Note-to-self: Got #MIM2016 product feedback, feature wish list? aka.ms/mimfeedback

Very short note-to-myself (#memory-function-on)…

David Steadman, respected @fimguy, now  @TheMIMGuy posted an interesting poke…

So, got any constructive suggestion, move over to that feedback page at:https://aka.ms/mimfeedback

Note-to-self: Windows 10 numeric keypad not working

Once they know you do “something with computers”, you can’t escape your family request fixing anything that goes wrong on machines with a CPU, right?

Last weekend a laptop was dropped of with a bizare symptom: once logged in, the numeric keypad stopped working.
Freshly migrated to Windows 10, a Toshiba Satellite c(something)…

When you quickly search for it on bing/google… you’ll find some hints like

  • updating BIOS (check, latest installed)
  • checking BIOS (well, …nah, it is working at logon)
  • registry settings (maybe, but ..nope, lets first try the normal stuff)
  • some other windows settings

This one got me started, but actually discussed the solution for Windows 7.
” if you have Windows 7, just go to Ease of Access Center >>>>>> Turn on Mouse Keys and make sure it’s unchecked”

Well, how about Windows 10?

First go to Settings.

w10settings

Find the Ease Of Access

Within Ease of Access, check the Mouse option

w10_eoa_mouse

In the Mouse settings, check the Mouse Keys settings.
Make sure the option to “use numeric keypad to move mouse around the screen” is disabled/off.

Easy, simple, but this single setting isn’t easily found, as you won’t think about mouse settings.

Certainly, when searching apps, files and settings, and the setting does not show up when typing “numeric” or “keypad”

Note-to-self: OneDrive (For Business) vs SharePoint Online

Just got a question about the differences between OneDrive (for Business) and SharePoint Online… As it’s not my core knowledge, I just did some quick research, which might serve your knowledge too… Here we go.

Sources:

The page on OneDrive for Business Service Description has a very interesting comparison, but IMHO, it’s missing a bit of color.
So, I’ve reworked the page slightly (but all credits to the Microsoft Product team.

 

Table of Contents

 

Developer features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Access Services
Yes Yes Yes Yes

App Catalog (SharePoint)
Yes Yes Yes Yes

App Deployment: Cloud-Hosted Apps
Yes Yes Yes Yes

App Deployment: SharePoint-Hosted Apps
Yes Yes Yes Yes

App Management Services
Yes Yes Yes Yes

BCS: Alerts for External Lists
No No No Yes

BCS: App Scoped External Content Types (ECTs)
No No No Yes

BCS: Business Data Webparts
No No No Yes

BCS: External List
No No No Yes

BCS: OData connector
No No No Yes

BCS: Profile Pages
No No No No

BCS: Rich Client Integration
No No No No

BCS: Secure Store Service
No No No Yes

BCS: Tenant-level external data log
No No No Yes

Browser-based customizations
Yes Yes Yes Yes

Client Object Model (OM)
Yes Yes Yes Yes

Client-side rendering (CSR)
Yes Yes Yes Yes

Custom Site Definitions
No No No No

Custom Site Provisioning
No No No No

Developer Site
No No Yes Yes

Forms Based Applications
No No Yes Yes

Full-Trust Solutions
No No No No

InfoPath Forms Services
No No No Yes

JavaScript Object Model
Yes Yes Yes Yes

List and Library APIs
Yes Yes Yes Yes

Remote Event Receiver
No No Yes Yes

REST API
Yes Yes Yes Yes

Sandboxed Solutions
Yes Yes Yes Yes

SharePoint Design Manager
No No Yes Yes

SharePoint Designer
No No Yes Yes

SharePoint Store
2
Yes Yes Yes Yes

Workflow 2010 (.NET 3.5)
No No Yes Yes

Workflow 2010 (out of the box)
No No Yes Yes

Workflow 2013
No No Yes Yes

Workload API: ECM APIs
No No Yes Yes

Workload API: Search APIs
No No Yes Yes

Workload API: Social APIs
No No Yes Yes

 

IT Professional features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Active Directory Synchronization
Yes Yes Yes Yes

