### Start Process with Timeout Example

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Start-ProcessWithTimeout.md

Use this to start an executable like 'djoin.exe' with specific arguments and a timeout of 300 seconds.

```powershell
Start-ProcessWithTimeout -FilePath 'djoin.exe' -ArgumentList '/PROVISION /DOMAIN contoso.com /MACHINE SRV1' -Timeout 300
```

--------------------------------

### Get Domain Object Example

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-DomainObject.md

This example demonstrates how to retrieve a domain object using its domain name. Ensure the domain name is correctly specified.

```powershell
Get-DomainObject -DomainName contoso.com
```

--------------------------------

### Install ActiveDirectoryDsc Module

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/Home

Installs the ActiveDirectoryDsc module from the PowerShell Gallery. Ensure you have PowerShellGet installed.

```powershell
Install-Module -Name ActiveDirectoryDsc -Repository PSGallery
```

--------------------------------

### Add AD Domain Controller Using Installation Media

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainController

This configuration adds a domain controller to an existing domain by utilizing installation media. Ensure the media path is correctly specified and the domain is available.

```powershell
Configuration ADDomainController_AddDomainControllerToDomainUsingIFM_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        WindowsFeature 'InstallADDomainServicesFeature'
        {
            Ensure = 'Present'
            Name   = 'AD-Domain-Services'
        }

        WindowsFeature 'RSATADPowerShell'
        {
            Ensure    = 'Present'
            Name      = 'RSAT-AD-PowerShell'

            DependsOn = '[WindowsFeature]InstallADDomainServicesFeature'
        }

        WaitForADDomain 'WaitForestAvailability'
        {
            DomainName = 'contoso.com'
            Credential = $Credential

            DependsOn  = '[WindowsFeature]RSATADPowerShell'
        }

        ADDomainController 'DomainControllerWithIFM'
        {
            DomainName                    = 'contoso.com'
            Credential                    = $Credential
            SafeModeAdministratorPassword = $SafeModePassword
            InstallationMediaPath         = 'F:\\IFM'

            DependsOn                     = '[WaitForADDomain]WaitForestAvailability'
        }
    }
}
```

--------------------------------

### Install StubCommand Module

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/tests/Unit/Stubs/README.md

Install the 'Indented.StubCommand' module from the PowerShell Gallery. This module is required for generating stub functions.

```powershell
Install-Module Indented.StubCommand -Scope CurrentUser
```

--------------------------------

### Install Windows Features for AD

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/tests/Unit/Stubs/README.md

Install the 'AD-Domain-Services' and 'RSAT-AD-PowerShell' Windows features. These features provide the necessary components for working with Active Directory.

```powershell
Add-WindowsFeature AD-Domain-Services
Add-WindowsFeature RSAT-AD-PowerShell
```

--------------------------------

### Verify ActiveDirectoryDsc Installation

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/Home

Confirms that the ActiveDirectoryDsc DSC resources are available after installation. This command lists all DSC resources from the specified module.

```powershell
Get-DscResource -Module ActiveDirectoryDsc
```

--------------------------------

### Test User Password

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Test-Password.md

This example demonstrates how to use the Test-Password cmdlet to check if a user's password is valid. Ensure the $cred variable is properly defined with the user's credentials.

```powershell
Test-Password -DomainName contoso.com -UserName 'user1' -Password $cred
```

--------------------------------

### Test Array Members

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Test-Members.md

Use this example to test if the existing members in an array exactly match the specified members. This is useful for validating configurations or states.

```powershell
Test-Members -ExistingMembers fred, bill -Members fred, bill
```

--------------------------------

### Get-ActiveDirectoryForest

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ActiveDirectoryForest.md

This example demonstrates how to retrieve an Active Directory Forest object using the Get-ActiveDirectoryForest cmdlet.

```APIDOC
## Get-ActiveDirectoryForest

### Description
Gets a Forest object for the specified context.

### Syntax
```powershell
Get-ActiveDirectoryForest -DirectoryContext <DirectoryContext> [<CommonParameters>]
```

### Parameters
#### -DirectoryContext
Specifies the Active Directory context from which the forest object is returned. The Get-ADDirectoryContext cmdlet retrieves a value that can be provided in this parameter.

- **Type**: System.DirectoryServices.ActiveDirectory.DirectoryContext
- **Required**: True
- **Position**: 1

### Examples
#### EXAMPLE 1
```powershell
Get-ActiveDirectoryForest -DirectoryContext $context
```

### Outputs
System.DirectoryServices.ActiveDirectory.Forest
```

