer + ".old.gov.au"

$taskName1="ADMTPreBoot"

$taskName2="ADMTPostBoot"

$didit = Test-Connection $ThisComputer -count 1 -quiet

if ($didit -ne $false) {

#today

#write-host Attempt: $ThisComputer

Write-Host $ThisComputer + $taskName1 "to computer at" $time1 "and" $time2

c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn $taskName1 /tr "C:\Windows\System32\shutdown.exe /r /t 30 /f /d P:2:4" /st $time1 /ru "NT authority\local service" >>null

$now=(get-date).AddMinutes(2).ToString("HH:mm")

c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn ADMTipconfig /tr "ipconfig /registerdns" /st $now /ru "NT authority\local service" >>null

#c:\windows\system32\schtasks.exe /s $ThisComputer /run ADMTIPconfig >>null

#Write-Host "Add schelded reboot for" $taskName2 "to computer" $ThisComputer

c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn $taskName2 /tr "C:\Windows\System32\shutdown.exe /r /t 30 /f /d P:2:4" /st $time2 /ru "NT authority\local service" >>null

c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn ADMTgpudate /tr "GPupdate /force" /st $time2 /ru "NT authority\local service" >>null

#Write-Host "Add schelded reboot for" $taskName3 "to computer" $ThisComputer

#c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn $taskName3 /tr "C:\WINDOWS\CCMSETUP\CCMSETUP.EXE /MP:SCM.NEW.GOV.AU" /st $time3 /ru "NT authority\local service"

#future date (you can do today or this command is in the future)

#c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn $taskName1 /tr "C:\Windows\System32\shutdown.exe /r /t 30 /f /d P:2:4" /st $time1 /sd $date /ru "NT authority\local service"

#Write-Host "Add schelded reboot for" $time "to computer" $ThisComputer

#c:\windows\system32\schtasks.exe /create /s $ThisComputer /sc once /tn $taskName2 /tr "C:\Windows\System32\shutdown.exe /r /t 30 /f /d P:2:4" /st $time2 /sd $date /ru "NT authority\local service"

}

if ($didit -eq $false) {write-host $ThisComputer " is offline or unreachable"}

}

Second script, check for existing

$computers = Import-Csv C:\temp\computerlist.txt

ipconfig /flushdns

foreach ($computers in $computers){

#change for each migration date.

$ThisComputer=$computers.computername.trim()

$ThisComputer=$ThisComputer + ".wca.gov.au"

$taskName1="ADMTPreBoot"

#look

$didit = Test-Connection $ThisComputer -count 1 -quiet

if ($didit -ne $false)

{

#write-host Attempting to look at $ThisComputer

$isItDone = c:\windows\system32\schtasks.exe /query /v /s $ThisComputer /fo csv | ConvertFrom-Csv | ? TaskName -like *$taskName1* | select "next run time"

if ($isItDone -ne $null) {$ThisComputer + " has scheduled ADMTboots"

############## TO remove

compmgmt.msc /computer:$ThisComputer

}

if ($isItDone -eq $null) {$ThisComputer + " no ADMTboots"

############## TO remove

#compmgmt.msc /computer:$ThisComputer

}

#made a mistake?

#Write-Host "Removed reboot for" $time " computer" $ThisComputer

#error????

#c:\windows\system32\schtasks.exe /delete /s $ThisComputer /tn $taskName1

# c:\windows\system32\schtasks.exe /Query /s $ThisComputer /tn $taskName1

}

else {write-host $ThisComputer "offline"}

}

Powershell - check ADMT already done on workstation

2018-08-20T11:18:00.001+10:00

Because this specific migration was feed in user name and computer names from the business (ie full of mistakes) it was super common for computers to be targeted to be migrated a second time.

The issue with that is step one of ADMT is to delete the destination computer account (or reset the password, I forget which). The affect of that was you throw the computer off the domain and at next reboot the user needs the service to re-join the computer to the domain.

This checked old v new to tell you if the computer had moved, and had rebooted after the migration and was ready for a user.

$computers = Import-Csv C:\temp\computerlist.txt

foreach ($computers in $computers){

$thisPC=$computers.computername.Trim()

$looked=$null

$old=$null

$looked=Get-ADcomputer -Filter 'Name -like $thisPC' -Properties * -SearchScope Subtree

$old=Get-ADcomputer -Filter 'Name -like $thisPC' -Properties * -server "dc1.old.gov.au"

if ($old -eq $null) {$thisPC + " not in OLD domain - not a valid name"}

if ($looked.SamAccountName -eq $null -and $old -ne $null) {$thisPC + ".old.gov.au, Not in NEW (OLD only) OLD enabled? " + $old.Enabled + " " + $old.Description + "OLD last logon " + $old.LastLogonDate }

if ($looked.LastLogonDate -ne $null)

{

if ($looked.LastLogonDate -ge $old.LastLogonDate) { write-host $thisPC ".new.gov.au --------> newer in NEW Domain" }

}

if ($looked.SamAccountName -ne $null -and $looked.LastLogonDate -eq $null ) {$thisPC + " computer has never logged on FAILED migration, in migration now?, OLD enabled? " + $old.Enabled + $old.Description + " OLD last logon " + $old.LastLogonDate}

}

Powershell - Find IP range for device

2018-08-20T11:16:00.000+10:00

This was a pre-check for client computers about the be ADMT'ed to a new domain. The back story is a computer could be on a wired connection, a few WIFI networks which some had domain connectivity and some did not, and 4g/Home connection and direct access. At the point of migrate we bumped out the laptops that were going to fail, this was just a pre-check.

