Note-to-self: OneDrive (For Business) vs SharePoint Online

Just got a question about the differences between OneDrive (for Business) and SharePoint Online… As it’s not my core knowledge, I just did some quick research, which might serve your knowledge too… Here we go.

Sources:

The page on OneDrive for Business Service Description has a very interesting comparison, but IMHO, it’s missing a bit of color.
So, I’ve reworked the page slightly (but all credits to the Microsoft Product team.

 

Table of Contents

 

Developer features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Access Services
Yes Yes Yes Yes

App Catalog (SharePoint)
Yes Yes Yes Yes

App Deployment: Cloud-Hosted Apps
Yes Yes Yes Yes

App Deployment: SharePoint-Hosted Apps
Yes Yes Yes Yes

App Management Services
Yes Yes Yes Yes

BCS: Alerts for External Lists
No No No Yes

BCS: App Scoped External Content Types (ECTs)
No No No Yes

BCS: Business Data Webparts
No No No Yes

BCS: External List
No No No Yes

BCS: OData connector
No No No Yes

BCS: Profile Pages
No No No No

BCS: Rich Client Integration
No No No No

BCS: Secure Store Service
No No No Yes

BCS: Tenant-level external data log
No No No Yes

Browser-based customizations
Yes Yes Yes Yes

Client Object Model (OM)
Yes Yes Yes Yes

Client-side rendering (CSR)
Yes Yes Yes Yes

Custom Site Definitions
No No No No

Custom Site Provisioning
No No No No

Developer Site
No No Yes Yes

Forms Based Applications
No No Yes Yes

Full-Trust Solutions
No No No No

InfoPath Forms Services
No No No Yes

JavaScript Object Model
Yes Yes Yes Yes

List and Library APIs
Yes Yes Yes Yes

Remote Event Receiver
No No Yes Yes

REST API
Yes Yes Yes Yes

Sandboxed Solutions
Yes Yes Yes Yes

SharePoint Design Manager
No No Yes Yes

SharePoint Designer
No No Yes Yes

SharePoint Store
2
Yes Yes Yes Yes

Workflow 2010 (.NET 3.5)
No No Yes Yes

Workflow 2010 (out of the box)
No No Yes Yes

Workflow 2013
No No Yes Yes

Workload API: ECM APIs
No No Yes Yes

Workload API: Search APIs
No No Yes Yes

Workload API: Social APIs
No No Yes Yes

 

IT Professional features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Active Directory Synchronization
Yes Yes Yes Yes

Alternate Access Mapping (AAM)
No No No No

Analytics Platform
No No Yes Yes

Anti-malware protection
Yes Yes Yes Yes

Claims-Based Authentication Support
No No No No

Configuration Wizards
No No No No

Data loss prevention
No Yes No Yes

Deferred Site Collection upgrade
Yes Yes Yes Yes

Distributed Cache
No No No No

Encryption at rest
Yes Yes Yes Yes

Host Header Site Collections
No No No No

Improved Permissions Management
Yes Yes Yes Yes

Improved Self-Service Site Creation
No No No No

Managed Accounts
No No No No

Minimal Download Strategy (MDS)
Yes Yes Yes Yes

OAuth
Yes Yes Yes Yes

Patch Management
No No No No

Quota Templates
No No No No

Read-Only Database Support
No No No No

Remote BLOB Storage
No No No No

Request Management
No No No No

Request throttling
No No No No

Resource throttling
No No No No

Service Application Platform
No No Yes Yes

SharePoint Health Analyzer
No No No No

SharePoint admin center
Yes Yes Yes Yes

Shredded Storage
Yes Yes Yes Yes

Site Collection Compliance Policies
Yes Yes Yes Yes

Site Collection Health Checks
Yes Yes Yes Yes

State Service
No No No No

Streamlined Central Administration
No No No No

System Status Notifications
No No No No

Unattached Content Database Recovery
No No No No

Upgrade evaluation site collections
No No Yes Yes

Usage Reporting and Logging
No No No No

Windows PowerShell Support
Yes Yes Yes Yes

 

Content features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Accessibility Standards Support
Yes Yes Yes Yes