--------------------------------

### Configure AD Domain Controller with ADDomainController DSC Resource

Source: https://context7.com/dsccommunity/activedirectorydsc/llms.txt

Use ADDomainController to install AD DS and promote a server to a domain controller. Supports Read-Only Domain Controllers (RODC), Install-From-Media (IFM), and FSMO role assignment.

```powershell
Configuration ADDomainController_Examples
{
    param (
        [Parameter(Mandatory)] [PSCredential] $Credential,
        [Parameter(Mandatory)] [PSCredential] $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node 'RODC01'
    {
        WindowsFeature 'ADDS' { Name = 'AD-Domain-Services'; Ensure = 'Present' }
        WindowsFeature 'RSAT' { Name = 'RSAT-AD-PowerShell'; Ensure = 'Present';
                                DependsOn = '[WindowsFeature]ADDS' }

        WaitForADDomain 'WaitForDomain'
        {
            DomainName = 'contoso.com'
            Credential = $Credential
            DependsOn  = '[WindowsFeature]RSAT'
        }

        # Read-Only Domain Controller with password replication policy
        ADDomainController 'RODC'
        {
            DomainName                          = 'contoso.com'
            Credential                          = $Credential
            SafeModeAdministratorPassword       = $SafeModePassword
            ReadOnlyReplica                     = $true
            SiteName                            = 'BranchOffice'
            DelegatedAdministratorAccountName   = 'contoso\adm.branch'
            AllowPasswordReplicationAccountName = @('BranchUser1', 'BranchUser2')
            DenyPasswordReplicationAccountName  = @('SVC_SQL', 'Domain Admins')
            DependsOn                           = '[WaitForADDomain]WaitForDomain'
        }
    }
}
```

--------------------------------

### Start-ProcessWithTimeout Function

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Start-ProcessWithTimeout.md

This function starts a process and waits for it to complete within a specified timeout period. It returns the exit code of the process.

```APIDOC
## Start-ProcessWithTimeout

### Description
Starts a process with a timeout. The function returns an Int32 object representing the exit code of the started process.

### Syntax
```powershell
Start-ProcessWithTimeout [-FilePath] <String> [[-ArgumentList] <String[]>] [-Timeout] <UInt32>
```

### Parameters
#### -FilePath
Specifies the path to the executable to start.
- Type: System.String
- Required: True
- Position: 1

#### -ArgumentList
Specifies the arguments that should be passed to the executable.
- Type: System.String[]
- Required: False
- Position: 2

#### -Timeout
Specifies the timeout in seconds to wait for the process to finish.
- Type: System.UInt32
- Required: True
- Position: 3
- Default value: 0

### Examples
#### EXAMPLE 1
```powershell
Start-ProcessWithTimeout -FilePath 'djoin.exe' -ArgumentList '/PROVISION /DOMAIN contoso.com /MACHINE SRV1' -Timeout 300
```

### Outputs
- System.Int32: The exit code of the started process.
```

--------------------------------

### Install Active Directory PowerShell Module (Windows Server)

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/Home

Installs the Active Directory PowerShell module on Windows Server using Server Manager features. This is a prerequisite for managing Active Directory with PowerShell.

```powershell
Install-WindowsFeature -Name 'RSAT-AD-PowerShell'
```

--------------------------------

### Add AD Domain Controller with All Properties

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainController

Use this configuration to add a domain controller to an existing domain, specifying all available properties for the ADDomainController resource. Ensure the necessary Windows Features are installed and the domain is available before applying.

```powershell
Configuration ADDomainController_AddDomainControllerToDomainAllProperties_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        WindowsFeature 'InstallADDomainServicesFeature'
        {
            Ensure = 'Present'
            Name   = 'AD-Domain-Services'
        }

        WindowsFeature 'RSATADPowerShell'
        {
            Ensure    = 'Present'
            Name      = 'RSAT-AD-PowerShell'

            DependsOn = '[WindowsFeature]InstallADDomainServicesFeature'
        }

        WaitForADDomain 'WaitForestAvailability'
        {
            DomainName = 'contoso.com'
            Credential = $Credential

            DependsOn  = '[WindowsFeature]RSATADPowerShell'
        }

        ADDomainController 'DomainControllerAllProperties'
        {
            DomainName                    = 'contoso.com'
            Credential                    = $Credential
            SafeModeAdministratorPassword = $SafeModePassword
            DatabasePath                  = 'C:\\Windows\\NTDS'
            LogPath                       = 'C:\\Windows\\Logs'
            SysvolPath                    = 'C:\\Windows\\SYSVOL'
            SiteName                      = 'Europe'
            IsGlobalCatalog               = $true

            DependsOn                     = '[WaitForADDomain]WaitForestAvailability'
        }
    }
}
```

