Skip to main content

Is there a way to mark all AD objects Delete protected in mass?

In Windows Server 2008, a new feature is available to protect your Active Directory objects from being accidentally deleted. To view this feature:

· Open Active Directory Users and Computers

· Click View à Advanced Features

· Expand your domain.

· Right click and OU and select Properties.

· Click the Object tab.

· You will see a check box marked Protect object from accidental deletion.

The need for this protection rose from administrators accidently removed critical objects from Active Directory. With the only route to recovery being an authoritive restore from backup, this was a problem.

The question in class was how to mark all objects as protected? We attempted to select multiple objects of the same class and the open their properties. The Object tab is not available with multiple objects selected. The next idea was to turn to PowerShell.

On Windows Server 2008 R2, you have an option from the Start menu to open PowerShell Modules. This simply loads additional cmdlets into your PowerShell session. The cmdlets we were interested in are Get-ADOrganizationalUnit, Get-ADUser, Get-ADComputer, Get-ADGroups, Set-ADOrganizationalUnit, Set-ADUser, Set-ADComputer, and Set-ADGroups.

First we can enumerate the properties of the current Organizational Units and expose the setting for the ProtectFromAccidentlDeletion attribute.

Get-ADOrganizationalUnit –filter {name –like “*”} –properties ProtectFromAccidentalDeletion

This will generate a list of all the OUs and expose the current status of the ProtectFromAccidentalDeletion attribute. A setting of False means that it is turned off. To set the attribute to True for all the OUs:

Get-ADOrganizationalUnit –filter {name –like “*”} –properties ProtectFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion –eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

This command will first enumerate all the OUs in Active Directory. It then pipes the results to the Where statement. This statement filters out any OUs that has the protection attribute set to True and sends the rest to the next command. In this case, the set command changes the flag on the ProtectFromAccidentalDeletion from $False to $True. At this point, all your OUs are protected.

You would assume that running the above commands with Get-ADUser and Set-ADUser would do the same for the user objects. Even though you can expose the ProtectFromAccidentalDeletion attribute with Get-ADUser, you cannot change the attribute with Set-ADUser. By typing the following command, Get-Help Set-ADUser –Detailed you will see all the attributes that you can set with the Set-ADUser cmdlet. ProtectFromAccidentalDeletion is not listed. The same holds true for Set-ADComputer and Set-ADGroups.

http://technet.microsoft.com/en-us/library/dd723677(WS.10).aspx

Comments

Anonymous said…
Use the following instead
get-ADobject -filter * -searchbase "DC=yodomain,DC=co,DC=com" | Set-adobject -ProtectedFromAccidentalDeletion $true

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.