Active Directory

If you use Active Directory Domain Services, you should definitely check whether the AD Recycle Bin is enabled in your environment. What is the AD Recycle Bin? The AD Recycle Bin works similarly to the Recycle Bin in the file system: Deleted objects (users, groups, and so on) are first moved to the Recycle Bin and can be restored easily. This is especially useful for: accidental deletions intentional deletions that need to be undone missing AD backups (which do not replace a backup) The AD Recycle Bin was introduced with Windows Server 2008 R2. Requirement: your AD forest must have at least the Windows Server 2008 R2 functional level. ...

In this post, I will explain how Entra Connect merges identities and then continues to track them in operation. Some points could be explored in more depth, but these are the most important fundamentals in my opinion. Everything I describe here is usually relevant for both classic Entra Connect Sync and the newer Entra Cloud Sync. If something only applies to one of the two sync tools, I will point that out explicitly. Otherwise, for simplicity, I will just write Entra Connect below when I mean both. ...

If you quickly want to retrieve infos about Active Directory Based Activation (ADBA) in your domain, you can use this PowerShell One-liner: 1 Get-ADDomain | %{Get-ADObject -SearchBase "CN=Activation Objects,CN=Microsoft SPP,CN=Services,CN=Configuration,$($_.DistinguishedName)" -LDAPFilter "(objectclass=msspp-activationobject)" -Properties * -ErrorAction SilentlyContinue | fl displayName,DistinguishedName,Name,msspp-csvlkpartialproductkey } I haven’t tested it in a multi-domain environment, but I think it should work. Explanation The code uses aliases, which are not great in scripts, but neat in One-Liners. It uses Get-ADDomain to determine the Distinguished Name for the Domain. This should make the code portable. ...

I recently worked on a client project, where I had to do some work around Active Directory Computers. I used PowerShell and some light filtering and processing. And now I share those examples, and hopefully someone finds them interesting or helpful. Maybe it will be me, who finds it interesting in the future. In that case: Moin Andi! 👋 Example 1: Filter Computer by Operating System Version The AD attribute OperatingSystemVersion holds the OS version with the build number in a format like this: 10.0 (19041) ...

I had this weird issue with a Exchange Server environment: The company had an Exchange Server 2016 DAG and migrated all User Mailboxes to Exchange Online. I then installed a fresh Exchange Server 2019 for Recipient Management and SMTP-Relay. To use the Exchange Server 2019 Hybrid License, I did not create a Mailbox Database. I removed all remaining System Mailboxes and Arbitration Mailboxes from the Exchange 2016 Servers. I decomissioned the DAG and uninstalled Exchange from the old Servers. ...

It has been possible for some time to use the Exchange Server management tools without a full Exchange Server. Most guides assume that at least one Exchange Server already existed and was then removed. And the Microsoft documentation only briefly mentions the topic and does not really explain it. In this post I look at a scenario that affects many smaller companies: In the Microsoft 365 Admin Center it says: ...