Le blog technique

Toutes les astuces #tech des collaborateurs de PI Services.

#openblogPI

Voir tous les articles

Retrouvez les articles à la une

[Powershell] – Fonction pour obtenir les membres des groupes Active Directory supérieur à 5000 objets.

par | 14 Juil 2024 | ,

Problème :

Il existe une limitation à la commande « Get-ADGroupMember » et cette dernière est de 5000, ce qui veut dire que si le groupe détient plus de 5000 membres vous obtiendrez un joli message d’erreur du type :

Get-ADGroupMember : The size limit for this resquest was exceeded

Solution :

Voici une fonction Powershell qui vous permettra de récupérer l’intégralité des membres d’un groupe même s’il y en a 10 000 dedans.

Vous pourrez choisir de retourner :

  • Les utilisateurs
  • Les groupes
  • Le tout
<pre class="wp-block-syntaxhighlighter-code">Function Get-AllMembers {
     <#
    .SYNOPSIS
    Return a list of members for a group.

    .DESCRIPTION
    Get-AllMembers is a function that returns a list of members for a specific group.
    
    .PARAMETER Name
    The name of the group you want to get the member list.

    .EXAMPLE
    Get-AllMembers "Domain Admins", "DNS Admins"

    .INPUTS
    String

    .OUTPUTS
        PSCustomObject

    .NOTES
        Author:  ADELAIDE Mathieu
    #>
    PARAM (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
        [STRING]$Name,
        [Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 1)]
        [ValidateSet("UsersOnly","GroupsOnly","All")]
        [STRING]$Return
        )
    Process {
        $Name | Foreach {
            $GroupName = $_
            $ArrayUsers = @()
            $ArrayGroups = @()
            $ArrayAll = @()
            Try {
                $DistinguishedName = Get-ADGroup -Identity $GroupName -ErrorAction Stop | select -ExpandProperty DistinguishedName
                # Searching all Users who's member of current Group
                Try {
                    $AllUsersMembers = Get-ADUser -LDAPFilter "(&(objectCategory=user)(memberOf=$DistinguishedName))" -ErrorAction Stop
                    $AllUsersMembers | foreach {
                        $ArrayUsers += New-Object psobject -Property @{
                            GroupName = $GroupName
                            DistinguishedName = $_.DistinguishedName
                            Enabled = $_.Enabled
                            GivenName = $_.GivenName
                            Name = $_.Name
                            ObjectClass = $_.ObjectClass
                            ObjectGUID = $_.ObjectGUID
                            SamAccountName = $_.SamAccountName
                            SID = $_.SID
                            Surname = $_.Surname
                            UserPrincipalName = $_.UserPrincipalName
                            }

                        # Collect All
                        $ArrayAll += New-Object psobject -Property @{
                            GroupName = $GroupName
                            DistinguishedName = $_.DistinguishedName
                            Enabled = $_.Enabled
                            GivenName = $_.GivenName
                            Name = $_.Name
                            ObjectClass = $_.ObjectClass
                            ObjectGUID = $_.ObjectGUID
                            SamAccountName = $_.SamAccountName
                            SID = $_.SID
                            Surname = $_.Surname
                            UserPrincipalName = $_.UserPrincipalName
                            }
                        }
                    }
                Catch {
                    Write-Warning -Message "Unable to find all users member of $Name"
                    }
                # Searching all Groups who's member of current Group
                Try {
                    $AllGroupsMembers = Get-ADGroup -LDAPFilter "(&(objectCategory=group)(memberOf=$DistinguishedName))" -ErrorAction Stop
                    $AllGroupsMembers | foreach {
                        $ArrayGroups += New-Object psobject -Property @{
                            GroupName = $GroupName
                            DistinguishedName = $_.DistinguishedName
                            GroupCategory = $_.GroupCategory
                            GroupScope = $_.GroupScope
                            Name = $_.Name
                            ObjectClass = $_.ObjectClass
                            ObjectGUID = $_.ObjectGUID
                            SamAccountName = $_.SamAccountName
                            SID = $_.SID
                            }