--------------------------------

### Set ADForestFunctionalLevel

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADForestFunctionalLevel

This example demonstrates how to use the ADForestFunctionalLevel resource to change the forest functional level to Windows Server 2012 R2 Forest.

```APIDOC
## ADForestFunctionalLevel

### Description

This resource changes the forest functional level. For further details, see [Forest and Domain Functional Levels](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels).

**WARNING: This action might be irreversible!** Make sure you understand
the consequences of changing the forest functional level.

Read more about raising function levels and potential roll back
scenarios in the Active Directory documentation, for example: [Upgrade Domain Controllers to Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers).

### Parameters

#### Parameters

- **ForestIdentity** (String) - Required - Specifies the Active Directory forest to modify. You can identify a forest by its fully qualified domain name (FQDN), GUID, DNS host name, or NetBIOS name.
- **ForestMode** (String) - Required - Specifies the functional level for the Active Directory forest. Allowed Values: `Windows2008R2Forest`, `Windows2012Forest`, `Windows2012R2Forest`, `Windows2016Forest`, `Windows2025Forest`

### Example

This configuration will change the forest functional level to
a Windows Server 2012 R2 Forest.

```powershell
Configuration ADForestFunctionalLevel_SetLevel_Config
{
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADForestFunctionalLevel 'ChangeForestFunctionalLevel'
        {
            ForestIdentity = 'contoso.com'
            ForestMode     = 'Windows2012R2Forest'
        }
    }
}
```
```

--------------------------------

### Create an AD Replication Site Link

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADReplicationSiteLink

Use this configuration to create a new AD Replication Site Link. Ensure the 'ActiveDirectoryDsc' module is imported.

```powershell
Configuration ADReplicationSiteLink_CreateReplicationSiteLink_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADReplicationSiteLink 'HQSiteLink'
        {
            Name                          = 'HQSiteLInk'
            SitesIncluded                 = @('site1', 'site2')
            Cost                          = 100
            ReplicationFrequencyInMinutes = 15
            Ensure                        = 'Present'
        }
    }
}
```

--------------------------------

### Create an Active Directory Replication Site

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADReplicationSite

Use this snippet to create a new Active Directory replication site. Ensure the ActiveDirectoryDsc module is imported.

```powershell
Configuration ADReplicationSite_CreateADReplicationSite_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADReplicationSite 'SeattleSite'
        {
            Ensure = 'Present'
            Name   = 'Seattle'
        }
    }
}
```

--------------------------------

### Enable Replication Options on an AD Replication Site Link

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADReplicationSiteLink

This configuration demonstrates how to enable specific replication options such as Change Notification, Two-Way Sync, and Compression for an existing AD Replication Site Link. Ensure the 'ActiveDirectoryDsc' module is imported.

```powershell
Configuration ADReplicationSiteLink_EnableOptions_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADReplicationSiteLink 'HQSiteLink'
        {
            Name                          = 'HQSiteLInk'
            SitesIncluded                 = 'site1'
            SitesExcluded                 = 'site2'
            Cost                          = 100
            ReplicationFrequencyInMinutes = 20
            OptionChangeNotification      = $true
            OptionTwoWaySync              = $true
            OptionDisableCompression      = $true
            Ensure                        = 'Present'
        }
    }
}
```

--------------------------------

### Install Active Directory PowerShell Module (Windows 10)

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/Home

Installs the Active Directory PowerShell module on Windows 10 using DISM. This command adds the necessary capabilities for AD management.

```powershell
DISM /Online /add-capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
```

