Jason Yoder, MCT

Today in my PowerShell class, we played with the WhenChanged attribute in Active Directory. We were looking at is as part of a question on PowerShell.com. The IT Pro needed to know when an object was last changed. While doing some research, I came across some accounts that the WhenChanged property is only replicated on Global Catalogs, and not the ADDS database. In my testing on Windows Server 2012 R2, replication of this date/time value was replicating on both GCs and non GCs. Getting the most recent value is easy then.       Get-ADUser -Filter { Name -eq "ABC34" } -Properties WhenChanged   The problem here is that this will only reflect the last time stamp of the Domain Controller that you are currently pulling information from. In an AD environment with multiple Sites, the default replication interval is 3 hours. If sites are logically chained together, that means that an update made 2 or 3 sites away from you may not get replicated to you for many hours. ...

It is amazing on how easy it is to be pulled onto a tangent while researching a problem. I was actually looking at ways to better demonstrate Domain Controller Cloning when I got pulled back into an old thought process on RID depletion. I decided to take a look at creating a warning system for myself. Those of you who have taken my PowerShell or Windows classes know that I prefer automation over manual tasks. Here is one that you can add to your weekly domain health checks. This code will take a look at your RID pool. Once it starts to be depleted, it will warn you and provide the Microsoft KB article to help you make the proper planning decisions early. You can run it at the command line or run it as a scheduled task. If you do so, add the name of your SMTP server as the value of $SMTPServer. Also, if your SMTP server requires authentication, take a look at the –Credential parameter in the help file of Send-MailMessage.  Just to give you an idea about how critical this is, once de...