1 / 41

DS Commands

DS Commands. Notes and Examples. DS Commands. Tools that are available to manage Active Directory from the command prompt. Use of DS commands requires an understanding of distinguished names. . Distinguished Name (DN).

masako
Télécharger la présentation

DS Commands

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. DS Commands Notes and Examples

  2. DS Commands • Tools that are available to manage Active Directory from the command prompt. • Use of DS commands requires an understanding of distinguished names.

  3. Distinguished Name (DN) • Every object in Active Directory has an associated distinguished name, or DN. The DN exactly identifies the location of the object within Active Directory. It uniquely identifies the object by its common name and its location within the domain.

  4. Distinguished Name (DN) (continued) • Common Name: An object’s common name is the plain-English name given to the object when it’s created. An object’s common name is identified using cn=Name; for example: “cn=Sponge Bob”

  5. Distinguished Name (DN) (continued) • Object’s Location: An object’s location is determined by the names of the domain components and the names of the container objects (organizational unit) that contain the object. • Organizational Units are identified by using ou= • Exception: the system generated users container is identified with cn= • Domain components are identified by using dc= . • If the Sponge Bob object is in a container (organizational unit) named Finance and the Finance container is in a domain named marketing.insideis.com, the object’s location would be referenced as: “ou=finance, dc=marketing, dc=insideis, dc=com” or ou=finance,dc=marketing,dc=insideis,dc=com Quotes are needed in the first example because spaces were included after each comma in the name .

  6. Distinguished Name (DN) (continued) • An object’s distinguished name includes it’s common name and the object’s location. • The distinguished name for the Sponge Bob object that exists inside the Finance container within the Marketing.InsideIS.com domain is: “cn=Sponge Bob, ou=Finance, dc=marketing, dc=insideis, dc=com” or “cn=Sponge Bob,ou=Finance,dc=marketing,dc=insideis,dc=com” Quotes are required in both examples because the value of cn includes spaces..

  7. Distinguished Name (DN) (continued) • Some rules regarding writing a distinguished name include: • CN= precedes the common name of the object • OU= precedes an organizational unit’s name • DC= precedes each part of a domain name • Commas separate each component in the name and they are required • The space after the comma is optional, if used, the DN must be enclosed in quotes • If any spaces exist in any part of the name, the DN must be enclosed in quotes • No portion of the name is case sensitive

  8. Examples of Distinguished Names The Brian user object’s distinguished name: cn=brian,ou=finance,dc=domainp,dc=bcc or “cn=brian, ou=finance, dc=domainp, dc=bcc” Quotes are needed in the second example because spaces were included after each comma in the name.

  9. Examples of Distinguished Names The John J. Jones user object’s distinguished name: “cn=John J. Jones,ou=Users,ou=Finance,dc=domainp,dc=bcc” Quotes are required because the value of the cn name contains spaces..

  10. DSADD User • DSADD can be used to create many different object types, this and the next few slides will concentrate on using DSADD to create user objects. • Syntax for user account is • DSADD USER distinguished-name switches • Switches commonly used include • -pwd (password), -samid, -upn, -memberof, -disabled

  11. cn upn samid Sample DSAdd The below command would be typed on one line. It adds a user to the Finance container within the domainp.bcc domain. The user’s password will be set at Bristol!, her user object’s common name (cn) will be Wilma Flinstone, her user principal name (upn) will be wflintstone@domainp.bcc and her samid will be wflintstone. The user could login using wflinstone or wflinstone@domainp.bcc dsadd user "cn=Wilma Flintstone, ou=finance,dc=domainp,dc=bcc" -pwd Bristol! -upn wflintstone@domainp.bcc -samid wflintstone

  12. DSADD User (continued) • It’s important to understand the difference between the different name values: cn, upn & samid • When entering the command, the only required value is cn. • But.. what happens if you leave off the upn or samid? • Upn – if omitted, that property is left blank and a user would not be able to login using a upn name (i.e,. wflinstone@domainp.bcc) • Samid – if omitted, the first 20 characters of the supplied cn value will be used as the samid

  13. cn value used as object name and samid. Upn value left blank DSADD User (continued) Example: Dsadd user cn=Jackson,ou=finance,dc=domainp,dc=bcc” –pwd Bristol! User could login using the login name: Jackson A upn (i.e., Jackson@domainp.bcc) would not be supported)

  14. DSADD User (continued) Example: Dsadd user “cn=Jackson M. Mortinville, ou=finance,dc=domainp,dc=bcc –pwd Bristol! cn value used as object name and samid Notice, only the first 20 characters of the cn value are used for the samid. User would have to login using the login name: Jackson M. Mortinvil This, obviously would not be recommended. Understanding how DSADD provides values to properties is critical in ensuring that a desired login name is provided.