Alternate Access Mapping (AAM)
No No No No

Analytics Platform
No No Yes Yes

Anti-malware protection
Yes Yes Yes Yes

Claims-Based Authentication Support
No No No No

Configuration Wizards
No No No No

Data loss prevention
No Yes No Yes

Deferred Site Collection upgrade
Yes Yes Yes Yes

Distributed Cache
No No No No

Encryption at rest
Yes Yes Yes Yes

Host Header Site Collections
No No No No

Improved Permissions Management
Yes Yes Yes Yes

Improved Self-Service Site Creation
No No No No

Managed Accounts
No No No No

Minimal Download Strategy (MDS)
Yes Yes Yes Yes

OAuth
Yes Yes Yes Yes

Patch Management
No No No No

Quota Templates
No No No No

Read-Only Database Support
No No No No

Remote BLOB Storage
No No No No

Request Management
No No No No

Request throttling
No No No No

Resource throttling
No No No No

Service Application Platform
No No Yes Yes

SharePoint Health Analyzer
No No No No

SharePoint admin center
Yes Yes Yes Yes

Shredded Storage
Yes Yes Yes Yes

Site Collection Compliance Policies
Yes Yes Yes Yes

Site Collection Health Checks
Yes Yes Yes Yes

State Service
No No No No

Streamlined Central Administration
No No No No

System Status Notifications
No No No No

Unattached Content Database Recovery
No No No No

Upgrade evaluation site collections
No No Yes Yes

Usage Reporting and Logging
No No No No

Windows PowerShell Support
Yes Yes Yes Yes

 

Content features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Accessibility Standards Support
Yes Yes Yes Yes

Asset Library Enhancements/Video Support
Yes Yes Yes Yes

Auditing
Yes Yes Yes Yes

Auditing & Reporting (e.g. doc edits, policy edits, deletes)
Yes Yes Yes Yes

Content Organizer
No No Yes Yes

Design Manager
No No Yes Yes

Document Sets
Yes Yes Yes Yes

Document Translation in Word Online
Yes4 Yes4 Yes4 Yes4

eDiscovery Search
Yes Yes Yes Yes

eDiscovery Hold
No Yes No Yes

eDiscovery Export
No Yes No Yes

Email enabled lists and libraries
No No No No

External Sharing: External Access
Yes Yes Yes Yes

External Sharing: Guest Link
Yes Yes Yes Yes

Folder Sync
Yes Yes Yes Yes

IRM using Azure AD Rights Management
No1 No1 No1 No1

IRM using Windows Server AD RMS
No No No No

Managed Metadata Service
No No Yes Yes

Metadata-driven Navigation
No No Yes Yes

Multi-stage Disposition
Yes Yes Yes Yes

Office Online (create/edit)
Yes Yes No No

Office Online (view)
Yes Yes Yes Yes

Office Web Apps Server integration
No No No No

PowerPoint Automation Services
No No No No

Preservation hold library
No Yes No Yes

Quick Edit
Yes Yes Yes Yes

Records management
No No Yes Yes

Recycle Bin (SharePoint admin center)
Yes Yes Yes Yes

Recycle Bin (site collection)
Yes Yes Yes Yes

Related Items
No No Yes Yes

Rich Media Management
No No Yes Yes

Shared Content Types
Yes Yes Yes Yes

SharePoint Translation Services
No No Yes Yes

Site mailbox
No No Yes Yes

Surveys
Yes Yes Yes Yes

Unique Document IDs
Yes Yes Yes Yes

Video Search
No No No Yes

WCM: Analytics
No No Yes Yes

WCM: Catalog
No No No Yes

WCM: Category page and catalog item page
No No No Yes

WCM: Search web parts
No No No Yes

WCM: Cross-Site publishing
No No No Yes

WCM: Designer Tools
No No Yes Yes

WCM: Faceted navigation
No No No No

WCM: Image Renditions
No No Yes Yes

WCM: Managed navigation
No No Yes Yes

WCM: Mobile and Device Rendering
No No Yes Yes

WCM: Multiple Domains
No No No No

WCM: Recommendations
No No Yes Yes

WCM: Search Engine Optimizations (SEO)
No No Yes Yes

Word Automation Services
No No No No

 

Insights features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Business Intelligence Center
No No No Yes

