發表文章

目前顯示的是有「Windows 2008 R2」標籤的文章

Active Directory - Use AD Recycle Bin

Active Directory - Use AD Recycle Bin Windows Server 2008 R2 Active Directory includes a feature called the Active Directory Recycle Bin that will allow administrators to restore deleted objects without having to perform an administrative restore. Campus Active Directory has the AD Recycle Bin enabled. The example PowerShell commands bellow can be used to list and restore deleted objects. List Deleted Objects: Get-ADObject -f {isdeleted -eq $true } -includeDeletedObjects -pr * | ft Name,lastknownParent,objectClass Restore a single deleted object: Get-ADObject -f {(isdeleted -eq $true) -and (name -eq )} | Restore-ADObject -identity Restore multiple deleted objects (objects that have a name that ends with "smith"): Get-ADObject -f {(isdeleted -eq $true) -and (name -match "*smith")} -includeDeletedObjects -pr * | restore-adobject Technical Details The amount of time that an object can be recovered is controlled by the Deleted Object Lifetime (DOL). By d...

Windows 2008 R2 Event Forward limits

Just take a notes , it can't forward event over < 20

Windows 2008 R2 event forward XML sample

      *[System[(EventID=4662)]]and *[EventData[Data[@Name='ObjectServer'] and (Data='DS')]] and *[EventData[Data[@Name='AccessMask'] and (Data= '0x20')]] and *[EventData[Data[@Name='ObjectType'] and (Data= '%{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}')]]