[Powershell] Import-ActiveDirectory on non-RSAT student machines

[CHiLL]

Hello,

I have created a printer script using Powershell and part of the whole process is to determine the security group membership of the logged on user, requiring the Import-Module ActiveDirectory cmdlet. The script works on my own machine because I have RSAT installed. However we do not have RSAT installed on our student or staff machines, thus that cmdlet is not installed. Is there a risk having RSAT installed on client machines?

 

How can I get around this? Our printers are added via security groups via Group Policy Preferences at the moment, however we are having no end of problems with it. So I thought I'd achieve the same thing using a Powershell logon script.

 

Can anyone help?

Edited November 16, 2015 by CHiLL

[HPlum78]

Don't install RSAT on all of your computers, just put the AD Modules in the powershell folder on the computers. c:\windows\system32\WindowsPowerShell\v1.0\Modules\ on your workstation and you will see the folder ActiveDirectory copy it to the same place on your other workstations via Group Pol would be the quickest.

 

or if you want to flex you PS might use PS to do it for you!

Edited November 19, 2015 by HPlum78

[HPlum78]

or thinking on a bit you could drop the module in a shared folder and use the import-module \\yourshare\Powershell\Modules\ you get the idea...

[CHiLL]

Don't install RSAT on all of your computers, just put the AD Modules in the powershell folder on the computers. c:\windows\system32\WindowsPowerShell\v1.0\Modules\ on your workstation and you will see the folder ActiveDirectory copy it to the same place on your other workstations via Group Pol would be the quickest.

 

or if you want to flex you PS might use PS to do it for you!

Ahh, OK, that's a good idea, I didn't know it worked like that!

 

or thinking on a bit you could drop the module in a shared folder and use the import-module \\yourshare\Powershell\Modules\ you get the idea...

That's an even easier solution! I might give that a go.

 

P.S, Do you know if a normal student or staff domain user are able to query AD using Import-ActiveDirectory or even ADSI? I'm running into problems at the moment where I the script works when I run it as my domain admin account, but not as a student or staff account.

[HPlum78]

Thing with PS it will unless you specify other wise it will use the credentials from the session and for good reason! you have the power to mange that. I need to have a think about how that works with the user as they would have the self ACL that includes the read on their AD object...... hmmm, I will try to take a look in my test env. I have got to dig out a password reset script on post while I am at it! Edited November 19, 2015 by HPlum78

[mikeyd101]

LDAP Queries maybe?

 

I hacked together (from other sources) powershell script todo AD LDAP queries without the need for external modules.

 

 

function Get-ADObjects{

param (

$searchroot = [system.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain(),

$Category = "(objectCategory=computer)",

$fieldlist = @("name", "cn")

)

 

 

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher

$objSearcher.SearchRoot = "LDAP://$searchroot"

$objSearcher.Filter = ($Category)

$objSearcher.SearchScope = "subtree"

$objSearcher.pagesize = 10000

 

# TODO: request / consolidate from all domain controllers

foreach ($i in $fieldlist) {

$temp = $objSearcher.PropertiesToLoad.Add($i)

}

 

$colResults = $objSearcher.FindAll()

 

 

$Results = @()

foreach ($objResult in $colResults) {

$Result = New-Object PSObject

foreach ($Property in $objResult.Properties.getenumerator()) {

if($Property.Value) {

$Result | Add-Member NoteProperty $Property.Key ([string]$Property.Value)

}

}

$Results += $Result

}

$Results

}

 

# get all computers from AD

$computers = Get-ADObjects -category (objectCategory=computer) -fieldlist @("name", "cn", "lastLogonTimeStamp", "userAccountControl", "description", "location")