Asset Library Enhancements/Video Support
Yes Yes Yes Yes

Auditing
Yes Yes Yes Yes

Auditing & Reporting (e.g. doc edits, policy edits, deletes)
Yes Yes Yes Yes

Content Organizer
No No Yes Yes

Design Manager
No No Yes Yes

Document Sets
Yes Yes Yes Yes

Document Translation in Word Online
Yes4 Yes4 Yes4 Yes4

eDiscovery Search
Yes Yes Yes Yes

eDiscovery Hold
No Yes No Yes

eDiscovery Export
No Yes No Yes

Email enabled lists and libraries
No No No No

External Sharing: External Access
Yes Yes Yes Yes

External Sharing: Guest Link
Yes Yes Yes Yes

Folder Sync
Yes Yes Yes Yes

IRM using Azure AD Rights Management
No1 No1 No1 No1

IRM using Windows Server AD RMS
No No No No

Managed Metadata Service
No No Yes Yes

Metadata-driven Navigation
No No Yes Yes

Multi-stage Disposition
Yes Yes Yes Yes

Office Online (create/edit)
Yes Yes No No

Office Online (view)
Yes Yes Yes Yes

Office Web Apps Server integration
No No No No

PowerPoint Automation Services
No No No No

Preservation hold library
No Yes No Yes

Quick Edit
Yes Yes Yes Yes

Records management
No No Yes Yes

Recycle Bin (SharePoint admin center)
Yes Yes Yes Yes

Recycle Bin (site collection)
Yes Yes Yes Yes

Related Items
No No Yes Yes

Rich Media Management
No No Yes Yes

Shared Content Types
Yes Yes Yes Yes

SharePoint Translation Services
No No Yes Yes

Site mailbox
No No Yes Yes

Surveys
Yes Yes Yes Yes

Unique Document IDs
Yes Yes Yes Yes

Video Search
No No No Yes

WCM: Analytics
No No Yes Yes

WCM: Catalog
No No No Yes

WCM: Category page and catalog item page
No No No Yes

WCM: Search web parts
No No No Yes

WCM: Cross-Site publishing
No No No Yes

WCM: Designer Tools
No No Yes Yes

WCM: Faceted navigation
No No No No

WCM: Image Renditions
No No Yes Yes

WCM: Managed navigation
No No Yes Yes

WCM: Mobile and Device Rendering
No No Yes Yes

WCM: Multiple Domains
No No No No

WCM: Recommendations
No No Yes Yes

WCM: Search Engine Optimizations (SEO)
No No Yes Yes

Word Automation Services
No No No No

 

Insights features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Business Intelligence Center
No No No Yes

Calculated Measures and Members
No No No Yes

Data Connection Library
No No No Yes

Decoupled PivotTables and PivotCharts
No No No Yes

Excel Services
No No No Yes

Field list and Field Support
No No No Yes

Filter Enhancements
No No No Yes

Filter Search
No No No Yes

PerformancePoint Services
No No No No

PerformancePoint Services (PPS) Dashboard Migration
No No No No

Power View for Excel in SharePoint
No No No Yes

Power Pivot for Excel in SharePoint
No No No Yes

Quick Explore
No No No Yes

Scorecards & Dashboards
No No No No

SQL Server Reporting Services (SSRS) Integrated Mode
No No No No

Timeline Slicer
No No No Yes

Visio Services
No No No Yes

 

Search features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Advanced Content Processing
No No No No

Continuous crawls
Yes Yes Yes Yes

Custom entity extraction
No No No No

Deep links
Yes Yes Yes Yes

Event-based relevancy
Yes Yes Yes Yes

Expertise Search
Yes Yes Yes Yes

Extensible content processing
No No No No

Graphical refiners
Yes Yes Yes Yes

Hybrid search
Yes Yes Yes Yes

Manage search schema
No No Yes Yes

On-premises search index
No No No No

Phonetic name matching
Yes Yes Yes Yes

Query rules—Add promoted results
No No Yes Yes

Query rules—advanced actions
No No No No

Query spelling correction
No No Yes Yes

Query suggestions
No No Yes Yes

Query throttling
No No Yes Yes

Quick preview
Yes Yes Yes Yes

Ranking models
No Yes Yes2 Yes2

Refiners
Yes Yes Yes Yes

RESTful Query API/Query OM
Yes Yes Yes Yes

Result sources
Yes Yes Yes Yes

Search connector framework
No No No No

Search results sorting
Yes Yes Yes Yes

Search vertical: “Conversations”
Yes Yes Yes Yes

Search vertical: “People”
Yes Yes Yes Yes

Search vertical: “Video”
No No No Yes

“This List” searches
Yes Yes Yes Yes

 

