Why AD management is essential for sysadmins in PowerShell - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is Active Directory (AD) management crucial for sysadmins?

Which of the following best explains why sysadmins must manage Active Directory effectively?

A Because AD is only used for storing files and has no impact on network security.

B Because AD automatically manages all network devices without any sysadmin intervention.

C Because AD is a backup system for user data and does not affect user authentication.

D Because AD controls user access and security policies across the network, ensuring proper permissions and compliance.

💡 Hint

Think about what AD controls in a network environment.

Active Directory manages user accounts, permissions, and security policies, which are critical for network security and access control.

💻 Command Output

intermediate

Output of a PowerShell command to list AD users

What is the output of this PowerShell command? Get-ADUser -Filter * -Properties Name | Select-Object -First 3 -ExpandProperty Name

PowerShell

Get-ADUser -Filter * -Properties Name | Select-Object -First 3 -ExpandProperty Name

A ["Name", "Name", "Name"]

B Error: The term 'Get-ADUser' is not recognized as the name of a cmdlet

C ["Alice", "Bob", "Charlie"]

D Empty output

💡 Hint

Get-ADUser lists users; Select-Object picks first 3 names.

The command lists all AD users, selects the first three, and outputs their names as strings.

📝 Syntax

advanced

Identify the syntax error in this AD user creation script

Which option contains the correct syntax to create a new AD user with PowerShell?

PowerShell

New-ADUser -Name "John Doe" -SamAccountName "jdoe" -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) -Enabled $true

A New-ADUser -Name "John Doe" -SamAccountName "jdoe" -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) -Enabled $true

B New-ADUser -Name "John Doe" -SamAccountName "jdoe" -AccountPassword ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force -Enabled $true

C New-ADUser -Name "John Doe" -SamAccountName "jdoe" -AccountPassword "P@ssw0rd" -Enabled $true

D New-ADUser -Name "John Doe" -SamAccountName "jdoe" -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -Force) -Enabled $true

💡 Hint

AccountPassword needs a secure string wrapped in parentheses.

Option A correctly wraps the ConvertTo-SecureString command in parentheses and uses all required parameters.

🔧 Debug

advanced

Why does this AD group membership script fail?

This script is supposed to add a user to a group but fails. What is the error? Add-ADGroupMember -Identity "Admins" -Members "jdoe"

PowerShell

Add-ADGroupMember -Identity "Admins" -Members "jdoe"

A Error: Cannot find an object with identity: 'jdoe' because it does not exist or you do not have permission.

B Error: The parameter -Members is not recognized.

C Success: User 'jdoe' added to group 'Admins'.

D Error: The group 'Admins' does not exist.

💡 Hint

Check if the user 'jdoe' exists and permissions.

The error occurs because the user 'jdoe' is not found or the script lacks permission to access it.

🚀 Application

expert

Automate user account expiration notification

You want to write a PowerShell script that finds all AD users whose accounts expire within 7 days and sends an email notification. Which snippet correctly filters these users?

PowerShell

Get-ADUser -Filter {AccountExpirationDate -le $dateLimit} -Properties AccountExpirationDate

A $dateLimit = (Get-Date).AddDays(7); Get-ADUser -Filter {AccountExpirationDate -le '$dateLimit'} -Properties AccountExpirationDate

B $dateLimit = (Get-Date).AddDays(7); Get-ADUser -Filter {AccountExpirationDate -le $dateLimit} -Properties AccountExpirationDate

C $dateLimit = (Get-Date).AddDays(7); Get-ADUser -Filter 'AccountExpirationDate -le $dateLimit' -Properties AccountExpirationDate

D $dateLimit = (Get-Date).AddDays(7); Get-ADUser -Filter {AccountExpirationDate -lt (Get-Date).AddDays(7)} -Properties AccountExpirationDate

💡 Hint

Use a variable for the date and a script block filter.

Option B correctly sets a variable and uses it inside the filter script block to find users expiring within 7 days.