This was just a report so we could chase the user to correct the problem.

This script could be much easier in Windows 10 due to new functions (ip v6), but I did not have the option.

$computers = Import-Csv C:\temp\computerlist.txt

ipconfig /flushdns > null

#cls

foreach ($computers in $computers){

$ThisComputer=$computers.computername.trim()

$NoMigComputer=$ThisComputer + ".old.gov.au"

$testcon = " NOT reachable"

$didit = Test-Connection $NoMigComputer -count 1 -quiet

if ($didit -ne $false)

{$testcon = "and is contactable"}

#write-host Attempt to look at $NoMigComputer

try {

$result = $null

$JustIP = $null

$result = [System.Net.Dns]::GetHostAddresses($NoMigComputer)

$JustIP = $result.ipaddresstostring

if ($result -eq $null)

{ write-host $NoMigComputer " is not in DNS" }

else

{

#write-host $NoMigComputer" IP is" $JustIP

(

$JustIP -like '192.22.124.*' -or

$JustIP -like '192.28.126.*' -or

$JustIP -like '192.22.234.*'

)

{

write-host $NoMigComputer $JustIP "wired" $testcon

}

else

{

write-host $NoMigComputer $JustIP "is on WIFI" $testcon

} } }

catch {

$YesMigComputer=$ThisComputer + ".ic.nsw.gov.au"

try {

$Yesresult = [System.Net.Dns]::GetHostAddresses($YesMigComputer)

}

catch {

#$YesMigComputer + " not in IC domain EITHER"

}

$JustIP = $result.ipaddresstostring

if ($JustIP -eq $null)

{

write-host $NoMigComputer "is not in DNS *V4"

}

if ($NoMigComputer -eq $null)

{

Write-host $NoMigComputer "On 4G connection"

} } }

Powershell - ping the top of a list

2018-08-20T11:07:00.001+10:00

This is a bit of a dodgy, basically the migration was many computers at once each day, feed in from a list. This just picked the top computer and would ping it on screen so I could see if the process had started for the whole group. The first step in my migration was a pre-reboot.

$computers = Import-Csv C:\temp\computerlist.txt

ipconfig /flushdns

#cls

foreach ($computers in $computers){

$ThisComputer=$computers.computername.trim()

$NoMigComputer=$ThisComputer + ".old.gov.au"

ping -t $NoMigComputer -4

}

Powershell - create uses from CSV in Active Directory

2018-08-20T10:55:00.001+10:00

I did not write this, but fixed it, but I know it will come in handy again.

$targetpassword=ConvertTo-SecureString "Password!" -asplaintext -force

$thisUser= New-Object System.Management.Automation.PSCredential ("name\service_account", $targetpassword)

#$thisUser=Get-Credential

cls

$csv = Import-Csv -Path "C:\temp\User-create.csv"

foreach ($i in $csv) {

#$i.SamAccountName

$pass = [string] $i.password

$oupath = [string] $i.OUDN

New-ADUser -SamAccountName $i.samaccountname -Name $i.Name -GivenName $i.givenname -Surname $i.surname -DisplayName $i.name -UserPrincipalName $i.upn -EmailAddress $i.emailaddress -Path $oupath -Department $i.AgencyNameinCRM -OfficePhone $i.WorkPhoneNumber -title $i.Jobtitle -mobile $i.mobile -streetAddress $i.Street -city $i.city -postalCode $i.PostalCode -description $i.Description -Credential $thisUser

#write-host -SamAccountName $i.samaccountname -Name $i.Name -GivenName $i.givenname -Surname $i.surname -DisplayName $i.name -UserPrincipalName $i.upn -EmailAddress $i.emailaddress -Path $oupath -Department $i.AgencyNameinCRM -OfficePhone $i.WorkPhoneNumber

write-host "Creating" $i.givenname $i.surname

Set-ADAccountPassword -Identity $i.SamAccountName -NewPassword (ConvertTo-SecureString -AsPlainText $pass -Force) -Reset -Credential $thisUser

Set-ADUser -Identity $i.SamAccountName -Enabled $true -Credential $thisUser

}

Powershell - export groups, members details

2018-08-20T10:52:00.003+10:00

As it says on the box. Export groups, members details

cls

$Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,OU=name,DC=ic,DC=nsw,DC=gov,DC=au"

#get from the DN in AD Users and computers

Foreach($G In $Groups)