Calculated Measures and Members
No No No Yes

Data Connection Library
No No No Yes

Decoupled PivotTables and PivotCharts
No No No Yes

Excel Services
No No No Yes

Field list and Field Support
No No No Yes

Filter Enhancements
No No No Yes

Filter Search
No No No Yes

PerformancePoint Services
No No No No

PerformancePoint Services (PPS) Dashboard Migration
No No No No

Power View for Excel in SharePoint
No No No Yes

Power Pivot for Excel in SharePoint
No No No Yes

Quick Explore
No No No Yes

Scorecards & Dashboards
No No No No

SQL Server Reporting Services (SSRS) Integrated Mode
No No No No

Timeline Slicer
No No No Yes

Visio Services
No No No Yes

 

Search features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Advanced Content Processing
No No No No

Continuous crawls
Yes Yes Yes Yes

Custom entity extraction
No No No No

Deep links
Yes Yes Yes Yes

Event-based relevancy
Yes Yes Yes Yes

Expertise Search
Yes Yes Yes Yes

Extensible content processing
No No No No

Graphical refiners
Yes Yes Yes Yes

Hybrid search
Yes Yes Yes Yes

Manage search schema
No No Yes Yes

On-premises search index
No No No No

Phonetic name matching
Yes Yes Yes Yes

Query rules—Add promoted results
No No Yes Yes

Query rules—advanced actions
No No No No

Query spelling correction
No No Yes Yes

Query suggestions
No No Yes Yes

Query throttling
No No Yes Yes

Quick preview
Yes Yes Yes Yes

Ranking models
No Yes Yes2 Yes2

Refiners
Yes Yes Yes Yes

RESTful Query API/Query OM
Yes Yes Yes Yes

Result sources
Yes Yes Yes Yes

Search connector framework
No No No No

Search results sorting
Yes Yes Yes Yes

Search vertical: “Conversations”
Yes Yes Yes Yes

Search vertical: “People”
Yes Yes Yes Yes

Search vertical: “Video”
No No No Yes

“This List” searches
Yes Yes Yes Yes

 

Sites features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Change the look
No No Yes Yes

Connections to Microsoft Office Clients
Yes Yes Yes Yes

Cross Browser Support
Yes Yes Yes Yes

Custom Managed Paths
No No No No

Governance
Yes Yes Yes Yes

Large List Scalability and Management
Yes Yes Yes Yes

Mobile Connectivity
Yes Yes Yes Yes

Multi-Lingual User Interface
Yes Yes Yes Yes

My Tasks
No No Yes Yes

OOTB Web Parts
No No Yes Yes

Permissions Management
Yes Yes Yes Yes

Project functionality for team sites
No No Yes Yes

Project site template
No No Yes Yes

Project Summary web part
No No Yes Yes

Project workspace
No No Yes Yes

SharePoint Lists
No No Yes Yes

SharePoint Ribbon
No No Yes Yes

Site folders
No No Yes Yes

Task list
No No Yes Yes

Team Site: Drag & Drop
No No Yes Yes

Team Site: Notebook
No No Yes Yes

Team Site: Simplified Access
No No Yes Yes

Templates
No No Yes Yes

Themes
No No Yes Yes

Usage Analytics
No No Yes Yes

Variations
No No Yes Yes

Work Management Service
No No Yes Yes

 

Social features OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Ask Me About
Yes Yes Yes Yes

Blogs
No No Yes Yes

Communities Reputation, Badging, and Moderation
No No Yes Yes

Community
No No Yes Yes

Company Feed
No No Yes Yes

Document Conversations with Yammer
Yes Yes Yes Yes

Follow
Yes Yes Yes Yes

Microblogging
No No Yes Yes

Newsfeed
No No Yes Yes

One Click Sharing
Yes Yes Yes Yes

People, Sites, Document Recommendations
No No Yes Yes

Personal Site
Yes Yes Yes Yes

Photos and Presence
Yes Yes Yes Yes

Profile
Yes Yes Yes Yes

Ratings
Yes Yes Yes Yes

Shared with Me
Yes Yes Yes Yes

Site Feed
No No Yes Yes

OneDrive for Business
Yes Yes Yes Yes

Tag profiles
No No Yes Yes

Tasks integrated with Outlook
Yes Yes Yes Yes

Trending Tags
No No Yes Yes

Wikis
No No Yes Yes

 

