Powershell – Where do dsrm, dsadd and dsmove come from

active-directorypowershell

I am writing a script to join a machine to the domain after it has been imaged. (Don't want to do it in Sysprep.)

On the machine I am writing the script on (a battered, world weary IT workhorse with all sorts of crud on it) my script works fine. However on one of my shiny new test machines, it doesn't find dsrm and dsadd.

I can only assume I have inadvertently installed this on my machine in the past. I want these to be used just for the purpose of joining the machines to the domain, so don't want any full blown admin-ware installed.

Where do I get / turn on dsrm etc?

Best Answer

The ds* suite of tools is included with Windows Server 2003 Administration Tools Pack, AKA adminpack. Windows 2003 and 2008 include the tools by default. You can extract the files from the MSI if you only want those couple tools.

Have a look at netdom which can also add/remove computers from the domain.

Related Solutions

Powershell – run AD commands from a standard PowerShell script

DSRM will work fine, too.

However, if you want to stay 100% PowerShell, you can use the ADSI provider to accomplish this natively within PowerShell without modules.

 $computer = "computername"
 $dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()            
 $root = $dom.GetDirectoryEntry()            
 $search = [System.DirectoryServices.DirectorySearcher]$root            
 $search.filter = "(&(objectclass=computer)(name=$computer))"            
 $search.findall() | foreach-object{$_.GetDirectoryEntry() } | foreach-object{$_.DeleteObject(0)}

Powershell – “Correct” way to programatically join a Windows 7 machine to the domain

NETDOM.EXE is all you need. I'd just copy it over and be done with it.

There's no danger in the user having NETDOM.EXE. The same functionality that NETDOM exposes is available in the GUI anyway. So long as the user doesn't have a domain credential with rights to join / disjoin computers from the domain they can't harm your AD with the NETDOM tool. Likewise, if the user isn't a local Administrator of the PC they can't use NETDOM to make the PC believe it's disjoined from the domain any more than using the GUI tools.

Just be sure that you're not leaving credentials on the PC, post-imaging, that could give the user privileged access to the AD.

Best Answer

Related Solutions

Powershell – run AD commands from a standard PowerShell script

Powershell – “Correct” way to programatically join a Windows 7 machine to the domain

Related Topic