                        # Collect All
                        $ArrayAll += New-Object psobject -Property @{
                            GroupName = $GroupName
                            DistinguishedName = $_.DistinguishedName
                            Enabled = $_.Enabled
                            GivenName = $_.GivenName
                            Name = $_.Name
                            ObjectClass = $_.ObjectClass
                            ObjectGUID = $_.ObjectGUID
                            SamAccountName = $_.SamAccountName
                            SID = $_.SID
                            Surname = $_.Surname
                            UserPrincipalName = $_.UserPrincipalName
                            }
                        }
                    }
                Catch {
                    # Return an error message if member not found.
                    Write-Warning -Message "Unable to find all groups member of $Name"
                    }
                }
            Catch {
                # Return an error message if Group was not found.
                Write-Warning -Message "Unable to find $Name"
                }
            
            Switch ($Return) {
                "UsersOnly" {Return $ArrayUsers}
                "GroupsOnly" {Return $ArrayGroups}
                "All" {Return $ArrayAll}
                }

            # Release
            $GroupName = $null
            $DistinguishedName = $null
            $AllUsersMembers = $null
            $AllGroupsMembers = $null
            }
        }
    }</pre>

Intune : Désactiver le webmail dans Adobe Acrobat Reader

par | 24 Juin 2024 | ,

Par mesure de sécurité, il est conseillé de désactiver le « Webmail » dans Adobe Acrobat Reader.

Ceci est possible en utilisant un script de remédiation dans Intune.

Script de détection :

$regkey64 = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles"
$regkey32 = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles"
$name = "bDisableWebmail"
    try
    {
        $exists64 = Get-ItemProperty $regkey64 $name -ErrorAction SilentlyContinue
        $exists32 = Get-ItemProperty $regkey32 $name -ErrorAction SilentlyContinue
        #Write-Host "Test-RegistryValue: $exists"
        if ((($exists64 -eq $null) -and ($exists32 -eq $null)) -or (($exists64.bDisableWebmail -ne 1) -and ($exists32.bDisableWebmail -ne 1)))
        {
            Write-Host "Webmail enabled"
            exit 1
        }
        else
        {
            Write-Host "Webmail disabled"
            exit 0
        }
    }
    catch
    {
        return $false
    }

Script de remédiation :

$regkey64 = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles"
$regkey32 = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles"
$name = "bDisableWebmail"
New-item -Path $regkey64 -ErrorAction SilentlyContinue
New-item -Path $regkey32 -ErrorAction SilentlyContinue
New-ItemProperty -Path $regkey64 -Name $name -Value "1"  -PropertyType "DWORD" -Force -ErrorAction SilentlyContinue
New-ItemProperty -Path $regkey32 -Name $name -Value "1"  -PropertyType "DWORD" -Force -ErrorAction SilentlyContinue

 

Intune – Détecter l’installation et l’utilisation du New Teams

par | 24 Mai 2024 | ,

Avec l’arrivée du New Teams, les IT ont besoin d’inventorier les appareils Windows qui l’ont installé et qui l’utilisent.

Ceci est possible en utilisant un script de remédiation Intune, qui fera le check continu sur tous les appareils concernés.

Script de détection :

function Is-NewTeamsInstalled {
    return (Get-AppxPackage *MSTeams* -ErrorAction SilentlyContinue) -ne $null
}
 
# Function to check if Microsoft Teams is the default IM app
function Is-NewTeamsDefault {
    $registryPath = "HKCU:\Software\IM Providers"
    $registryKey = "DefaultIMApp"
    $defaultValue = Get-ItemProperty -Path $registryPath -Name $registryKey -ErrorAction SilentlyContinue
 
    return ($defaultValue -ne $null) -and ($defaultValue.DefaultIMApp -eq "MSTeams")
}
 
# Main script logic
$teamsInstalled = Is-NewTeamsInstalled
$teamsDefault = Is-NewTeamsDefault
 
if ($teamsInstalled -and $teamsDefault) {
    Write-Host "New Teams installed and is set Default!";Exit 0
} 
elseif ($teamsInstalled -or $teamsDefault) {
    Write-Host "New Teams installed but not set Default."
    Exit 1
}
else {
    Write-Host "New Teams not installed."
    Exit 1
}

 

Derniers articles

Catégories

Archives

Auteurs/Autrices