Add-Ons OneDrive for Business Plan 1 OneDrive for Business Plan 2 SharePoint Online Plan 1 SharePoint Online Plan 2

Additional Storage
No No No No

Azure Provisioned Apps: Access Services
Yes Yes Yes Yes

Azure Provisioned Apps: Custom Code in Azure LWR
Yes Yes Yes Yes

Duet Online
No No No No

Active Directory PowerShell: List items with “Protect object from accidental deletion” setting

Freshly posted for you on TNWiki: http://social.technet.microsoft.com/wiki/contents/articles/36088.active-directory-powershell-list-items-with-protect-object-from-accidental-deletion-setting.aspx

 


Introduction

Ever got in a situation where you as AD domain admin were blocked from
deleting items?

Or did you ever receive an “Access denied” when you tried to delete items
from AD, even with full admin rights?

Then you better check if AD has the “protect from accidental deletion”
activated on the object, container or OU…

In case you want to check a larger collection of items for this setting, it
quickly becomes complicated.

This article helps you to get an overview by using Powershell, and an export
of the impacted items to a CSV file.

As explained by : James ONeill (Windows Server 2008 Protection from Accidental Deletion)

“The functionality to prevent accidental deletion is not based on a new attribute in Active Directory.  It is enabled by ticking a check box on the Object tab of the particular object you wish to protect.  The Object tab is only visible when the Advanced Features option is selected from the View menu of Active Directory Users and Computers. When the tick box is checked the permissions on the object are changed. A “Deny” permission is created which stops deletion of the object.  “

 


Overview

This script finds all AD objects protected from accidental deletions.

 


Credits

This script uses logic that has been developed by:

 


Source references



Active Directory OU Permissions Report: Free PowerShell Script Download

 


Preventing Unwanted/Accidental deletions and Restore deleted objects in Active
Directory

 


Windows Server 2008 Protection from Accidental Deletion

 


Prerequisites

This script only runs if you can load the AD PS module eg. run the analysis
on a DC.

 


Downloads (Gallery)

 


Source Code

Full Version (with progress bar)

001002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068

069

070

071

072

073

074

075

076

077

078

079

080

081

082

083

084

085

086

087

088

089

090

091

092

093

094

095

096

097

098

099

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122


<##############################################################################
Author: Peter Geelen

Quest For Security

October 2016
https://identityunderground.wordpress.com

This script finds all AD objects protected by accidental deletions.

Credits: This script uses logic that has been developed by:

– Ashley McGlone, Microsoft Premier Field Engineer, March 2013, http://aka.ms/GoateePFE

– Source: https://gallery.technet.microsoft.com/Active-Directory-OU-1d09f989

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code,

provided that You agree:

(i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded;and

(iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys  fees, that arise or result from the use or distribution of the Sample Code.

 

This posting is provided “AS IS” with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm.

##############################################################################>


#—————————————————————————–

#Source references


#—————————————————————————–


#Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory

#abizer_hazratJune 9, 2009


#https://blogs.technet.microsoft.com/abizerh/2009/06/09/preventing-unwantedaccidental-deletions-and-restore-deleted-objects-in-active-directory/


#Windows Server 2008 Protection from Accidental Deletion

#James ONeill, October 31, 2007


#https://blogs.technet.microsoft.com/industry_insiders/2007/10/31/windows-server-2008-protection-from-accidental-deletion/


#—————————————————————————–

#Prerequisites: 


#this script only runs if you can load the AD PS module

#eg. run the analysis on a DC


#—————————————————————————–

cls

import-module activedirectory


#—————————————————————————–

#initialisation


#—————————————————————————–


#the CSV file is saved in the same directory as the PS file

$csvFile = $MyInvocation.MyCommand.Definition -replace ‘ps1’,‘csv’

$report = @()

#(*) Credits 

$schemaIDGUID = @{}


### NEED TO RECONCILE THE CONFLICTS ###

$ErrorActionPreference = ‘SilentlyContinue’

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter ‘(schemaIDGUID=*)’ -Properties name, schemaIDGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

