Exchange Issues with Delegation due to AdminSDHolder and Protected Groups

We had some really weird issues going on delegating permissions to certain users within Active Directory. Basically, when we would assign them some rights, the rights would just disappear for no rhyme nor reason. What we discovered was Protected Groups. I'm not going to try to explain it, because I don't completely understand it (here's someone much more intelligent doing so on Technet), but I'm going to tell you how to fix it!

The jist of it is that you can't delegate stuff to a user account that is a member of a protected group. Complicating matters is that when you remove someone from a protected group, the setting does not change! You have to go into ADSIEdit and change the AdminCount property on the user's AD object from 1 to 0 manually. Well, you could script that too, but I only had this happen with a few users so I didn't bother with that.

WHY we ran across this is that we had removed some user accounts from the Domain Admins group and had issues with delegating in Exchange. I hear it's a problem with Lync, too, but we don't run that. Again, simply removing someone from the protected group (Domain Admins in this example) does not change the setting. It also bears mentioning that nesting counts. So if User A is a member of a group that's a member of Domain Admins, their AdminCount value will change to 1.

The following commands must be performed inside an Active Directory Powershell Session.

To find which groups are protected, use this command:
Get-ADGroup -LDAPFilter "(objectcategory=group)(admincount=1)" | select name | sort name

To find out which users are protected, use this:
Get-ADUser -LDAPFilter "(objectcategory=person)(samaccountname=*)(admincount=1)" | select name

So what you have to do is get the list of protected users, then cross out any users that are direct or indirect members of the protected groups. The users that remain are unjustly protected. To resolve, simply change the AdminCount value on the remaining users.

Here's a handy function I ran across to get nested group memberships (shout out to Piotr Lewandowski for that).

The protected groups by default include:
Account Operators
Administrators
Backup Operators
Cert Publishers
Domain Admins
Domain Controllers
Enterprise Admins
Print Operators
Read-only Domain Controllers
Replicator
Schema Admins
Server Operators

All OUs in this Domain Should be Protected from Accidental Deletion

I run the best practices analyzer on my domain controllers on the first of the month, every month.

Today I got this result: All OUs in this Domain Should be Protected from Accidental Deletion

So this begets the question: How do I find out which OUs are not protected?

Answer: Of course, make sure you are running this command after doing an import-module activedirectory, from a computer that has the Active Directory Powershell module installed.

The command is:
Get-ADOrganizationalUnit -filter * -Properties * | where {$_.ProtectedFromAccidentalDeletion -eq $False} | select DistinguishedName

There may be a good reason for them not to be protected, but if you want to go ahead and set protection on each OU, you can run this command:
Get-ADOrganizationalUnit -filter * | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

Spiceworld 2015

So I'm still in Austin for one more night. I attended Spiceworld 2015 for the first time, and what an amazing conference! I was a little disappointed in a couple of the breakout sessions but that's to be expected. For the price, it was well worth it to network with other admins, get my "business" card out there with my blog's address, and talk to some vendors. We're looking at a possible converged infrastructure project, and possibly a new backup solution (even though I love Veeam, they don't support KVM). I got a lot of questions answered and met a lot of great people, including from my municipal sector. Hopefully we can keep the relationships going and help each other out. It was really cool, and a little bit overwhelming, to get so much swag from the vendors. Here's a picture from day one, and day two was just as much.

Windows 10 - Useful Group Policies (Part 2 of ??) - Get Rid of Microsoft Edge Taskbar Pin

I'm crunched for time today, but I thought I would at least throw out something today.

One of my current sticking points in creating a workable Windows 10 machine for my users is getting rid of the Microsoft Edge icon that's pinned to the taskbar.

Yes, Edge looks appealing as a browser. My helpdesk, though, is going to have all kinds of questions and issues related to Edge. I don't have the manpower, so we're getting rid of Edge as much as we can.

The only way I've found to get rid of the pinned Edge icon is to nuke all of the pinned items.

To accomplish this, I use a Group Policy Preferences Registry item under User Configuration.

Create a delete action for HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband, but remember to go to the "Common" tab and check the box that says "Apply once and do not reapply", or else your users' pinned items will be disappearing on them!

Now if I could just figure out how to get rid of the Start Menu pinned item.....