HPlum78

Before I look any further can we sort out the - Filter * -Properties * That is not the best way to get the details you are after and do that in a large environment you will not be popular either.

Just out of interest what does the switch say? You are thinking host but it may not be as clear cut as that.

So you may well not get the information that you are expecting by using the above command and this is drawn out in the documentation for the cmdlet https://docs.microsoft.com/en-us/powershell/module/addsadministration/get-adgroupmember?view=winserver2012r2-ps (this will depend on what the hierarchy of the group looks like) Get-ADGroupMember -Recurse Function Get-NestedGroupMembers As you can see there is quite a difference between the two results Code for the function follows:- function Get-NestedGroupMembers { param ( [Parameter(ValuefromPipeline=$true,mandatory=$true)][string] $GroupName, [int] $nesting = -1, [int]$circular = $null, [switch]$indent ) function indent { Param($list) foreach($line in $list) { $space = $null for ($i=0;$i -lt $line.nesting;$i++) { $space += " " } $line.name = "$space" + "$($line.name)" } return $List } $modules = get-module | select -expand name if ($modules -contains "ActiveDirectory") { $table = $null $nestedmembers = $null $adgroupname = $null $nesting++ $ADGroupname = get-adgroup $groupname -properties memberof,members $memberof = $adgroupname | select -expand memberof write-verbose "Checking group: $($adgroupname.name)" if ($adgroupname) { if ($circular) { $nestedMembers = Get-ADGroupMember -Identity $GroupName -recursive $circular = $null } else { $nestedMembers = Get-ADGroupMember -Identity $GroupName | sort objectclass -Descending if (!($nestedmembers)) { $unknown = $ADGroupname | select -expand members if ($unknown) { $nestedmembers=@() foreach ($member in $unknown) { $nestedmembers += get-adobject $member } } } } foreach ($nestedmember in $nestedmembers) { $Props = @{Type=$nestedmember.objectclass;Name=$nestedmember.name;DisplayName="";ParentGroup=$ADgroupname.name;Enabled="";Nesting=$nesting;DN=$nestedmember.distinguishedname;Email=$nestedmember.mail;Department=$nestedmember.department;Comment=""} if ($nestedmember.objectclass -eq "user") { $nestedADMember = get-aduser $nestedmember -properties enabled,displayname,mail,department $table = new-object psobject -property $props $table.enabled = $nestedadmember.enabled $table.name = $nestedadmember.samaccountname $table.displayname = $nestedadmember.displayname $table.email = $nestedadmember.mail $table.department = $nestedadmember.department if ($indent) { indent $table | select @{N="Name";E={"$($_.name) ($($_.displayname))"}} } else { $table | select type,name,displayname,parentgroup,nesting,enabled,dn,email,department,comment } } elseif ($nestedmember.objectclass -eq "group") { $table = new-object psobject -Property $props if ($memberof -contains $nestedmember.distinguishedname) { $table.comment ="Circular membership" $circular = 1 } if ($indent) { indent $table | select name,comment | %{ if ($_.comment -ne "") { [console]::foregroundcolor = "red" write-output "$($_.name) (Circular Membership)" [console]::ResetColor() } else { [console]::foregroundcolor = "yellow" write-output "$($_.name)" [console]::ResetColor() } } } else { $table | select type,name,displayname,parentgroup,nesting,enabled,dn,mail,department,comment } if ($indent) { Get-NestedGroupMembers -GroupName $nestedmember.distinguishedName -nesting $nesting -circular $circular -indent } else { Get-NestedGroupMembers -GroupName $nestedmember.distinguishedName -nesting $nesting -circular $circular } } else { if ($nestedmember) { $table = new-object psobject -property $props if ($indent) { indent $table | select name } else { $table | select type,name,displayname,parentgroup,nesting,enabled,dn,email,department,comment } } } } } } else {Write-Warning "Active Directory module is not loaded"} } Sorry stripped all the line breaks out will sort it at some point...

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 Download the replication graphical tool and see what it is saying, i am a PowerShell man myself but this is the best tool for the job. Let me know what its saying error wise/ follow what it tells you.

Yep that's right, if you can get to the PS exchange prompt I will post some powershell shortly.

Oh and just make sure you observe the ground rules for Exchange nothing in the way of all traffic being able to flow betwee the boxes. (so no firewalls and the likes)

The 500 error on the exch 16 box is going to need fixing in the first place. How do you mean the 2010 box don't know about the 16 box where are you looking? Can you get to the exchange powershell command prompt? (on the 16 box) I am doing this migration right now in our dev test and just got live through CAB so will be doing that next week....

If you have azure it's got to be key vault. Well that's what we use to keep secrets and certs. Also can read out the secrets with code.

