Is there a way to mark all AD objects Delete protected in mass?

In Windows Server 2008, a new feature is available to protect your Active Directory objects from being accidentally deleted. To view this feature:

· Open Active Directory Users and Computers

· Click View à Advanced Features

· Expand your domain.

· Right click and OU and select Properties.

· Click the Object tab.

· You will see a check box marked Protect object from accidental deletion.

The need for this protection rose from administrators accidently removed critical objects from Active Directory. With the only route to recovery being an authoritive restore from backup, this was a problem.

The question in class was how to mark all objects as protected? We attempted to select multiple objects of the same class and the open their properties. The Object tab is not available with multiple objects selected. The next idea was to turn to PowerShell.

On Windows Server 2008 R2, you have an option from the Start menu to open PowerShell Modules. This simply loads additional cmdlets into your PowerShell session. The cmdlets we were interested in are Get-ADOrganizationalUnit, Get-ADUser, Get-ADComputer, Get-ADGroups, Set-ADOrganizationalUnit, Set-ADUser, Set-ADComputer, and Set-ADGroups.

First we can enumerate the properties of the current Organizational Units and expose the setting for the ProtectFromAccidentlDeletion attribute.

Get-ADOrganizationalUnit –filter {name –like “*”} –properties ProtectFromAccidentalDeletion

This will generate a list of all the OUs and expose the current status of the ProtectFromAccidentalDeletion attribute. A setting of False means that it is turned off. To set the attribute to True for all the OUs:

Get-ADOrganizationalUnit –filter {name –like “*”} –properties ProtectFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion –eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

This command will first enumerate all the OUs in Active Directory. It then pipes the results to the Where statement. This statement filters out any OUs that has the protection attribute set to True and sends the rest to the next command. In this case, the set command changes the flag on the ProtectFromAccidentalDeletion from $False to $True. At this point, all your OUs are protected.

You would assume that running the above commands with Get-ADUser and Set-ADUser would do the same for the user objects. Even though you can expose the ProtectFromAccidentalDeletion attribute with Get-ADUser, you cannot change the attribute with Set-ADUser. By typing the following command, Get-Help Set-ADUser –Detailed you will see all the attributes that you can set with the Set-ADUser cmdlet. ProtectFromAccidentalDeletion is not listed. The same holds true for Set-ADComputer and Set-ADGroups.

http://technet.microsoft.com/en-us/library/dd723677(WS.10).aspx