  15. cn value is used as object name and because the total characters are less than 20, the entire cn value is used as the samid. Upn value is provided.. DSADD User (continued) Example: samid not provided Dsadd user “cn=Jackson Smith, ou=finance,dc=domainp,dc=bcc –pwd Bristol! –upn jsmith@domainp.bcc User could login using: Jackson Smith orJsmith@domainp.bcc Jsmith (alone) will not work. This, obviously would not be recommended. Here again, understanding how DSADD provides values to properties is critical in ensuring that a desired login name is provided.

  16. DSADD User: Best Practice • The best practice when creating user accounts with the DSADD command is to always provide all three values • Cn – this is the object’s name and it’s what you see by default when viewing the database using Active directory Users and Computers. It’s also the name you’ll use whenever referencing the object from the command prompt. • Samid – this is the name you want the user to use when logging in. (i.e, jjones) • Upn – should be the same value as the samid, followed by @ and the domain name in which the account is being created. (i.e, jjones@domain.com)

  17. DSMOD User • DSMOD can be used to modify many different object types, this and the next slide will concentrate on using DSMOD to modify user objects. • Syntax for modifying user account is • DSMOD USER distinguished-name -switches • Switches commonly used include • -pwd (password), -mustchpwd –disabled

  18. DSMOD User: Examples Each of the below examples modifies a user object that exists in either the finance container or the accounting container in the domainp.bcc domain. Dsmod user “cn=Jackson,ou=Finance,dc=domainp,dc=bcc” -pwd Password! Changes the Jackson user’s password to Password! Dsmod user “cn=Mary, ou=Accounting, dc=domainp, dc=bcc” –pwd Password! –mustchwd yes Changes the Mary user’s password to Password! and requires that she change her password at next logon. Dsmod user “cn=John Smith, ou=Accounting, dc=domainp, dc=bcc” –disabled yes Disables the John Smith user account. Dsmod user “cn=John Smith, ou=Accounting, dc=domainp, dc=bcc” –disabled no –Enables the John Smith user account

  19. DSQuery User • DSQUERY can be used to query different object types from the command line. • Syntax for querying a user account is • DSQUERY USER distinguished-name -switches • Switches commonly used include • -o (controls output’s display) –stalepwd -disabled

  20. DSQuery User: Examples dsquery user Displays a list of distinguished names for all users in the domain dsquery user “ou=Accounting,dc=domainp,dc=bcc” Displays a list of distinguished names for all users in the Accounting container within Domainp.bcc dsquery user “ou=Accounting,dc=domainp,dc=bcc” –o samid Displays a list of samids for all users in the Accounting container within Domainp.bcc dsquery user -name j* Displays a list of distinguished names for all users in the domain who have an object name that begins with the letter j.

  21. DSQuery User: Examples dsquery user -name j* “ou=Finance,dc=domainp,dc=bcc” Displays a list of distinguished names for all user objects in the Finance Container within Domainp.bcc who have an object name that begins with the letter j. dsquery user -disabled Displays a list of distinguished names for all users in the domain that have a disabled account dsquery user “ou=Finance,dc=domainp,dc=bcc” –disabled –o samid Displays a list of samids for all users in the Finance container within Domainp.bcc that have a disabled account dsquery user “ou=Finance,dc=domainp,dc=bcc” –stalepwd 14 Displays a list of distinguished names for all user objects in the Finance Container within Domainp.bcc who have not changed their password in 14 days

  22. DSQuery User: Piping DSQUERY Output can be used as input to another command (piped)Examples provided have wrapped onto multiple lines. When executed, they would have to be typed on one line. Dsquery user “ou=finance,dc=domainp,dc=bcc” –stalepwd 72 | dsmod user –disabled yes This will take the output of the dsquery command (on the left of the pipe (|), and use it as input to the dsmod command on the right of the (|). In this case, it will disable all user accounts in the finance container who have not changed their password in 72 days.