Sites features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Change the look
No No Yes Yes

Connections to Microsoft Office Clients
Yes Yes Yes Yes

Cross Browser Support
Yes Yes Yes Yes

Custom Managed Paths
No No No No

Governance
Yes Yes Yes Yes

Large List Scalability and Management
Yes Yes Yes Yes

Mobile Connectivity
Yes Yes Yes Yes

Multi-Lingual User Interface
Yes Yes Yes Yes

My Tasks
No No Yes Yes

OOTB Web Parts
No No Yes Yes

Permissions Management
Yes Yes Yes Yes

Project functionality for team sites
No No Yes Yes

Project site template
No No Yes Yes

Project Summary web part
No No Yes Yes

Project workspace
No No Yes Yes

SharePoint Lists
No No Yes Yes

SharePoint Ribbon
No No Yes Yes

Site folders
No No Yes Yes

Task list
No No Yes Yes

Team Site: Drag & Drop
No No Yes Yes

Team Site: Notebook
No No Yes Yes

Team Site: Simplified Access
No No Yes Yes

Templates
No No Yes Yes

Themes
No No Yes Yes

Usage Analytics
No No Yes Yes

Variations
No No Yes Yes

Work Management Service
No No Yes Yes

 

Social features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Ask Me About
Yes Yes Yes Yes

Blogs
No No Yes Yes

Communities Reputation, Badging, and Moderation
No No Yes Yes

Community
No No Yes Yes

Company Feed
No No Yes Yes

Document Conversations with Yammer
Yes Yes Yes Yes

Follow
Yes Yes Yes Yes

Microblogging
No No Yes Yes

Newsfeed
No No Yes Yes

One Click Sharing
Yes Yes Yes Yes

People, Sites, Document Recommendations
No No Yes Yes

Personal Site
Yes Yes Yes Yes

Photos and Presence
Yes Yes Yes Yes

Profile
Yes Yes Yes Yes

Ratings
Yes Yes Yes Yes

Shared with Me
Yes Yes Yes Yes

Site Feed
No No Yes Yes

OneDrive for Business
Yes Yes Yes Yes

Tag profiles
No No Yes Yes

Tasks integrated with Outlook
Yes Yes Yes Yes

Trending Tags
No No Yes Yes

Wikis
No No Yes Yes

 

Add-Ons OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Additional Storage
No No No No

Azure Provisioned Apps: Access Services
Yes Yes Yes Yes

Azure Provisioned Apps: Custom Code in Azure LWR
Yes Yes Yes Yes

Duet Online
No No No No

Microsoft released #MIM2016 Service Pack 1 UPDATE package

Source: https://aka.ms/mim2016sp1upgrade

Since the release of MIM 2016 SP1 just a few weeks ago, Microsoft received significant feedback from the community, their partners and customers regarding the upgrade paths for the service pack.

8th of November, Microsoft announced the availability of the MIM 2016 SP1 Update MSP.

This MSP allows current customers on MIM 2016 RTM, or any hotfix build since 2016 RTM to perform an in-place upgrade to the current build of this MSP (4.4.1302.0).

The supported in-place upgrade scenarios are outlined in the table below. To obtain this update, please click here.

Please note, an updated MSI for new implementations is likely to be released soon.

Carefully check the upgrade paths, as this MSP cannot be applied to build 4.4.1296.0 (MIM 2016 SP1 RTM).

The download page explicitly mentions: “MIM 2016 RTM Versions to update their infrastructure to the latest SP1 Build without complete uninstall. Customers already on MIM 2016 SP1 (4.4.1237) can not install this patch. 

