If you have ever had to take on a Physical-to-Virtual (P2V) migration of a server or other machine, you know that you generally have a fine balance of the following triangle of factors: cost, complexity, and reliability. It seems like the only way to get an easy and reliable solution is to throw gobs of money at either a VMWare infrastructure or something like Platespin. Don't get me wrong: from what I've heard they both offer excellent solutions in that field, but it simply isn't cheap. I had to find out the hard way, but there is another way…

I recently had to spend hours figuring out how to properly modify Active Directory group memberships using Powershell. Some of the .Net methods have not yet been implemented, so I had to get a bit tricky with it. I could find the various bits of information I needed in various places, so I hope that collecting them here in one place is of some use to others. The scenario was that I needed to disable user accounts in a Windows Server 2003 Active Directory environment running with Exchange 2007. We have a fairly customized, hosted Exchange environment, and so disabling a user is not just a simple matter and right-clicking and disabling the account in Active Directory Users and Computers (ADUC); we have a 2-page doc for the process to catch everything from removing group memberships to setting up email forwarding or restrictions, changing dial-in permissions, changing NTFS permissions on profile directories, etc…

I had hoped to put this all in one post, but the thing would have gone on forever! Part I covered some basics in copying group memberships to an Active Directory user from another user, such as a template account, using Powershell. Part II will delve into my misadventures in gaining more control of user group memberships, including removing users from a group either by editing the group's attributes or editing the user's attributes. I was also looking for a way to change dial-in permissions on user accounts, and that will be covered by a similar strategy. While these examples should be less dependent on the MS Exchange 2007 snap-in for Powershell and Powershell Community Extensions, please note that I have not checked through the code samples to confirm what is purely Powershell and what requires those snap-ins…