At my company, the IT department consists of several teams like Microsoft, Network, Storage, Linux and VMware. To administer our environment we do not use our regular accounts (duh… 🙂 ), but instead use what we call admin accounts. Over the years, the security structure used to assign permissions to these admin accounts became poluted. Groups nested in groups nested in other groups, different group membership for team members, etc. As a result, we failed a security audit and I was tasked with cleaning this mess up using a role based access control (RBAC) like structure to achieve a transparent method of assigning permissions.
Continue reading Create Active Directory administration OU
Monitor AD user account changes
At my company, the system administrators separate admin accounts to administer our server infrastructure. These admin accounts are often powerful accounts which get their power from group membership (Role Based Access Control a.k.a. RBAC). Therefore, I would like to receive a notification via e-mail when a user account is added to or removed from a group (in my previous post I shared with you a script to monitor just that), but added to that I also would like to receive a notification when for example the Password Never Expires option is ticked. Other scenarios may include notification when an admin account is created or deleted. Or when the password of an admin account has been changed. And I would like to know who has made these changes and when.
As and added benifit, you can also claim to any auditor that you have a log of all changed made to your admin accounts by simply saving the e-mails.
In this post I would like to share with you the script I have made to monitor AD user account changes. This script will check all user account related events from the last hour. You can implement this script by running it every hour via a scheduled task.
Continue reading Monitor AD user account changes
Monitor AD group changes
Ever wanted to monitor group changes in AD? This is a script I came up with to do just that. It will collect the security log events from the last hour on all your domain controllers.
Continue reading Monitor AD group changes
Inventory VMware virtual machines
For reporting purposes, I maintain an Excel sheet containing information on my server base. I update this sheet on a weekly basis. Part of the information displayed in this sheet comes from a PowerShell script I have created to extract the required data from our vCenters.
This script pulls the following information for every VM running the vCenter environment: VM Name, Hardware version, VMware tools status, guest OS, number of vCPU’s, amount of assigned RAM, the host the VM runs on, the cluster the VM is assigned to, the folder it lives in, the power status, number of NICs, the NIC types and the vCenter it runs on (in case you have more than 1).
Continue reading Inventory VMware virtual machines
Fix Windows Update error code 0x80244022, 0x8024401C and 0x80072EE2
WSUS is a great product from Microsoft to keep your servers up to date. In the past years, I have often used it at the companies I worked for. But it has it downsides as well. Sometimes the Windows Update client just won’t work. You’ll get errors like 0x80244022, 0x8024401C and 0x80072EE2 and just haven’t got a clue what is going on.
I have collected a number of solutions to fix these errors and put them in a PowerShell script. This script contains all the tricks I had to pull to get the Windows Update client running again.
Continue reading Fix Windows Update error code 0x80244022, 0x8024401C and 0x80072EE2