Supported Operating System

Windows Server 2012, Windows Server 2012 R2, Windows Server 2016

MIM 2016 RTM or one of the following hotfix builds: 4.3.2064.0 4.3.2195.0 4.3.2266.0″

 

Initial Build Hotfix Applied Build after SP1 Update
RTM None 4.4.1302.0
RTM 4.3.2064.0 4.4.1302.0
RTM 4.3.2064.0, 4.3.2195.0 4.4.1302.0
RTM 4.3.2195.0 4.4.1302.0
RTM 4.3.2266.0 4.4.1302.0

Additionally, for customers running Office 2010 needing the x86 Add-ins and Extensions, do not update using this MSP, a forthcoming hotfix will be made available in the coming months.

If you have any comments for the Product Group, please send us an email at: mim2016@microsoft.com

 

Active Directory PowerShell: List items with “Protect object from accidental deletion” setting

Freshly posted for you on TNWiki: http://social.technet.microsoft.com/wiki/contents/articles/36088.active-directory-powershell-list-items-with-protect-object-from-accidental-deletion-setting.aspx

 


Introduction

Ever got in a situation where you as AD domain admin were blocked from
deleting items?

Or did you ever receive an “Access denied” when you tried to delete items
from AD, even with full admin rights?

Then you better check if AD has the “protect from accidental deletion”
activated on the object, container or OU…

In case you want to check a larger collection of items for this setting, it
quickly becomes complicated.

This article helps you to get an overview by using Powershell, and an export
of the impacted items to a CSV file.

As explained by : James ONeill (Windows Server 2008 Protection from Accidental Deletion)

“The functionality to prevent accidental deletion is not based on a new attribute in Active Directory.  It is enabled by ticking a check box on the Object tab of the particular object you wish to protect.  The Object tab is only visible when the Advanced Features option is selected from the View menu of Active Directory Users and Computers. When the tick box is checked the permissions on the object are changed. A “Deny” permission is created which stops deletion of the object.  “

 


Overview

This script finds all AD objects protected from accidental deletions.

 


Credits

This script uses logic that has been developed by:

 


Source references



Active Directory OU Permissions Report: Free PowerShell Script Download

 


Preventing Unwanted/Accidental deletions and Restore deleted objects in Active
Directory

 


Windows Server 2008 Protection from Accidental Deletion

 


Prerequisites

This script only runs if you can load the AD PS module eg. run the analysis
on a DC.

 


Downloads (Gallery)

 


Source Code

Full Version (with progress bar)

001002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068

069

070

071

072

073

074

075

076

077

078

079

080

081

082

083

084

085

086

087

088

089

090

091

092

093

094

095

096

097

098

099

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122


<##############################################################################
Author: Peter Geelen

Quest For Security

October 2016
https://identityunderground.wordpress.com

This script finds all AD objects protected by accidental deletions.

Credits: This script uses logic that has been developed by:

– Ashley McGlone, Microsoft Premier Field Engineer, March 2013, http://aka.ms/GoateePFE

– Source: https://gallery.technet.microsoft.com/Active-Directory-OU-1d09f989

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code,

provided that You agree:

(i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded;and

(iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys  fees, that arise or result from the use or distribution of the Sample Code.

 

This posting is provided “AS IS” with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm.

##############################################################################>


#—————————————————————————–

#Source references


#—————————————————————————–


#Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory

#abizer_hazratJune 9, 2009


#https://blogs.technet.microsoft.com/abizerh/2009/06/09/preventing-unwantedaccidental-deletions-and-restore-deleted-objects-in-active-directory/


#Windows Server 2008 Protection from Accidental Deletion

#James ONeill, October 31, 2007


#https://blogs.technet.microsoft.com/industry_insiders/2007/10/31/windows-server-2008-protection-from-accidental-deletion/


#—————————————————————————–

#Prerequisites: 


#this script only runs if you can load the AD PS module

#eg. run the analysis on a DC


#—————————————————————————–

cls

import-module activedirectory


#—————————————————————————–

#initialisation


#—————————————————————————–


#the CSV file is saved in the same directory as the PS file

$csvFile = $MyInvocation.MyCommand.Definition -replace ‘ps1’,‘csv’

$report = @()

