38 lines
3.2 KiB
Markdown
38 lines
3.2 KiB
Markdown
# AD Managed-By Logon Script
|
|
|
|
**Date:** 2026-09-23
|
|
**Project:** ad-managed-by-logon
|
|
**Status:** ongoing
|
|
**Tags:** powershell, active-directory, gpo, logon-script, asset-tracking
|
|
|
|
## Context
|
|
Needed a GPO logon script that automatically tracks which user last logged into each computer. The script stamps the user's DN into the computer object's "Managed By" attribute, and the computer name into the user's "Notes" (info) field, giving two-way lookup in ADUC.
|
|
|
|
## Key Decisions
|
|
- **Dual-method approach (AD module + ADSI fallback)** — not all client machines have RSAT installed, so the script tries `Import-Module ActiveDirectory` first and falls back to raw ADSI/DirectorySearcher. This means zero client prerequisites.
|
|
- **Separate try/catch blocks for each task** — initially both operations were in one try/catch, which meant a `managedBy` access-denied failure (common without delegation) killed the Notes write too. Split so each runs independently.
|
|
- **ASCII-only comments** — the first version used Unicode box-drawing characters (`──`) for section headers, which triggered an encoding warning in PowerShell ISE. Replaced with plain ASCII dashes.
|
|
- **User Notes format** — chose `Last logon: COMPUTERNAME (YYYY-MM-DD HH:mm)` for the info attribute. Includes timestamp so you can tell how recent the data is.
|
|
- **Skip logic for unchanged values** — avoids unnecessary AD writes (and replication churn) by checking current values before writing.
|
|
- **Skip local logins** — if `USERDOMAIN` equals `COMPUTERNAME`, it's a local account login and the script exits cleanly.
|
|
|
|
## Technical Details
|
|
- **Computer attribute:** `managedBy` (DN of the user) — visible on the Managed By tab in ADUC
|
|
- **User attribute:** `info` (string) — visible on the Telephones tab > Notes field in ADUC
|
|
- **Delegation required:** Authenticated Users need "Write Managed By" on Computer objects in the relevant OUs. No delegation needed for the user's `info` attribute (users can write their own Personal Information property set by default).
|
|
- **Log file:** `%TEMP%\Set-ComputerManagedBy.log`, auto-rotates at 256 KB
|
|
- **Deployment path:** `\\domain.local\NETLOGON\Scripts\Set-ComputerManagedBy.ps1`
|
|
- **GPO location:** User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) > Logon
|
|
|
|
## Code Changes
|
|
- `Set-ComputerManagedBy.ps1` — created logon script with AD module + ADSI fallback, managedBy + Notes stamping, separate error handling per task
|
|
- `README.md` — full deployment docs including delegation walkthrough, verification commands, and two-way lookup explanation
|
|
|
|
## Open Questions / Next Steps
|
|
- **AD delegation** — needs to be applied to all computer OUs for non-admin users to write `managedBy`. Without this, only the Notes field works for standard users.
|
|
- **Multi-user machines** — shared/lab PCs will only show the *last* user. Could be extended to append a history instead of overwriting, but would need size management on the `info` attribute.
|
|
- **Existing Notes content** — the script overwrites the `info` attribute entirely. If any users have manually-entered Notes data, it will be replaced. Consider prefixing/appending instead if that's a concern.
|
|
|
|
## Artifacts
|
|
- Repo: https://gitea.hideawaygaming.com.au/jessikitty/ad-managed-by-logon
|