Rebuild Domain Controller

[GRitchie]

Hello,

So I'm wanting to rebuild the domain controller at my workplace (if my boss allows it) however is it particularly hard?

 

I've done the whole setting up a DC from scratch, but obviously this involves migration of users, group policies etc.

 

 

How hard can it be?

Let me know your thoughts/advice!

 

Thanks.

[6Foot2]

If you have more that one domain controller it shouldn't be too hard as AD/GP settings will be inherited from the other server when the rebuild is complete and the server joins the domain.

 

Is there anything on the server that is to be re-built that is not present on another server? [EG: My DC1 server has Homework Tracker services and folders not present anywhere else on the domain. If I were to rebuild this server I would have to restore from backup or re-install this from scratch]

[GRitchie]

If you have more that one domain controller it shouldn't be too hard as AD/GP settings will be inherited from the other server when the rebuild is complete and the server joins the domain.

 

Is there anything on the server that is to be re-built that is not present on another server? [EG: My DC1 server has Homework Tracker services and folders not present anywhere else on the domain. If I were to rebuild this server I would have to restore from backup or re-install this from scratch]

 

Don't think so!

We already have two domain controllers, however it's really messy and there are ou's and group policies all over the place, so I kinda want to redo the entire group policy system mainly.

[heyjim]

Don't think so!

We already have two domain controllers, however it's really messy and there are ou's and group policies all over the place, so I kinda want to redo the entire group policy system mainly.

 

Creating another domain controller isn't really the answer then as everything will replacate from the exisiting domain controllers.

 

You should look at tidying up and re-organising the existing AD and GP structure, creating a new domain would be overkill IMO.

[GRitchie]

Creating another domain controller isn't really the answer then as everything will replacate from the exisiting domain controllers.

 

You should look at tidying up and re-organising the existing AD and GP structure, creating a new domain would be overkill IMO.

 

Okay, so is there an easy way of finding out which machines in the computer OU's are in use and which arent?

 

There didn't used to be a naming system, so all machines are like 'GRITCHIE' 'GRITCHIE-2' 'GRITCHIE-NEW' etc. etc. etc.

I suppose I just want to clean it all up and make it neat and tidy - I have OCD when it comes to things like this!

[heyjim]

It's not something I've done for a while but maybe try dsquery computer -inactive 4 on your DC - that would show any computers that haven't been active for 4 weeks (you can obviously change 4 to whatever). Be careful though as sometimes laptops etc could potentially be away from the domain for x amount of time, so you wouldn't want to delete them.

 

Maybe also move the computers that you know are active into a new OU?

 

I'm sure they'll be loads of stuff on Google about finding inactive objects.

Edited May 20, 2014 by heyjim

[ADMaster]

Here is a script I wrote just for this job.

 

Just change the path if you wish. This will output a csv of all the computers with last logon time. Open it an excel to filter / sort by date.

 

the dsquery command above can me piped to dsrm to remove the computers as well. But I would look at them in excel first to get a better visual on the dates.

 

 

 

clear

$comps = Get-ADComputer -Filter * -Properties lastlogontimestamp

foreach ($comp in $comps){
$out =  $comp.Name + "," + [datetime]::FromFileTime($comp.lastlogontimestamp )
$out | Out-File c:\work\lastlogon.csv -Append -Encoding ascii
}

echo 'Done'

 

Cheers

[GRitchie]

Here is a script I wrote just for this job.

 

Just change the path if you wish. This will output a csv of all the computers with last logon time. Open it an excel to filter / sort by date.

 

the dsquery command above can me piped to dsrm to remove the computers as well. But I would look at them in excel first to get a better visual on the dates.

 

 

 

clear

$comps = Get-ADComputer -Filter * -Properties lastlogontimestamp

foreach ($comp in $comps){
$out =  $comp.Name + "," + [datetime]::FromFileTime($comp.lastlogontimestamp )
$out | Out-File c:\work\lastlogon.csv -Append -Encoding ascii
}

echo 'Done'

 

 

Cheers

 

Tried this and it didn't work for some reason :-/

[ADMaster]

What OS are you on, I believe the get-adcomputer cmdlet is part of the windows 8/2012 RSAT. You could accomplish the same with quest's AD cmdlets with slightly different syntax. I'll see what I can find.

[ADMaster]

Here you go, same thing except with quest AD cmdlets, you'll need to install them.

 

 

clear

$comps = Get-QADComputer  

foreach ($comp in $comps){
$out =  $comp.Name + "," + [datetime]::FromFileTime($comp.lastlogontimestamp )
$out | Out-File c:\work\lastlogon.csv -Append -Encoding ascii
}

echo 'Done'

[GRitchie]

Here you go, same thing except with quest AD cmdlets, you'll need to install them.

 

 

clear

$comps = Get-QADComputer  

foreach ($comp in $comps){
$out =  $comp.Name + "," + [datetime]::FromFileTime($comp.lastlogontimestamp )
$out | Out-File c:\work\lastlogon.csv -Append -Encoding ascii
}

echo 'Done'

 

We're on Windows Server 2008

[fairm010]

You can use this Cjwdev | AD Info - Active Directory Reporting Tool to look at last used machines on your domain.