41 lines
3.4 KiB
Markdown
41 lines
3.4 KiB
Markdown
**Requirements:** The CBPAD PowerShell module located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\PowerShell-Modules). Copy the whole CBPAD folder to your jump server to your "C:\Users\\<hash id\>-M\Documents\PowerShell\Modules" or "C:\Users\\<hash id\>-M\Documents\WindowsPowerShell\Modules" folder(s). Depending on what version of PowerShell you typically use.
|
|
You will need to have a copy of the same module on a domain controller as well to delete the OUs. Then the module will need to be copied to your -0 profile but the same location as above.
|
|
|
|
**How To:**
|
|
**Do the following on your jump server**
|
|
|
|
1. **Get the list of site codes that have already been migrated.**
|
|
|
|
1. You will need the distinguished name (DN) of the new area OU that the sites have been migrated to.
|
|
2. Open a elevated PowerShell console on your jump server and import the CBPAD module
|
|
3. Then run "get-cbptransitionedsites -dn \<DN\>
|
|
|
|
1. Ex: get-cbptransitionedsites -dn "OU=NorthCalPacific,OU=West,DC=ad,DC=cbp,DC=dhs,DC=gov"
|
|
2. 
|
|
4. This will create a text file name "Transitioned-site-codes.txt" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory). This will be the default text file that will be used for the rest of this procedure.
|
|
2. **Remove all legacy site admin security groups.**
|
|
|
|
1. From the same elevated Powershell console you can run "remove-siteadmingroups". This will use the text file created to remove all legacy site admin groups from the old site OUs.
|
|
|
|
1. 
|
|
2. If there were any errors it will tell you an "error log" was created and open the error log.
|
|
|
|
1. 
|
|
2. Typically the errors would be that the "\<site OU\> admin" doesn't exist and that it can be ignored. However you may want to review the log to make sure there isn't anything else out of the ordinary.
|
|
3. **Run a report to see if any objects are left in the legacy site OUs that need to be moved before the site OU is deleted.**
|
|
|
|
1. From the same elevated Powershell console you can run "find-cbpemptyous".
|
|
|
|
1. 
|
|
2. This will create a CSV file "transitioned-sites-ad-object-count-\<date\>.csv" located [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory\Logs).
|
|
3. Open the CSV file and do a filter on Column B which is the "ObjectCount" Column. If there is anything but a 0 or a blank filter for those numbers.
|
|
|
|
1. 
|
|
4. Then find out what objects are there and where to move them to. Then move them.
|
|
5. After you move them you can repeat this process again to see if any objects are still there. Repeat this process until you are satisfied that all objects have been moved and you can safely delete the site OUs.
|
|
4. **Delete legacy site OUs.**
|
|
|
|
1. Copy the ""Transitioned-site-codes.txt" from [here](file:///\\ad.cbp.dhs.gov\wsg\WAN%20FILE%20SHARE\ActiveDirectory) to the C:\files directory on the domain controller.
|
|
2. This will need to be done with your -0 account from a domain controller.
|
|
3. Log on to a DC and open an elevated PowerShell console and import module CBPAD.
|
|
4. Run "Remove-legacysiteous". |