--------------------------------

### Create and Enable a Computer Account

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADObjectEnabledState

This configuration creates a computer account with the 'EnabledOnCreation' property set to false, and then uses the ADObjectEnabledState resource to enforce that the account is enabled. This is useful when you need to ensure a computer account exists and is enabled for subsequent operations.

```powershell
Configuration ADObjectEnabledState_EnabledComputerAccount_Config
{
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADComputer 'CreateDisabled'
        {
            ComputerName      = 'CLU_CNO01'
            EnabledOnCreation = $false
        }

        ADObjectEnabledState 'EnforceEnabledPropertyToEnabled'
        {
            Identity    = 'CLU_CNO01'
            ObjectClass = 'Computer'
            Enabled     = $true

            DependsOn   = '[ADComputer]CreateDisabled'
        }
    }
}
```

--------------------------------

### Get Common AD Parameters for New-ADUser Splatting

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ADCommonParameters.md

This snippet is used to get connection parameters specifically for cmdlets like New-ADUser, which utilize the 'Name' parameter instead of 'Identity'. The -UseNameParameter flag ensures the output is formatted correctly for such cmdlets.

```powershell
Get-CommonADParameters @PSBoundParameters -UseNameParameter
```

--------------------------------

### Get Domain Name

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-DomainName.md

Use this cmdlet to retrieve the Active Directory domain name of the computer. No parameters are required.

```powershell
Get-DomainName
```

--------------------------------

### Create a KDS Root Key

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADKDSKey

This configuration creates a KDS root key. Ensure the EffectiveTime is set to a future date to allow Active Directory to replicate the key properly. A minimum of 10 hours from creation is recommended.

```powershell
Configuration ADKDSKey_CreateKDSRootKey_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADKDSKey 'ExampleKDSRootKey'
        {
            Ensure        = 'Present'
            EffectiveTime = '1/1/2030 13:00'
            # Date must be set to at time in the future
        }
    }
}
```

--------------------------------

### Get Domain Controller Object

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-DomainControllerObject.md

Use this cmdlet to retrieve the domain controller object for a specified domain. Ensure you provide the domain name.

```powershell
Get-DomainControllerObject -DomainName contoso.com
```

--------------------------------

### Create a KDS Root Key in the Past

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADKDSKey

This configuration creates a KDS root key with an EffectiveTime set in the past. Use the 'AllowUnsafeEffectiveTime' parameter with caution, as it may cause issues if domain controllers have not yet replicated the key. This is primarily for lab environments.

```powershell
Configuration ADKDSKey_CreateKDSRootKeyInPast_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADKDSKey 'ExampleKDSRootKeyInPast'
        {
            Ensure                   = 'Present'
            EffectiveTime            = '1/1/1999 13:00'
            AllowUnsafeEffectiveTime = $true # Use with caution
        }
    }
}
```

--------------------------------

### Add Domain Controller to Existing Domain (Minimal)

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainController

This configuration adds a domain controller to an existing domain. Ensure the provided credentials have the necessary domain permissions and that the DNS server is correctly configured if `InstallDns` is used.

```powershell
Configuration ADDomainController_AddDomainControllerToDomainMinimal_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        WindowsFeature 'InstallADDomainServicesFeature'
        {
            Ensure = 'Present'
            Name   = 'AD-Domain-Services'
        }

        WindowsFeature 'RSATADPowerShell'
        {
            Ensure    = 'Present'
            Name      = 'RSAT-AD-PowerShell'

            DependsOn  = '[WindowsFeature]InstallADDomainServicesFeature'
        }

        WaitForADDomain 'WaitForestAvailability'
        {
            DomainName = 'contoso.com'
            Credential = $Credential

            DependsOn  = '[WindowsFeature]RSATADPowerShell'
        }

        ADDomainController 'DomainControllerMinimal'
        {
            DomainName                    = 'contoso.com'
            Credential                    = $Credential
            SafeModeAdministratorPassword = $SafeModePassword

            DependsOn                     = '[WaitForADDomain]WaitForestAvailability'
        }
    }
}
```

--------------------------------

### Create a New Domain-Local Group with Members

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADGroup

This configuration shows how to create a new domain-local group and specify its members directly. The 'Members' parameter accepts an array of strings representing the members' names.

```powershell
Configuration ADGroup_NewGroupWithMembers_Config
{
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADGroup 'dl1'
        {
            GroupName  = 'DL_APP_1'
            GroupScope = 'DomainLocal'
            Members    = 'john', 'jim', 'sally'
        }
    }
}
```