#(*) Credits 

$schemaIDGUID = @{}


### NEED TO RECONCILE THE CONFLICTS ###

$ErrorActionPreference = ‘SilentlyContinue’

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter ‘(schemaIDGUID=*)’ -Properties name, schemaIDGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

Get-ADObject -SearchBase “CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)” -LDAPFilter ‘(objectClass=controlAccessRight)’ -Properties name, rightsGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$_.name)}

$ErrorActionPreference = ‘Continue’

#(*)


#—————————————————————————–

#Functions


#—————————————————————————–

function CheckProtection

{

    param($obj)

    $path = “AD:\” + $obj

    Get-Acl -Path $path | `

    Select-Object -ExpandProperty Access | `

    Where-Object {($_.ActiveDirectoryRights -like “*DeleteTree*”-AND ($_.AccessControlType -eq “Deny”)} | `

        #(*)

        Select-Object @{name=‘Object’;expression={$obj}}, `

        @{name=‘objectTypeName’;expression={if ($_.objectType.ToString() -eq ‘00000000-0000-0000-0000-000000000000’) {‘All’Else {$schemaIDGUID.Item($_.objectType)}}}, `

        @{name=‘inheritedObjectTypeName’;expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `

        #(*)

        ActiveDirectoryRights,

        ObjectFlags,

        AccessControlType,

        IdentityReference,

        IsInherited,

        InheritanceFlags,

        PropagationFlags

}


#—————————————————————————–

#MAIN


#—————————————————————————–

#add the top domain

$OUs = @(Get-ADDomain | Select-Object -ExpandProperty DistinguishedName)

#add the OUs

$OUs += Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

#add other containers

$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(|(objectClass=container)(objectClass=builtinDomain))’ | Select-Object -ExpandProperty DistinguishedName


#if you don’t want to scan the builtin container use line below instead of line above


#$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(objectClass=container)’ | Select-Object -ExpandProperty DistinguishedName


#set the target objects types to investigate


#including users, groups, contacts, computers

$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer))’


#$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer)(objectclass=Foreign-Security-Principal))’


#not included: Foreign-Security-Principal, msTPM-InformationObjectsContainer, msDS-QuotaContainer, lostAndFound,

$iSeqNo = 0

$OUCount = $OUs.Count

ForEach ($OU in $OUs

{

    $iSeqNo++

    $pct = ([int]($iSeqNo/$OUCount * 100))

    $activity = “Analyzing container: “+ $OU

    Write-Progress -activity $activity -status “Please wait” -percentcomplete $pct -currentoperation “now processing container $iSeqNo of $OUCount” -id 1

    #check the protection of the parent container

    $isProtected = 

    $isProtected = CheckProtection $OU

    if ($isProtected -ne $null) {$report += $isProtected}

    

    #Lookup the child target objects in the parent container

    $objects = Get-ADObject -SearchBase $OU -SearchScope OneLevel -LDAPFilter $ldapfilter | Select-Object -ExpandProperty DistinguishedName

    $iSubSeqNo = 0

    $ObjCount = $objects.Count

    

    #check the protection of the child objects

    ForEach ($object in $objects)

    {

        $iSubSeqNo++

        $iSubpct = ([int]($iSubSeqNo/$ObjCount * 100))

        $SubActivity = “Analyzing object: “+ $object 

        Write-Progress -activity $SubActivity -status “Please wait” -percentcomplete $iSubpct -currentoperation “now processing object $iSubSeqNo of $ObjCount” -ParentId 1 -id 2

    

        $isProtected = 

        $isProtected = CheckProtection $object

        if ($isProtected -ne $null) {$report += $isProtected}

    }

        Write-Progress -activity “Analyzing object completed.” -status “Proceeding” -Completed -ParentId 1 -id 2

}

$report | Format-Table -Wrap

$report | Export-Csv -Path $csvFile -NoTypeInformation

 

Light version (without progress bar)

001002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068

069

070

071

072

073

074

075

076

077

078

079

080

081

082

083

084

085

086

087

088

089

090

091

092

093

094

095

096

097

098

099

100

101

102


<##############################################################################
Author: Peter Geelen Quest For Security  October 2016

https://identityunderground.wordpress.com

This script finds all AD objects protected by accidental deletions.

