Powershell -Partition parameter (Naming Context)

Question

We have four domains set up on our Adaxes service, and I can see them in the Administration Console with no problems. However, I have not been able to figure out how to access the three non-default domains when using Powershell scripts against the Adaxes service. Scripts that omit the -Partition parameter run fine against the default domain, but every variation I've tried on the -Partition parameter fails.
Is there a way in the Administration Console to determine the Naming Context for each of the configured AD domains? Or a powershell command that can query the service to determine the permissible partition values?

Thanks in advance!
Scott Kuntzelman
Electrolux North America

Comments

Hello Scott,

To start with something, could you describe what you are trying to achieve and give a couple of examples that failed?

---

In the Adaxes Administration Console, in the Console Tree, under "Active Directory", I have four domains listed.

When I use any of the cmdlets with the identity parameter set to the SAM account name, it always uses the default domain (the first in the list).

I can apparently get to the other domains by using the complete Distinguished Name, but that kind of defeats the purpose since I won't know in advance which OUs contain the object in the other three domains (if any).

I can use the Quest tools with "get-qaduser -service <domain.com> -identity <samaccountname>" and it works fine, but I have been unable to figure out how to get the same functionality within Adaxes when I'm working with one of the non-default domains. I'm assuming I need to use the -Partition parameter, but every entry I've tried for that parameter fails. It always returns "Can't find an object with identity '<samaccountname>' under '<partition DN>'.

-Partition
Specifies the distinguished name of an Active Directory partition. The distinguished name must be one of the
naming contexts on the current directory server. The cmdlet searches this partition to find the object defined
by the Identity parameter.

How can I find the correct distinguished name for each of the non-default domains on the server? I'm assuming that information has to be in the Management Console somewhere, but I've been unable to find it even after significant searching.

---

And, I have found a workaround using the -Server parameter rather than the -Partition parameter.

I would still like to know how to use the -Partition parameter properly, though.

Answer 1

Scott,

Yes, if you want the cmdlet to look up in a different domain than the default domain, you need to use the -Server parameter, not -Partition. Also, you can use the -Server parameter to select a particular directory server.

As for the -Partition parameter, it allows you to select a particular Active Directory partition. For more information on partitions, have a look at the following article by Microsoft: https://technet.microsoft.com/en-us/lib ... 61591.aspx.