51 lines
2.8 KiB
PowerShell
51 lines
2.8 KiB
PowerShell
$ErrorActionPreference='SilentlyContinue'
|
|
Import-Module ActiveDirectory -ErrorAction SilentlyContinue
|
|
|
|
"==== FUNCTIONAL LEVELS + DOMAIN ===="
|
|
$f=Get-ADForest; $d=Get-ADDomain
|
|
"Forest mode: $($f.ForestMode) Domain mode: $($d.DomainMode)"
|
|
"Domain: $($d.DNSRoot) NetBIOS: $($d.NetBIOSName) PDC: $($d.PDCEmulator)"
|
|
|
|
"`n==== CURRENT DOMAIN CONTROLLERS ===="
|
|
Get-ADDomainController -Filter * | Select-Object Name,IPv4Address,IsGlobalCatalog,OperatingSystem,Site | Format-Table -Auto | Out-String
|
|
|
|
"==== FSMO HOLDERS ===="
|
|
netdom query fsmo 2>&1 | Out-String
|
|
|
|
"==== LINGERING TPS-SVR DC METADATA (must be clean before promo) ===="
|
|
$cfg=(Get-ADRootDSE).configurationNamingContext
|
|
"-- computer object(s) matching TPS-SVR --"
|
|
Get-ADComputer -Filter 'Name -like "*SVR*"' -Properties operatingSystem,whenCreated | Select-Object Name,DistinguishedName,operatingSystem,whenCreated | Format-Table -Auto | Out-String
|
|
"-- 'server' objects in config Sites (each real/former DC has one) --"
|
|
Get-ADObject -SearchBase "CN=Sites,$cfg" -Filter "objectClass -eq 'server'" -Properties dNSHostName | Select-Object Name,dNSHostName | Format-Table -Auto | Out-String
|
|
"-- nTDSDSA (NTDS Settings) objects = active DC replicas --"
|
|
Get-ADObject -SearchBase "CN=Sites,$cfg" -Filter "objectClass -eq 'nTDSDSA'" | Select-Object DistinguishedName | Format-Table -Auto | Out-String
|
|
"-- Domain Controllers OU members --"
|
|
Get-ADComputer -SearchBase "OU=Domain Controllers,$($d.DistinguishedName)" -Filter * | Select-Object Name | Format-Table -Auto | Out-String
|
|
|
|
"==== AD REPLICATION HEALTH ===="
|
|
repadmin /replsummary 2>&1 | Out-String
|
|
|
|
"==== DHCP AUTHORIZED IN AD (empty => MS DHCP not authoritative) ===="
|
|
Get-DhcpServerInDC 2>&1 | Out-String
|
|
|
|
"==== CERTIFICATE AUTHORITY (assess if in use) ===="
|
|
certutil -cainfo 2>&1 | Select-String 'CA type|CA name|Subject|Expires|Provider' | Out-String
|
|
"-- issued (non-revoked, non-expired-status) cert rows, first 30 --"
|
|
certutil -view -restrict "Disposition=20" -out "RequestID,CommonName,CertificateTemplate,NotAfter" csv 2>&1 | Select-Object -First 30 | Out-String
|
|
"-- total issued rows --"
|
|
$rows = certutil -view -restrict "Disposition=20" -out "RequestID" csv 2>&1
|
|
"issued cert rows (incl header): $(($rows | Measure-Object -Line).Lines)"
|
|
|
|
"==== OLD SERVER IP CONFIG (plan Option B swap) ===="
|
|
Get-NetIPConfiguration | ForEach-Object {
|
|
"IF: $($_.InterfaceAlias) IP: $($_.IPv4Address.IPAddress) GW: $($_.IPv4DefaultGateway.NextHop) DNS: $($_.DNSServer.ServerAddresses -join ',')"
|
|
}
|
|
"-- all IPv4 addrs --"
|
|
Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -notlike '169.*' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object IPAddress,PrefixLength,InterfaceAlias | Format-Table -Auto | Out-String
|
|
|
|
"==== DFS NAMESPACES (Folder Redirection / Shared Folders use these) ===="
|
|
Get-DfsnRoot 2>&1 | Out-String
|
|
|
|
"==== DONE ===="
|