Credits: This script uses logic that has been developed by:

– Ashley McGlone, Microsoft Premier Field Engineer, March 2013, http://aka.ms/GoateePFE

– Source: https://gallery.technet.microsoft.com/Active-Directory-OU-1d09f989

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code,

provided that You agree:

(i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded;and

(iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys  fees, that arise or result from the use or distribution of the Sample Code.

 

This posting is provided “AS IS” with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm.

##############################################################################>


#—————————————————————————–

#Source references


#—————————————————————————–


#Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory

#abizer_hazratJune 9, 2009


#https://blogs.technet.microsoft.com/abizerh/2009/06/09/preventing-unwantedaccidental-deletions-and-restore-deleted-objects-in-active-directory/


#Windows Server 2008 Protection from Accidental Deletion

#James ONeill, October 31, 2007


#https://blogs.technet.microsoft.com/industry_insiders/2007/10/31/windows-server-2008-protection-from-accidental-deletion/


#—————————————————————————–

#Prerequisites: 


#this script only runs if you can load the AD PS module

#eg. run the analysis on a DC


#—————————————————————————–

cls

import-module activedirectory


#—————————————————————————–

#initialisation


#—————————————————————————–


#the CSV file is saved in the same directory as the PS file

$csvFile = $MyInvocation.MyCommand.Definition -replace ‘ps1’,‘csv’

$report = @()

#(*) Credits 

$schemaIDGUID = @{}


### NEED TO RECONCILE THE CONFLICTS ###

$ErrorActionPreference = ‘SilentlyContinue’

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter ‘(schemaIDGUID=*)’ -Properties name, schemaIDGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

Get-ADObject -SearchBase “CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)” -LDAPFilter ‘(objectClass=controlAccessRight)’ -Properties name, rightsGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$_.name)}

$ErrorActionPreference = ‘Continue’

#(*)


#—————————————————————————–

#Functions


#—————————————————————————–

function CheckProtection

{

    param($obj)

    $path = “AD:\” + $obj

    Get-Acl -Path $path | `

    Select-Object -ExpandProperty Access | `

    Where-Object {($_.ActiveDirectoryRights -like “*DeleteTree*”-AND ($_.AccessControlType -eq “Deny”)} | `

        #(*)

        Select-Object @{name=‘Object’;expression={$obj}}, `

        @{name=‘objectTypeName’;expression={if ($_.objectType.ToString() -eq ‘00000000-0000-0000-0000-000000000000’) {‘All’Else {$schemaIDGUID.Item($_.objectType)}}}, `

        @{name=‘inheritedObjectTypeName’;expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `

        #(*)

        ActiveDirectoryRights,

        ObjectFlags,

        AccessControlType,

        IdentityReference,

        IsInherited,

        InheritanceFlags,

        PropagationFlags

}


#—————————————————————————–

#MAIN


#—————————————————————————–

#add the top domain

$OUs = @(Get-ADDomain | Select-Object -ExpandProperty DistinguishedName)

#add the OUs

$OUs += Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

#add other containers

$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(|(objectClass=container)(objectClass=builtinDomain))’ | Select-Object -ExpandProperty DistinguishedName


#if you don’t want to scan the builtin container use line below instead of line above


#$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(objectClass=container)’ | Select-Object -ExpandProperty DistinguishedName


#set the target objects types to investigate


#including users, groups, contacts, computers

$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer))’


#$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer)(objectclass=Foreign-Security-Principal))’


#not included: Foreign-Security-Principal, msTPM-InformationObjectsContainer, msDS-QuotaContainer, lostAndFound,

ForEach ($OU in $OUs

{

    #check the protection of the parent container

    $isProtected = 

    $isProtected = CheckProtection $OU

    if ($isProtected -ne $null) {$report += $isProtected}

    

    #Lookup the child target objects in the parent container

    $objects = Get-ADObject -SearchBase $OU -SearchScope OneLevel -LDAPFilter $ldapfilter | Select-Object -ExpandProperty DistinguishedName

    #check the protection of the child objects

    ForEach ($object in $objects)