Get-ADObject -SearchBase “CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)” -LDAPFilter ‘(objectClass=controlAccessRight)’ -Properties name, rightsGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$_.name)}

$ErrorActionPreference = ‘Continue’

#(*)


#—————————————————————————–

#Functions


#—————————————————————————–

function CheckProtection

{

    param($obj)

    $path = “AD:\” + $obj

    Get-Acl -Path $path | `

    Select-Object -ExpandProperty Access | `

    Where-Object {($_.ActiveDirectoryRights -like “*DeleteTree*”-AND ($_.AccessControlType -eq “Deny”)} | `

        #(*)

        Select-Object @{name=‘Object’;expression={$obj}}, `

        @{name=‘objectTypeName’;expression={if ($_.objectType.ToString() -eq ‘00000000-0000-0000-0000-000000000000’) {‘All’Else {$schemaIDGUID.Item($_.objectType)}}}, `

        @{name=‘inheritedObjectTypeName’;expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `

        #(*)

        ActiveDirectoryRights,

        ObjectFlags,

        AccessControlType,

        IdentityReference,

        IsInherited,

        InheritanceFlags,

        PropagationFlags

}


#—————————————————————————–

#MAIN


#—————————————————————————–

#add the top domain

$OUs = @(Get-ADDomain | Select-Object -ExpandProperty DistinguishedName)

#add the OUs

$OUs += Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

#add other containers

$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(|(objectClass=container)(objectClass=builtinDomain))’ | Select-Object -ExpandProperty DistinguishedName


#if you don’t want to scan the builtin container use line below instead of line above


#$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(objectClass=container)’ | Select-Object -ExpandProperty DistinguishedName


#set the target objects types to investigate


#including users, groups, contacts, computers

$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer))’


#$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer)(objectclass=Foreign-Security-Principal))’


#not included: Foreign-Security-Principal, msTPM-InformationObjectsContainer, msDS-QuotaContainer, lostAndFound,

$iSeqNo = 0

$OUCount = $OUs.Count

ForEach ($OU in $OUs

{

    $iSeqNo++

    $pct = ([int]($iSeqNo/$OUCount * 100))

    $activity = “Analyzing container: “+ $OU

    Write-Progress -activity $activity -status “Please wait” -percentcomplete $pct -currentoperation “now processing container $iSeqNo of $OUCount” -id 1

    #check the protection of the parent container

    $isProtected = 

    $isProtected = CheckProtection $OU

    if ($isProtected -ne $null) {$report += $isProtected}

    

    #Lookup the child target objects in the parent container

    $objects = Get-ADObject -SearchBase $OU -SearchScope OneLevel -LDAPFilter $ldapfilter | Select-Object -ExpandProperty DistinguishedName

    $iSubSeqNo = 0

    $ObjCount = $objects.Count

    

    #check the protection of the child objects

    ForEach ($object in $objects)

    {

        $iSubSeqNo++

        $iSubpct = ([int]($iSubSeqNo/$ObjCount * 100))

        $SubActivity = “Analyzing object: “+ $object 

        Write-Progress -activity $SubActivity -status “Please wait” -percentcomplete $iSubpct -currentoperation “now processing object $iSubSeqNo of $ObjCount” -ParentId 1 -id 2

    

        $isProtected = 

        $isProtected = CheckProtection $object

        if ($isProtected -ne $null) {$report += $isProtected}

    }

        Write-Progress -activity “Analyzing object completed.” -status “Proceeding” -Completed -ParentId 1 -id 2

}

$report | Format-Table -Wrap

$report | Export-Csv -Path $csvFile -NoTypeInformation

 

Light version (without progress bar)

001002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068

069

070

071

072

073

074

075

076

077

078

079

080

081

082

083

084

085

086

087

088

089

090

091

092

093

094

095

096

097

098

099

100

101

102


<##############################################################################
Author: Peter Geelen Quest For Security  October 2016

https://identityunderground.wordpress.com

This script finds all AD objects protected by accidental deletions.

Credits: This script uses logic that has been developed by:

– Ashley McGlone, Microsoft Premier Field Engineer, March 2013, http://aka.ms/GoateePFE

– Source: https://gallery.technet.microsoft.com/Active-Directory-OU-1d09f989

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code,

provided that You agree:

(i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded;and

(iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys  fees, that arise or result from the use or distribution of the Sample Code.