Need to have the following Windows features enabled/ installed:- Data Center Bridging DataCenterBridging LLDP Tools

Did not see that!

What OS are you on and what PS version?

"Pulled down" and "Jammed the network" did my 5 year old write the technical evaluation of what happened? Best way to do your load testing....

Architecture is very different from end user training, talk to MS they have resources available that schools can tap into.

No Edge original Edge stays.

@Uber22 how you getting on with resurrecting your AD services?

Don't just go forceably grabbing FSMO roles until you get the missing DC out of the picture, get that cleaned up and boot the existing DC and see what state it comes back in. Also if you are using AAD connect or whatever we are calling it today you should probably stop the sync cycles....

Thing is the current server knows of the missing DC and DC's insist on checking with their known partners who each other thinks is the FSMO role holder. You may well find that clearing up the missing DC resolves the knows of FSMO role holders issues you are seeing at the min. This depends on the state of the FSMO roles at the point the other DC went down mind.

Yep you have a number of issues here and as @Uber22 the first thing to get sorted is the DC that is missing, 2016 server running AD should clean up ok without the need to do the metadata clean up. If you are not able to add workstations to your Domain why do you think that adding a DC is going to be any different? Also knowing that you have replication/ AD issues trying to do operations against your AD infrastructure is interesting. Are you sure that this is only affecting joining workstations to the domain? Are you still able to create new accounts? Update password and the likes? I ask this as it seems like a RID Pool issue due to the FSMO problems you have posted above.

Yep fixed wire testing has to happen and this is sometimes set out by the insurers to be on a more frequent schedule, mostly can be done live but you have to take an outage and this should be minimal not days minutes for each circuit if all goes well. I would ask the question what testing are they doing that means you are taking an outage of days? (for my sins I am a qualified Electrician and cannot think why. Off top of my head....) Have you got onsite 10ks? If fact I have just seen PFI so I am guessing yes to having 10ks on site and I will also bet that they are air cooled not oil so that will be why you are taking an outage (if I am indeed correct) they will be checking those little f*! £@ers over for cracking and will most likely be having the tails killed by the distributor on their 10k.

https://news.microsoft.com/en-gb/2019/10/09/tech-can-tackle-uks-unhealthy-always-on-working-practices-but-only-if-company-bosses-want-to-use-it-microsoft-report-reveals/

I am not saying that IT in schools should be out sourced I am dead against that, i am mearly saying that from a high level management perspective it looks appealing. I also don't think you get the best support if you do outsource you certainly don't get any bespoke development. I hear you in what you say around Schools and MATs do not have the resources to have permanent devs as noted in my previous posts. This is an education issue not down to the individual IT departments in Schools I honestly believe from working in and with School IT departments that there is a lot of scope and knowledge that is under utilised and given some support that could be tapped into and unlock a whole host of development to aid in educating our students. Sometimes we have to push the rock uphill to make a differance.!

And as I have said that is why MATS and Schools are thinking about what there core functionality is, they are not best placed to run an IT department as most are in the business of educating so again as already noted if you are the click next admin and that is all you do then your time may well be limited. I will tell it another way, BMW are no longer known as an engineering house they are a software house (their code is worth more than their metal) in fact now most of the top companies in the world are not doing the same as they did 10 years ago, you will find most are now in the business of software. Education is going to be no different IT departments have to be able to develop and carve out a uniqueness that will help deliver education better or close the gap between students (to name but two places that IT departments should be looking at). So when I talk about development I not talking about a phone system or what mail service you use or if you are using office over G suite, your SLT dont care either when smartly dressed men/ women come in and say that x firm can deliver the day to day operations of IT and take away the management overhead that comes with running in house IT. The simple fact is if you offer bespoke solutions and have an in-depth knowledge of education and can demonstrate you and your departments value thats what separates you from the faceless company that's going to come in and take over.

I am certain that my job is a real job! well at least I get paid for it... (I am a third line support analyst and a developer) but development is defiantly a real job.

So if we are saying anything at all its this:- Paid for software is NOT FREE Free software is NOT FREE Closed source software is NOT FREE Open source software is NOT FREE In house dev is NOT FREE The thing is about in house dev is that staff are a sunk cost! :-P

@mavhc you are indeed correct, I myself have just lumped it all as one but there is a differance I agree. Also when I say in house development I know that there is an associated costs. Also when making decisions for any given solution we may have to make a tactical fix or decision knowing that we are going to be stuck with technical debt. It's not as simple as to say payed v free, closed v open there are way to many things to consider than just those factors. If nothing else this thread has shown just that. And also highlights the many approaches individuals choose some by our own unconscious/ conscious bias and those that are driven by our individual organisations requirements.