  23. DSQuery User: Piping Dsquery user “ou=finance,dc=domainp,dc=bcc” | dsmod user –desc “Finance Employees” This will take the output of the dsquery command (on the left of the pipe (|), and use it as input to the dsmod command on the right of the (|). In this case, it will change the description property for all user accounts in the finance container. The new value will be Finance Employees. Dsquery user “ou=Sales,dc=domainp,dc=bcc” | dsmod user –dept “Sales” –title “Customer Sales” –Company “Action Lights” This will take the output of the dsquery command (on the left of the pipe (|), and use it as input to the dsmod command on the right of the (|). In this case, it will change the department, title and company properties for all users in the sales container.

  24. DSMove • DSMOVE • can be used to move an object from one container to another from the command line. • Can be used to rename an object from the command line • Syntax - for moving • DSmove distinguished-name –newparent new-container • Syntax – for renaming • DSmove distinguished-name –newname new-name

  25. DSMove: Move Examples Dsmove “cn=sue,ou=finance,dc=domainp,dc=bcc” –newparent “ou=sales,dc=domainp,dc=bcc”This moves the user with an object name of Sue from the finance container in domainp.bcc to the sales container in domainp.bcc Dsmove “ou=users,ou=accounting,dc=domainp,dcc=bcc” –newparent “ou=finance,dc=domainp,dc=bcc” This moves the container named users from the Accounting container within domainp.bcc to the finance container within domainp.bcc.

  26. DSMove: Rename Examples Dsmove “cn=sue,ou=finance,dc=domainp,dc=bcc” –newname suzy This renames the user object with an object name of Sue in the finance container to suzy Dmove “ou=users,ou=accounting,dc=domainp,dcc=bcc” –newname Acc_Users This renamesthe container named users that exists in the Accounting container in domainp.bcc to Acc_Users.

  27. DSRM • Allows objects to be deleted from directory • Can delete single object or entire subtree • Syntax - for removing a single object • DSRM distinguished-name • Syntax – for removing an entire subtree • DSRM distinguished-name –subtree

  28. DSRM: Examples Dsrm “cn=sally,ou=finance,dc=domain16,dc=bcc” –noprompt Deletes the Sally user from the Finance container in Domain16.bcc without prompting for confirmation. Dsrm “ou=Accounting,dc=domainp,dc=bcc” -subtree Deletes the Accounting container from domainp.bcc. Does prompt for confirmation Dsrm “ou=Users,ou=Finance,dc=domainp,dc=bcc” –subtree –noprompt -c Deletes the Users container within the finance container in domainp.bcc without prompting for confirmation and, if there are errors, don’t stop the process - continue deleting.

  29. DSADD Group • DSADD can be used to create many different object types, this and the next few slides will concentrate on using DSADD to create group objects. • Syntax for user account is • DSADD Group distinguished-name switches • Switches commonly used include • -scope –secgrp –memberof

  30. DSAdd Group: Examples Dsadd group “cn=Finance-G,ou=Finance,dc=domainp,dc=bcc” Creates a group named Finance-G in the Finance container of Domainp.bcc. Since no scope or security type have been defined in the command, the group’s scope will be global and the group’s type will be security Dsadd group “cn=Finance-L,ou=Finance,dc=domainp,dc=bcc” -scope L Creates a group named Finance-L in the Finance container of Domainp.bcc. The group’s scope will be domain local and, since the security type has not been defined the group’s type will be security

  31. DSAdd Group: Examples Dsadd group “cn=Sales-G,ou=Sales,dc=domainp,dc=bcc” -scope G –members “cn=sally,ou=sales,dc=domainp,dc=bcc” “cn=joe,ou=sales,dc=domainp,dc=bcc” “cn=bob,ou=sales,dc=domainp,dc=bcc” Creates a group named Sales-G in the Sales container of Domainp.bcc. The group’s scope will be global; it’s type is security. Three users have been added to the group’s member list; Joe, Sally and Bob, each of which are user object’s that exist in the Sales container within domainp.bcc Dsadd group “cn=Sales-L,ou=Sales,dc=domainp,dc=bcc” -scope L –members “ou=Sales-G,ou=sales,dc=domainp,dc=bcc” Creates a group named Sales-L in the Sales container of Domainp.bcc. The group’s scope will be Domain Local; it’s type is security. The Sales-G global group which also exists in the Sales container of Domainp.bcc, is made a member of this group.

