אז מה היה לנו שם? (Hebrew)

Protecting OU from accidental deletion

When you create new Organizational Units in Active Directory Users And Computers (ADUC) in Server 2008 (or with RSAT on 2003 domains), ADUC gives you the option to protect the OU from accidental deletion.

When this option is selected, ADUC updates the security descriptor of the object and, potentially, its parent, with Deny ACE for the Everyone domain group, which denies all administrators or users of this domain and domain controller the ability to delete this object.

Note: This setting does not provide protection against accidental deletion of a subtree that contains the protected object. Therefore, it is recommend that you enable this setting for all the protected object's containers up to the domain naming context head.

If you try to delete the OU you’ll get the following dialog:

To unprotect a container uncheck the value from the object’s Object tab in ADUC. The Object tab is visible only when Advanced Features is selected on the View menu. 

With PowerShell and Quest AD cmdlets we can enable or disable OU protection with a single line of code!

Enable OU protection on all OUs

Get-QADObject –SizeLimit 0 -Type OrganizationalUnit | Add-QADPermission -Deny -Account Everyone -ApplyTo ThisObjectOnly -Rights DeleteTree,Delete

Enable protection for specific OU

Add-QADPermission -Identity 'DistinguishedNameOfTheOU' -Deny -Account Everyone -ApplyTo ThisObjectOnly -Rights DeleteTree,Delete

Remove protection for specific OU

Get-QADPermission -Identity 'DistinguishedNameOfTheOU' -Deny -Account Everyone -ApplyTo ThisObjectOnly | Remove-QADPermission

Powershell 2.0 for XP and Server 2003

PowerShell 2.0 Release Candidate for XP and Server 2003 has been released. The package includes the latest version of PowerShell and WINRM. Download it HERE.

Parsing PowerShell scripts

The PsParser class, introduced in Windows PowerShell 2.0, provides a mechanism to parse a script into a collection of tokens. There are some neat applications written using the Tokenize method such as Syntax Highlighting, Alias resolving and discovering functions in scripts . One other great benefit of the method is the ability to find if a script contains syntax errors without actually running the script.

The Tokenize method has two overloads, both accept a script as a string or as an array of lines (Script parameter) and both update a referenced variable with a collection of the errors that occurred when parsing the script (Errors parameter).

Test-PSScript is a v2 advanced function. Its FilePath parameter accepts input from the pipeline or through the command parameter. The output of the function is an extended Token object (see sample usage and result below) which includes the path of the script, Error Message, the line where the error occurred and some other information.

#Requires -Version 2

function Test-PSScript
{

   param(
      [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] 
      [ValidateNotNullOrEmpty()] 
      [Alias('PSPath','FullName')] 
      [System.String[]] $FilePath,

      [Switch]$IncludeSummaryReport
   )

   begin
   {
      $total=$fails=0
   }

   process
   {
       $FilePath | Foreach-Object {

         if(Test-Path -Path $_ -PathType Leaf)
         {
            $Path = Convert-Path -Path $_ 

            $Errors = $null
            $Content = Get-Content -Path $path 
            $Tokens = [System.Management.Automation.PsParser]::Tokenize($Content,[ref]$Errors)

            if($Errors)
            {
               $fails+=1
               $Errors | Foreach-Object { 
                  $_.Token | Add-Member -MemberType NoteProperty -Name Path -Value $Path -PassThru | `
                  Add-Member -MemberType NoteProperty -Name ErrorMessage -Value $_.Message -PassThru
               }
            }

           $total+=1 
         }  
      }
   } 

   end 
   {
      if($IncludeSummaryReport) 
      {
         Write-Host "`n$total script(s) processed, $fails script(s) contain syntax errors."
      }
   }
}

Sample usage:

PS > Get-ChildItem –Filter *.ps1 | Test-PSScript -IncludeSummaryReport

Path         : D:\scripts\Recycle-IIsAppPool.ps1
ErrorMessage : Missing closing ')' in expression.
Content      : <position>
Type         : Position
Start        : 3928
Length       : 0
StartLine    : 113
StartColumn  : 1
EndLine      : 113
EndColumn    : 1


Path         : D:\scripts\Play-Sound.ps1
ErrorMessage : Missing expression after unary operator '--'.
Content      : --
Type         : Operator
Start        : 975
Length       : 2
StartLine    : 35
StartColumn  : 32
EndLine      : 35
EndColumn    : 34


35 script(s) processed, 2 script(s) contain syntax errors.

For Powershell 1.0 parsing technique see Keith Hill’s Preparsing Scripts to Check for Syntax Errors blog post.

PowerShell 2.0 Modules: An Introduction with Bruce Payette

Join PowerShell Program Manager, Osama Sajid, in an interview with the Principal Software Design Engineer, Bruce Payette, discussing the new PowerShell Modules feature.



Episode one introduces Modules and discusses comparisons with CmdLets.
Episode two demonstrates how to use Modules.
Episode three illustrates how to develop script and binary Modules.