    {

        $isProtected = 

        $isProtected = CheckProtection $object

        if ($isProtected -ne $null) {$report += $isProtected}

    }

}

$report | Format-Table -Wrap

$report | Export-Csv -Path $csvFile -NoTypeInformation

 

 


Disclaimer

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of
illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR  PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify
the Sample Code and to reproduce and distribute the object code form of the
Sample Code,

provided that You agree:

(i) to not use Our name, logo, or
trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which
the Sample Code is embedded; and

(iii) to indemnify, hold harmless, and
defend Us and Our suppliers from and against any claims or lawsuits, including
attorneys’ fees, that arise or result from the use or distribution of the Sample
Code.

This posting is provided “AS IS” with no warranties, and confers no
rights.


#MIM2016 Troubleshooting: FIM MA Full import error 0x80070002

This post has been published on TNWiki too, and waiting for your input at: MIM 2016 Troubleshooting: FIM MA Full import error 0x80070002


Symptoms

When you try to run an Full import run profile on the MIMMA, you get an error message in the MIM GUI.

On screen

Unable to run the management agent.

The system cannot find the file specified. (Exception from HRESULT: 0x80070002)

Error message

 

Log Name:      Application
Source:        FIMSynchronizationService
Date:          10/17/2016 5:38:58 PM
Event ID:      6309
Task Category: Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER.SUBDOMAIN.AD.ACCEPT.ROOT
Description:
The server encountered an unexpected error while performing an operation for a management agent.
"BAIL: MMS(39888): ..\ma.cpp(3781): 0x80070002 (The system cannot find the file specified.)
Forefront Identity Manager 4.3.1935.0"
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="FIMSynchronizationService" />
    <EventID Qualifiers="49152">6309</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-10-17T15:38:58.000000000Z" />
    <EventRecordID>409902</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVER.SUBDOMAIN.AD.ACCEPT.ROOT</Computer>
    <Security />
  </System>
  <EventData>
<Data>BAIL: MMS(39888): ..\ma.cpp(3781): 0x80070002 (The system cannot find the file specified.)
Forefront Identity Manager 4.3.1935.0</Data>
  </EventData>
</Event>

Other symptoms

When you try to stop the run of the MIM MA you get an error.

Root cause

The option “run the management agent in a separate process” is activated.

Resolution

Uncheck the option “Run this management agent in a separate process” from the “Configure extensions” item in the management agent properties.


Note-to-self: Security Compliance Manager 4.0 now available for download!

Sometime you get some silent signals that you have been way too busy…

Like stumbling into an announcement of a tool you evangelise…

Security Compliance Manager 4.0 now available for download!

 

 

 

Thank you!

This weekend I’ve received some pretty exciting news that I was awarded the 2016 MVP award (Microsoft Most Valuable Professional) for Enterprise Mobility (Identity & Access).

mvp_logo

I’m extremely proud to receive the award, but I never could have achieved this award without your support. So, in the first place I want to thank YOU for supporting me and making it possible. With your help I certainly will continue to support and build the Microsoft and security community with great pride.

A great thanks to Ed Price, Ronen Ariely, Gokan Ozcifci and Jorge de Almeida Pinto for the support and recommendations. (I sincerely hope I haven’t forgotten anyone…) I owe you Belgian beer.

I had the honor to be part of the program earlier, and never have stopped to build and maintain the community with passion for Identity and Access management, but as combining Microsoft FTE with MVP is not possible… I had a break for the years at MS… still it was different.

I’m also extremely thankful that my wife Katrien and my 2 kids can cope with my crazy passion for TechNet Wiki and MS community obsession. This addiction is just so much fun…but I’ll never admit that. (oh ships, just did…)

#FIM2010 & #MIM2016 Error 25009 fun stuff on #TNWiki

For the FIM Geeks, I’ve submitted some new FIM/MIM 25009 event troubleshooting articles on TechNet Wiki (http://aka.ms/Wiki)

Plus, a page the collects all the 25009 trroubleshooting resources, including lots of fun stuff of Tim Macauly.

If you got more of this 25009 fun stuff yourself, feel free to add your articles and add them to the collection page.