{

Write-Host ""

Write-Host "-------------"

Write-Host "Group Name, SamAccountName, CanonnicalName, WhenCreated"

Write-Host $G.Name,"," $G.SamAccountName,"," $G.CanonnicalName,"," $G.WhenCreated,"," $G.LastLoginDate

#$G.Members

Write-Host ""

Write-Host "User SamAccountName, Name, CanonicalName, WhenCreated, LastLoginDate"

Foreach($User In $G.Members)

{

$u= Get-ADUser $User -Properties *

Write-Host $U.SamAccountName,"," $U.Name, "," $U.CanonicalName, "," $U.WhenCreated, "," $U.LastLoginDate

}

Powershell - find which domain a user in O365 is connected to

2018-08-20T10:48:00.000+10:00

This script was used as I had two domain, old and new which both had a connection to o365 via AADC. I needed to know which was active, so I could make the new one active an ultimately disable and remove the old one.

This needs W7+ x64 for the Office Powershell components.

Lastly, yes I could have the on screen display in one part of the code, but once you are half way down a hole it make sense to jump, not climb back up and start again. ;)

You only need to run this after a reboot, etc, so use ISE and run as needed

----------------------------------------------------------------------------------------------------------------

[system.net.webrequest]::defaultwebproxy = new-object system.net.webproxy('http://proxy-02.name.nsw.gov.au:8080')

[system.net.webrequest]::defaultwebproxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials

[system.net.webrequest]::defaultwebproxy.BypassProxyOnLocal = $true

connect-azuread

Connect-MsolService

----------------------------------------------------------------------------------------------------------------

cls

#this is a check to ensure you have a connection prior to running a disable/delete etc, put in a name that works

$TESTADuser=Get-ADUser -Filter {sAMAccountName -eq 'colvind' } -Properties * -SearchScope Subtree

if ($TESTADuser.whenCreated -eq $null) { write-host "ERROR no connected to AZAD ***************"

break}

$users = Import-Csv C:\temp\userlist.txt

foreach ($users in $users){

$logon=$users.username.trim()

#write-host "looking at " $logon

$newAcc = $null

$oldAcc = $null

$newAcc = Get-ADUser -Filter {sAMAccountName -eq $logon } -Properties * -server "new.name.gov.au" -SearchScope Subtree

$oldAcc = Get-ADUser -Filter {sAMAccountName -eq $logon } -Properties * -server "old.name.gov.au" -SearchScope Subtree

try {

$azad=$null

$o3ad=$null

$whichAD=$null

$azad=Get-AzureADUser -objectid $newAcc.UserPrincipalName

$o3ad=Get-MsolUser -UserPrincipalName $newAcc.UserPrincipalName # | ft AccountSku, licence

if ($azad.OnPremisesSecurityIdentifier -like "S-1-5-21-1323355854-4650515797-*") {$whichAD="o365 Joined to NEW" }

if ($azad.OnPremisesSecurityIdentifier -notlike "S-1-5-21-1323355854-4650515797-*") {$whichAD="**OLD AD Joined**" }

#write-host $oldAcc.samaccountname";" $AZAD.UserPrincipalName"; lic-> " $o3ad.IsLicensed ";" $oldacc.CanonicalName " IC LL;" + $newAcc.LastLogonDate + $whichAD

if ($oldAcc.LastLogonDate -eq $null)

{

write-host

write-host "logon name ; email; whichAD ; IC LastLogonDate ;LastLogonDate ;o365 lic-> IsLicensed ;" # WCA Not used;WCA LL; #

write-host $newAcc.SamAccountName ";" $newAcc.mail ";"$whichAD ";" ";IC LastLogon;" $newAcc.LastLogonDate ";o365 lic->" $o3ad.IsLicensed ";" $newacc.CanonicalName # WCA Not used;WCA LL; $oldAcc.LastLogonDate

}

if ($oldAcc.LastLogonDate -ne $null)

{

write-host

write-host "logon name ; email; whichAD ; UserPrincipalName/email; IC LastLogonDate; LastLogonDate ; o365lic-> IsLicensed ; ##"

write-host $newAcc.SamAccountName ";" $newAcc.mail ";"$whichAD ";"$AZAD.UserPrincipalName ";IC LastLogon;" $newAcc.LastLogonDate ";" ";o365lic->" $o3ad.IsLicensed ";" $newacc.CanonicalName #;WCA LL;" $oldAcc.LastLogonDate "

}

Catch

{

write-host

#write-host "logon name; email; Not in Office 365; UPN; IC LL; LastLogonDate; CanonicalName, ###"

write-host $newAcc.SamAccountName ";" $newAcc.mail "; Not in Office 365;" $newACC.UserPrincipalName "; IC LastLogon;" $newAcc.LastLogonDate ";"# $newacc.CanonicalName $newAcc.DistinguishedName

#redundent

#write-host $oldAcc.SamAccountName + $oldAcc.LastLogonDate + "not in O365"

}