 

This posting is provided “AS IS” with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm.

##############################################################################>


#—————————————————————————–

#Source references


#—————————————————————————–


#Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory

#abizer_hazratJune 9, 2009


#https://blogs.technet.microsoft.com/abizerh/2009/06/09/preventing-unwantedaccidental-deletions-and-restore-deleted-objects-in-active-directory/


#Windows Server 2008 Protection from Accidental Deletion

#James ONeill, October 31, 2007


#https://blogs.technet.microsoft.com/industry_insiders/2007/10/31/windows-server-2008-protection-from-accidental-deletion/


#—————————————————————————–

#Prerequisites: 


#this script only runs if you can load the AD PS module

#eg. run the analysis on a DC


#—————————————————————————–

cls

import-module activedirectory


#—————————————————————————–

#initialisation


#—————————————————————————–


#the CSV file is saved in the same directory as the PS file

$csvFile = $MyInvocation.MyCommand.Definition -replace ‘ps1’,‘csv’

$report = @()

#(*) Credits 

$schemaIDGUID = @{}


### NEED TO RECONCILE THE CONFLICTS ###

$ErrorActionPreference = ‘SilentlyContinue’

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter ‘(schemaIDGUID=*)’ -Properties name, schemaIDGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.schemaIDGUID,$_.name)}

Get-ADObject -SearchBase “CN=Extended-Rights,$((Get-ADRootDSE).configurationNamingContext)” -LDAPFilter ‘(objectClass=controlAccessRight)’ -Properties name, rightsGUID |

 ForEach-Object {$schemaIDGUID.add([System.GUID]$_.rightsGUID,$_.name)}

$ErrorActionPreference = ‘Continue’

#(*)


#—————————————————————————–

#Functions


#—————————————————————————–

function CheckProtection

{

    param($obj)

    $path = “AD:\” + $obj

    Get-Acl -Path $path | `

    Select-Object -ExpandProperty Access | `

    Where-Object {($_.ActiveDirectoryRights -like “*DeleteTree*”-AND ($_.AccessControlType -eq “Deny”)} | `

        #(*)

        Select-Object @{name=‘Object’;expression={$obj}}, `

        @{name=‘objectTypeName’;expression={if ($_.objectType.ToString() -eq ‘00000000-0000-0000-0000-000000000000’) {‘All’Else {$schemaIDGUID.Item($_.objectType)}}}, `

        @{name=‘inheritedObjectTypeName’;expression={$schemaIDGUID.Item($_.inheritedObjectType)}}, `

        #(*)

        ActiveDirectoryRights,

        ObjectFlags,

        AccessControlType,

        IdentityReference,

        IsInherited,

        InheritanceFlags,

        PropagationFlags

}


#—————————————————————————–

#MAIN


#—————————————————————————–

#add the top domain

$OUs = @(Get-ADDomain | Select-Object -ExpandProperty DistinguishedName)

#add the OUs

$OUs += Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName

#add other containers

$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(|(objectClass=container)(objectClass=builtinDomain))’ | Select-Object -ExpandProperty DistinguishedName


#if you don’t want to scan the builtin container use line below instead of line above


#$OUs += Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName -LDAPFilter ‘(objectClass=container)’ | Select-Object -ExpandProperty DistinguishedName


#set the target objects types to investigate


#including users, groups, contacts, computers

$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer))’


#$ldapfilter = ‘(|(objectclass=user)(objectclass=group)(objectclass=contact)(objectclass=computer)(objectclass=Foreign-Security-Principal))’


#not included: Foreign-Security-Principal, msTPM-InformationObjectsContainer, msDS-QuotaContainer, lostAndFound,

ForEach ($OU in $OUs

{

    #check the protection of the parent container

    $isProtected = 

    $isProtected = CheckProtection $OU

    if ($isProtected -ne $null) {$report += $isProtected}

    

    #Lookup the child target objects in the parent container

    $objects = Get-ADObject -SearchBase $OU -SearchScope OneLevel -LDAPFilter $ldapfilter | Select-Object -ExpandProperty DistinguishedName

    #check the protection of the child objects

    ForEach ($object in $objects)

    {

        $isProtected = 

        $isProtected = CheckProtection $object

        if ($isProtected -ne $null) {$report += $isProtected}

    }

}

$report | Format-Table -Wrap

$report | Export-Csv -Path $csvFile -NoTypeInformation

 

 


Disclaimer

LEGAL DISCLAIMER

This Sample Code is provided for the purpose of
illustration only and is not intended to be used in a production environment.

THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED “AS IS” WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR  PURPOSE.

We grant You a nonexclusive, royalty-free right to use and modify
the Sample Code and to reproduce and distribute the object code form of the
Sample Code,

provided that You agree:

(i) to not use Our name, logo, or
trademarks to market Your software product in which the Sample Code is embedded;

(ii) to include a valid copyright notice on Your software product in which
the Sample Code is embedded; and

(iii) to indemnify, hold harmless, and
defend Us and Our suppliers from and against any claims or lawsuits, including
attorneys’ fees, that arise or result from the use or distribution of the Sample
Code.

This posting is provided “AS IS” with no warranties, and confers no
rights.


Note-to-self: Security Compliance Manager 4.0 now available for download!

Sometime you get some silent signals that you have been way too busy…

Like stumbling into an announcement of a tool you evangelise…

Security Compliance Manager 4.0 now available for download!

 

 

 

Thank you!

This weekend I’ve received some pretty exciting news that I was awarded the 2016 MVP award (Microsoft Most Valuable Professional) for Enterprise Mobility (Identity & Access).

mvp_logo

I’m extremely proud to receive the award, but I never could have achieved this award without your support. So, in the first place I want to thank YOU for supporting me and making it possible. With your help I certainly will continue to support and build the Microsoft and security community with great pride.

A great thanks to Ed Price, Ronen Ariely, Gokan Ozcifci and Jorge de Almeida Pinto for the support and recommendations. (I sincerely hope I haven’t forgotten anyone…) I owe you Belgian beer.

I had the honor to be part of the program earlier, and never have stopped to build and maintain the community with passion for Identity and Access management, but as combining Microsoft FTE with MVP is not possible… I had a break for the years at MS… still it was different.

I’m also extremely thankful that my wife Katrien and my 2 kids can cope with my crazy passion for TechNet Wiki and MS community obsession. This addiction is just so much fun…but I’ll never admit that. (oh ships, just did…)

Note-to-self: DNS naming best practices for internal domains and networks

Just a few days ago, I’ve got a question from a customer regarding the DNS naming best practices for internal DNS and AD domains…

As it’s not a daily job to setup a new AD domain and internal DNS (from scratch…), so it might help to share the results of my investigation, that have lead to confirm my practical experiences.

Apparently it’s a pretty frequent topic on AD and network platforms. Plus there are some strict technical guidelines that apply here, even for internal DNS configurations…

The short answer, as best practice:

  • Microsoft strongly recommends to register a public domain and use subdomains for the internal DNS.
  • So, register a public DNS name , so you own it. Then create subdomains for internal use (like corp.pgeelen.be, dmz.pgeelen.be, extranet.pgeelen.be) and make sure you’ve got your DNS configuration setup correctly.

Below more detailed explanation. Luckily enough there is some nice reading material out there to prove the statement, so make sure you bookmark this page 😉

But first we need to clarify a few things…

AD Domain vs DNS name

The AD domain name is NOT the same as the DNS name, but they are linked.

AD Domain names are mainly used within AD operations, mostly LDAP queries for AD functionality, while DNS is rather a network level solution for name resolution on IP level (to solve the machines or application names to IP addresses).

Essentialy this difference allows you to use a ‘internal’, private AD domain name and use a public, registered DNS name.

When you look into discussions and documentation on this topic, you’ll also see that the AD domain short name is referred as NetBIOS Name (as in the AD logon name <DOMAIN>\<username>).

For example

  • AD Domain name: CORP
  • DNS name: corp.pgeelen.be

See here for more explanation: https://technet.microsoft.com/en-us/library/bb676377

You can also ‘unlink’ the AD domain name from the DNS name, then you get a disjoint namespace, as explained in previous link.

