How to enabled all those users who have disabled kerberos preauthentication.

Question

HASSAN BIN NASIR DAR 391

Hi

I have 200 users in my active directory. Few of them have kerberos pre-authentication is disabled.

I can get a list of users who have Kerberos pre-authentication disabled with the help of below cmlets:

Get-ADUSer -Filter { DoesNotRequirePreAuth -eq $true } -Properties DoesNotRequirePreAuth | select SamAccountName, DoesNotRequirePreAuth

My question is:

How to enabled all those users who have disabled kerberos preauthentication.

I have command to enabled one by one user or OU based users. I do not want this.

I want to enabled all those users who have disabled kerberos preauthentication in a domain.

Thanks

1 answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

You can try this command to force kerberos Preauthentication:

Get-ADUSer -Filter 'DoesNotRequirePreAuth -eq $true ' | Set-ADAccountControl -doesnotrequirepreauth $false

Please don't forget to mark helpful answer as accepted

HASSAN BIN NASIR DAR 391 Reputation points

2023-03-23T21:32:24.9+00:00

If we have forest level trust relationships then this cmdlet will work for specific domain or both forest domain?
Thameur-BOURBITA 36,261 Reputation points Moderator

2023-03-23T21:33:36.43+00:00

It will work only on the specific domain.

Please don’t forget to mark helpful answer as accepted
AlanGunnTest 0 Reputation points

2023-07-14T10:32:44.58+00:00

A great example of how output can be piped to other cmdlets and also how to use double negatives. :-)