  32. DSMOD Group • DSMOD can be used to modify many different object types, this and the next slide will concentrate on using DSMOD to modify group objects. • Syntax for modifying group account is • DSMOD Group distinguished-name -switches • Switches commonly used include • -rmmbr -addmbr

  33. DSMOD Group: Examples Each of the below examples modifies a group object that exists in either the Sales container or the accounting container in the domainp.bcc domain. Dsmod group “cn=Sales-G,ou=Sales,dc=domainp,dc=bcc” -addmbr “cn=JSmith,ou=sales,dc=domainp,dc=bcc” Makes the JSmith user a member of the Sales-G group Dsmod group “cn=Accounting-L, ou=Accounting, dc=domainp, dc=bcc” –addmbr “cn=Accounting-G,ou=Accounting,dc=domainp,dc=bcc” Makes the Accounting-L group a member of the Accounting-G group. Dsmod group “cn=Accounting-G, ou=Accounting, dc=domainp, dc=bcc” –rmmbr “cn=JSmith,ou=Accounting,dc=domainp,dc=bcc” Removes the JSmith user from the member list of the Accounting-G group. Dsmod Group “cn=Sales-G,ou=sales,dc=domainp,dc=bcc” –addmbr “cn=mbrown,ou=sales,dc=domainp,dc=bcc” –rmmbr “cn=sally,ou=sales,dc=domainp,dc=bcc” Makes mbrown a member of the Sales-G group and removes Sally from the members list of the Sales-G group.

  34. DSQuery Group • DSQUERY can be used to query different object types from the command line. • Syntax for querying a Group • DSQUERY Group distinguished-name -switches • Switches commonly used include • -o (controls output’s display) –name -desc

  35. DSQuery Group: Examples dsquery group Displays a list of distinguished names for all groups in the domain dsquery group “ou=Accounting,dc=domainp,dc=bcc” Displays a list of distinguished names for all groups in the Accounting container within Domainp.bcc dsquery group “ou=Accounting,dc=domainp,dc=bcc” –o samid Displays a list of samids for all groups in the Accounting container within Domainp.bcc dsquery group -name sale* Displays a list of distinguished names for all groups in the domain who have an object name that begins with the letters sale.

  36. DSGET • DSGET displays properties of Active Directory Objects. • Syntax • DSGET GROUP distinguished-name –switches • DSGET USER distinguished-name –switches

  37. DSGET Group: Examples Each of the below examples gets properties values of group objects that exist in either the Sales container or the Accounting container in the domainp.bcc domain. DSGET GROUP “cn=Sales-G,ou=Sales,dc=domainp,dc=bcc” -members Displays the members list for the Sales-G group DSGET GROUP “cn=Accounting-L, ou=Accounting, dc=domainp, dc=bcc” –memberof Displays the member of list for the Accounting-L group. This identifies in which groups this group is a member. DSGET GROUP “cn=Accounting-G, ou=Accounting, dc=domainp, dc=bcc” –desc Displays the description property for the Accounting-G group.

  38. DSGET Group: Examples Dsget group “cn=Finance-L,ou=finance,dc=domainp,dc=bcc” –members -expand Displays the members list of the Finance-L group and, if any of the members are groups, it displays the members list of those groups. For example, if the Finance-G group is a member of the Finance-L group, the above command would display the members list from both groups.

  39. DSGET User: Examples Each of the below examples gets properties values of user objects that exist in either the Sales container or the Accounting container in the domainp.bcc domain. DSGET USER “cn=Mary,ou=Sales,dc=domainp,dc=bcc” -memberof Displays a list of groups in which Mary is a member DSGET USER “cn=Susan,ou=Accounting, dc=domainp, dc=bcc” -profile –samid –desc Displays Susan’s profile, description and samid property values.

  40. DSGET User: Examples with Piping Dsquery user –name Susan |dsget user -memberof This will query the domain for a user object named Susan. Dsquery’s output (in this case, the user’s name) will be used as input to the DSGET command. The DSGet command will display the list of groups in which Susan is a member. Dsquery user –name Susan |dsget user –samid -desc This will query the domain for a user object named Susan. Dsquery’s output (in this case, the user’s name) will be used as input to the DSGET command. The DSGet command will display the samid and description property values of the susan user object.

  41. DSGET User: Examples with Piping Dsquery user “ou=finance,dc=domainp,dc=bcc” | dsget user –samid -desc -display This will list all user accounts that exist in the finance container. It will use that list as input to the dsget command on the right side of the pipe. Dsget will display the samid, display name and description property values for each user in the Finance container. Dsget user “cn=susan,ou=sales,dc=domain16,dc=bcc” –memberof | dsget group -members This will use the member of list of the Susan user as input to the dsget command on the right of the pipe. It will then display the members list of each group. In essence, it displays a list of group members for all groups that Susan belongs to.

More Related