GPO settings are not listed (as they should per Microsoft article)

You may notice that the settings to be configured by GPO are not listed in your configuration.
The reason of that: specific settings are issued with KB update that got installed on the domain controllers, but not into the SYSVOL location of domain controllers.
To fix the issue you have to manually move the new policy definitions files to the proper location:

1. Copy @.adml file from c:\windows\policydefinitions\en-us to your local sysvol location under sysvol\policydefinitions\en-us.
2. Copy @.admx file from c:\windows\policydefinitions to your local sysvol location under sysvol\policydefinitions.

List of Users with expired password - Quest Powershell

Get-QADUser -SearchRoot "OU=YourOU,DC=YourDomain,DC=com" -SearchScope Subtree -Enabled -Size 0 | Where-Object {($_.PasswordIsExpired) -eq $True} | fl displayname, *password*

Group Policy User/Computer Section

Login Script configured on the "User" section of GPO is applied to both Computer and Users objects, while expected to be applied only to User objects.

How to get list of mailboxes for enabled users only

Task: Provide the list of mailboxes for only accounts that are enabled (excluding the mailboxes for disabled accounts).  This is frequently required for any type of Exchange mailbox migration projects, when disabled mailboxes will not be migrated.

1. Get the all mailboxes list - including disabled (distinguishedname only): in Exchange Management Console run following command:"Get-Mailbox -resultsize unlimited | select-object distinguishedname | export-csv c:\admin\dn_mailboxes_all.csv -notype"
2. Get the list of distinguishednames of disabled accounts: using Quest ActiveRoles Management Shell: "Search-ADAccount -AccountDisabled | select-object distinguishedname | export-csv c:\admin\disabled-objects.csv -notype"
3. So - now we have 2 spreadsheets, first has all mailboxes, second all disabled objects - use your favorite way to select only items that exist in person first spreadsheet, but not in second.  I use Excel Pivot table: I combine both spreadsheets in one (simple copy/paste will work) and then I insert Pivot Table with 'count' option for that column...  The lines that have count '2' exist in both files, therefore disabled, so I need only lines that have count '1'.
4. Copy the ones that have count "1" (therefore either enabled objects or disabled non-user objects) to txt file (c:\admin\enabledobjects.txt in our case).
5. In Exchange Management Console run following command: "get-content c:\admin\enabledobjects.txt | Get-Mailbox -resultsize unlimited | select-object displayname, Organizationalunit, UserPrincipalname, PrimarySMTPAddress, ServerName | export-csv c:\admin\mailboxes_enabled_users.csv -notype" (note that when you run the script, non-user objects will produce error, that is normal: non-user objects do not have a mailbox, therefore the resulting file will have correct information with only enabled user mailboxes).

I am sure there maybe more elegant ways to do this...

Restart the domain controller in Directory Services Restore Mode Remotely

Extremely useful article when you need to boot domain controller into Directory Services Restore Mode Remotely:

http://technet.microsoft.com/en-us/library/cc779687(WS.10).aspx

Assign permissions to the tree of OUs when inheritance turned off (through Powershell)

Recently I needed to add permission to move computer objects to OUs for the group of users. I added the permissions to the “root” OU and tested it: everything worked great.
After I reported that task is done, I heard from the users in that group that they still get ‘Access is denied’ trying to move computer objects. I discovered that in AD permissions inheritance was disabled for most of the sub-OUs. So, there are more than 1,000 OUs to add permissions to.
Following script took care of the task for me:
#Require Quest "Active Roles Management Shell for Active Directory".

#Put following to the text document saved as *.ps1:

add-PSSnapin quest.activeroles.admanagement
$OU = “root OU DN”
get-qadobject -searchRoot $OU -searchScope 'SubTree'-Type organizationalUnit -SizeLimit 0 |
Add-QADPermission -Account “domainname\user group to add permissions” -Rights CreateChild -ApplyTo All -ChildType
Computer