For Example

  • AD Domain naam : CORP
  • DNS naam: intranet.pgeelen.be

Check this forum discussion: https://social.technet.microsoft.com/Forums/windowsserver/en-US/f6ac34e8-4b35-4c3b-a60f-179f68d6eb24/ad-domain-name-vs-dns-domain-name?forum=winserverDS

And also: https://technet.microsoft.com/en-us/library/cc978018.aspx

Dummy DNS name vs official DNS name

In the past, lots of people chose to use a dummy, unofficial TLD (top-level-domain) for their internal network, likedomain.lan, domain.local of domain.internal (and also domain.internalhost)

But this can get you in serious trouble.

Because these names are not supported by internet standards, the most important RFC on this is: RFC 2606 (http://tools.ietf.org/html/rfc2606)

This RFC standard is very explicit on chosing domain names for voor private testing and documentation

  • .test
  • .example
  • .invalid
  • .localhost

But also for documentation some 2nd level domains are reserved

  • example.com
  • example.net
  • example.org

As you can see, these names are created for testing and not for production.

Plus, if the public naming standards change or additional names are released you might be using a name you don’t own and that can be routed to the internet, which conflicts with the initial use.

Therefore the technical conclusion is fairly straight forward: register a public DNS name and use it for your internal DNS resolution.

So the use of <yourinternaldomain>.be is technically correct but it doesn’t stop there.

There are some important consequences.

Allow me to take the discussion a step further.

You have to make a choice on the DNS zones:

  • using a single DNS zone
  • Using subdomains
  • using different DNS zones

 

Using a single namespace (for internal and external hosts)

Some customers use the same DNS zone for internal and external usage. But there are some important disadvantages:

  • mismatch between security zones (like intranet, extranet, dmz and) and DNS naming
  • when adding / merging domains the DNS is subject to redesign
  • less flexible, less automated DNS operations
  • conflict in authority with internal DNS and external DNS (managed by internet provider)

You might face some practical issues like:

  • conflicts in DNS,
  • instable operations and sub-optimal performance
  • network issues
  • complex configuration
  • less or no automated DNS operations, more manual operations
  • keeping DNS under control is less obvious

Plus, you’ll face some consequences regarding network security, by the lack of segregation of (DNS) duties.

So: Single DNS domain is absolutely not advised.

Using different DNS names and zones

It’s completely the opposite of the previous approach. From DNS level, this is fairly simple setup, but you need to duplicate or multiply DNS configurations. And from a user perspective it might be complex or confusing, or not transparent, and inconsistent

DNS sub-domains

This is a frequently used technique to use the same TLD (top level domain) and separate the zones by subdomain. Eg “intranet”, “extranet”, “DMZ” for ‘internal’ zones en just plain <domain>.<tld> for public DNS.

For example:

  • intranet.pgeelen.be or corp.pgeelen.be (if your AD is named ‘CORP’ )
  • extranet.pgeelen.be for applications or partner facing websites
  • DMZ.pgeelen.be for applications that need DMZ for data protection or publication,
  • and master suffix .pgeelen.be for public websites (managed by your Internet Provider)

The forum post I mentioned earlier discusses a technique called “DNS split brain”:

In fact you have one DNS name space, but with sub spaces per zone.

This is a bit more complicated setup as you need to make sure the DNS servers forward the requests to the applicable zones correctly.

And it does require some planning and cooperation with your internet provider.

Microsoft strongly suggests to work with subdomains, within a publicly registered TLD domain.

Check: Creating Internal and External Domains op https://technet.microsoft.com/en-us/library/cc755946(WS.10).aspx

Design Option Management Complexity Example
The internal domain is a subdomain of the external domain. Microsoft strongly recommends this option. For more information, see Using an Internal Subdomain. Easy to deploy and administer. An organization with an external namespace contoso.com uses the internal namespace corp.contoso.com.
The internal and external domain names are different from each other. For more information, see Using Different Internal and External Domain Names. More complicated than previous option. An organization uses contoso.com for its external namespace, and corp.internal for its internal namespace.

 

On top of that you need to be aware of a few rules regarding naming standards: https://support.microsoft.com/en-us/kb/909264

 

To conclude, please find some useful reference info in one spot below: