{"id":293,"date":"2025-05-20T16:34:51","date_gmt":"2025-05-20T14:34:51","guid":{"rendered":"http:\/\/mariospavlidis.site\/?p=293"},"modified":"2025-05-20T16:34:51","modified_gmt":"2025-05-20T14:34:51","slug":"useful-powershell-commands","status":"publish","type":"post","link":"http:\/\/130.61.57.200\/index.php\/2025\/05\/20\/useful-powershell-commands\/","title":{"rendered":"Useful Powershell commands"},"content":{"rendered":"\n

1. Check if Machine Is Domain Joined<\/strong><\/p>\n\n\n\n

(Get-WmiObject Win32_ComputerSystem).PartOfDomain<\/pre>\n\n\n\n
2. View SPNs for a SQL Server Service Account<\/strong><\/p>\n\n\n\n
setspn -L domain\\sqlsvcaccount<\/pre>\n\n\n\n
3. Register an SPN for SQL Server<\/strong><\/p>\n\n\n\n
setspn -S MSSQLSvc\/sql1.contoso.com:1433 domain\\sqlsvcaccount<\/pre>\n\n\n\n
4. Create a gMSA Account (Domain Admin)<\/strong><\/p>\n\n\n\n
New-ADServiceAccount -Name gMSASQL01 `
  -DNSHostName sql1.contoso.com `
  -PrincipalsAllowedToRetrieveManagedPassword \"SQLServersGroup\"

Test-ADServiceAccount gMSASQL01<\/pre>\n\n\n\n
5. Install gMSA on SQL Server VM<\/strong><\/p>\n\n\n\n
Install-ADServiceAccount -Identity gMSASQL01

Test-ADServiceAccount gMSASQL01<\/pre>\n\n\n\n
6. Delegate Permissions to gMSA (Constrained)<\/strong><\/p>\n\n\n\n
Set-ADUser -Identity gMSASQL01 `
-Add @{msDS-AllowedToDelegateTo=\"MSSQLSvc\/sql2.contoso.com:1433\"}<\/pre>\n\n\n\n
7. Delegate DNS Record Permissions to a Cluster or Listener<\/strong><\/p>\n\n\n\n
dnscmd \/RecordAdd <domain name> AGListenerName A <IP><\/pre>\n\n\n\n
8. View Domain Membership Info<\/strong><\/p>\n\n\n\n
systeminfo | findstr \/B \/C:\"Domain\"
or
(Get-WmiObject Win32_ComputerSystem).Domain<\/pre>\n\n\n\n
9. View Delegation Settings in AD (GUI)<\/strong><\/p>\n\n\n\n
Open Active Directory Users and Computers<\/strong>
Find your gMSA or SQL Server object<\/strong>
Right-click \u2192 Properties<\/strong> \u2192 Delegation tab<\/strong><\/pre>\n\n\n\n
10. Common Permissions for DBA Tasks<\/strong><\/p>\n\n\n\n
Task<\/th>AD Permission Needed<\/th><\/tr><\/thead>
Create AG Listener<\/td>Create Computer Objects + DNS registration<\/td><\/tr>
Use gMSA<\/td>gMSA retrieval rights + Log on as service (local)<\/td><\/tr>
Use linked servers w\/ Kerberos<\/td>Constrained delegation from gMSA to target SPN<\/td><\/tr>
SQL Agent file share access<\/td>gMSA\/file system permissions (domain-level ACLs)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
11. PowerShell AD Module Cmdlets<\/strong><\/p>\n\n\n\n
Cmdlet<\/th>Purpose<\/th><\/tr><\/thead>
Get-ADUser<\/code><\/td>View user\/service account<\/td><\/tr>
Set-ADUser<\/code><\/td>Modify user (e.g., delegate)<\/td><\/tr>
New-ADServiceAccount<\/code><\/td>Create a gMSA<\/td><\/tr>
Install-ADServiceAccount<\/code><\/td>Install gMSA on SQL Server<\/td><\/tr>
Get-ADComputer<\/code><\/td>Inspect SQL Server host or cluster node<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1. Check if Machine Is Domain Joined (Get-WmiObject Win32_ComputerSystem).PartOfDomain 2. View SPNs for a SQL Server Service Account setspn -L domain\\sqlsvcaccount 3. Register an SPN for SQL Server setspn -S MSSQLSvc\/sql1.contoso.com:1433 domain\\sqlsvcaccount 4. Create a gMSA Account (Domain Admin) New-ADServiceAccount -Name gMSASQL01 ` -DNSHostName sql1.contoso.com ` -PrincipalsAllowedToRetrieveManagedPassword “SQLServersGroup”Test-ADServiceAccount gMSASQL01 5. Install gMSA on SQL Server […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-293","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":[],"_links":{"self":[{"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/posts\/293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/comments?post=293"}],"version-history":[{"count":1,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/posts\/293\/revisions"}],"predecessor-version":[{"id":294,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/posts\/293\/revisions\/294"}],"wp:attachment":[{"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/media?parent=293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/categories?post=293"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/130.61.57.200\/index.php\/wp-json\/wp\/v2\/tags?post=293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}