Active Directory Metadata PowerShell

Active Directory Metadata PowerShell

Hello,

Active Directory metadata are a very interesting subject. In the old days, we used to use repadmin.exe tool to access them. Nowadays, PowerShell is here to help.

Active Directory Metadata Repadmin

RepAdmin is a very powerful tool, hereunder an example to see the metadata of the default naming context of D2K12R2.local Active Directory domain.

repadmin /showobjmeta dc1 "DC=D2K12R2,DC=local"
Active Directory Metadata PowerShell - Repadmin DefaultNamingContext

Active Directory Metadata PowerShell – Repadmin DefaultNamingContext

Active Directory Metadata PowerShell

We can do the same with PowerShell, it’s even better because we got a object that is easier to handle then a full text output of a binary file.

Get-ADReplicationAttributeMetadata -Object 'DC=D2K12R2,DC=LOCAL' -Server DC1
Active Directory Metadata PowerShell - PowerShell DefaultNamingContext

Active Directory Metadata PowerShell – PowerShell DefaultNamingContext

Because it’s an object, we can use Out-GridView:

Active Directory Metadata PowerShell - PowerShell DefaultNamingContext - Out-GridView

Active Directory Metadata PowerShell – PowerShell DefaultNamingContext – Out-GridView

There is a lot of useful information in this. For example, you can see that the “gplink” attribute is version 3, that means it has been modified twice. You can also see that the default password policy is at version 2.

You can use this on every object in Active Directory, but some are more useful than others.

Admins Users

You can query metadata for one user :

Get-ADUser -Identity Administrator | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell Administrator

Active Directory Metadata PowerShell – PowerShell Administrator

Or for every admins :

Get-ADUser -Filter {AdminCount -eq 1} | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell Admins Filtered

Active Directory Metadata PowerShell – PowerShell Admins Filtered

If you filter on “Version” superior to 1, you can have a list of all attributes modified at least one time on every administrators in the current domain. You can also know from which domain controller and when the modification happened.

You can use this to check the number of password change, the number of ACL change, and a lot of nice things to know.

Admins Groups

You can query the metadata of all the adminis groups with:

Get-ADGroup -Filter {AdminCount -eq 1} | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell Admins Groups Filtered

Active Directory Metadata PowerShell – PowerShell Admins Groups Filtered

Now, you can see the modified attributes list on each administration groups of the current domain. You can see that members changes, the added and remove date of each member, that’s very helpful:

Active Directory Metadata PowerShell - PowerShell Admins Groups Membership

Active Directory Metadata PowerShell – PowerShell Admins Groups Membership

This information is used for the Active Directory replication and should be present for at least the duration of the TombStoneLifeTime. You can track administrative group membership, event for deleted users, as you can see in the screenshot capture above (their name contains “ADEL”).

Organizational Units

Just like users and groups:

Get-ADOrganizationalUnit -Filter * | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell Organizational Units

Active Directory Metadata PowerShell – PowerShell Organizational Units

Metadata of the organizational units are useful to track changes about group policy link, delegation and such.

Trusts

Get-ADTrust -Filter * | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell Trusts

Active Directory Metadata PowerShell – PowerShell Trusts

Metadata of Active Directory trusts contains valuable information about trust directions, UPN routing, and attribute (transitive, SID Filtering, forest, external, etc…).

AdminSDHolder

If you want to please your CISO, you may want to monitor the SecurityDescriptor of the AdminSDHolder object, indeed, those ACL are copied to each and every privilege account/group in the domain. You can read more about it here.

Get-ADObject -Identity "CN=AdminSDHolder,CN=System,$((Get-ADRootDSE).defaultNamingContext)" | Get-ADReplicationAttributeMetadata -Server DC1 | Out-GridView
Active Directory Metadata PowerShell - PowerShell AdminSDHolder

Active Directory Metadata PowerShell – PowerShell AdminSDHolder

In my lab,, the SecurityDescriptor has been changed 6 times, in a production environment, it shouldn’t be that high, or you should be aware of it.

Conclusion

There is several way of getting Active Directory metadata, some a more convenient than others, but they all get the same data.

Active Directory metadata contains a lot of data, not all is interesting, but with a few object manipulation and filter, you can get the useful information out.

Leave a Reply