--------------------------------

### Get Current User Identity

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-CurrentUser.md

Call this function to retrieve the WindowsIdentity object representing the current user. This is a wrapper function intended for test mocking.

```powershell
Get-CurrentUser
```

--------------------------------

### Get File Content as Byte Array

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ByteContent.md

Use this cmdlet to read the entire content of a file into a byte array. Ensure the file path is correctly specified.

```powershell
Get-ByteContent -Path $path
```

--------------------------------

### Create Cluster with Disabled Account and Enforce Enabled State

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADObjectEnabledState

This configuration demonstrates creating a computer account for a cluster, initially disabled, then configuring the cluster, and finally enforcing the computer account to be enabled. It requires the xFailoverCluster module and a PSCredential for domain access.

```powershell
Configuration ADObjectEnabledState_CreateClusterComputerAccount_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc
    Import-DscResource -ModuleName xFailoverCluster -ModuleVersion '1.14.1'

    node localhost
    {
        ADComputer 'ClusterAccount'
        {
            ComputerName      = 'CLU_CNO01'
            EnabledOnCreation = $false
        }

        xCluster 'CreateCluster'
        {
            Name                          = 'CLU_CNO01'
            StaticIPAddress               = '192.168.100.20/24'
            DomainAdministratorCredential = $Credential

            DependsOn                     = '[ADComputer]ClusterAccount'
        }

        ADObjectEnabledState 'EnforceEnabledPropertyToEnabled'
        {
            Identity    = 'CLU_CNO01'
            ObjectClass = 'Computer'
            Enabled     = $true

            DependsOn   = '[xCluster]CreateCluster'
        }
    }
}
```

--------------------------------

### Get Active Directory Forest Object

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ActiveDirectoryForest.md

Use this snippet to retrieve a Forest object for a specified Active Directory context. Ensure the DirectoryContext variable is properly initialized before execution.

```powershell
Get-ActiveDirectoryForest -DirectoryContext $context
```

--------------------------------

### Get Forest Directory Context

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ADDirectoryContext.md

Use this snippet to retrieve a DirectoryContext object for a forest. Specify the context type as 'Forest' and provide the fully qualified domain name of the forest.

```powershell
Get-ADDirectoryContext -DirectoryContextType 'Forest' -Name contoso.com
```

--------------------------------

### Add a member to an AD group using DistinguishedName

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Set-ADCommonGroupMember.md

Use this example to add a specific user to a group when their DistinguishedName is known. The MembershipAttribute parameter must be set to 'DistinguishedName' for this to work correctly.

```powershell
Set-ADCommonGroupMember -Members 'cn=user1,cn=users,dc=contoso,dc=com' -MembershipAttribute 'DistinguishedName' -Parameters @{Identity='cn=group1,cn=users,dc=contoso,dc=com'}
```

--------------------------------

### Create Active Directory Computer Accounts

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADComputer

This configuration demonstrates how to create two Active Directory computer accounts. The 'EnabledOnCreation' property is used to specify if the account should be enabled upon creation. Note that the 'Enabled' property itself is not enforced by this resource.

```powershell
Configuration ADComputer_AddComputerAccount_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADComputer 'CreateEnabled_SQL01'
        {
            ComputerName         = 'SQL01'

            PsDscRunAsCredential = $Credential
        }

        ADComputer 'CreateEnabled_SQL02'
        {
            ComputerName         = 'SQL02'
            EnabledOnCreation    = $true

            PsDscRunAsCredential = $Credential
        }
    }
}
```

--------------------------------

### Create AD Replication Subnet with DSC

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADReplicationSubnet

This configuration snippet demonstrates how to create an Active Directory replication subnet using the ADReplicationSubnet DSC resource. Ensure the ActiveDirectoryDsc module is imported.

```powershell
Configuration ADReplicationSubnet_CreateReplicationSubnet_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADReplicationSubnet 'LondonSubnet'
        {
            Name        = '10.0.0.0/24'
            Site        = 'London'
            Location    = 'Datacenter 3'
            Description = 'Datacenter Management Subnet'
        }
    }
}
```

--------------------------------

### Get Active Directory Domain Object

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ActiveDirectoryDomain.md

Use this command to retrieve the Domain object for a given directory context. Ensure the $context variable is properly initialized with a DirectoryContext object before execution.

```powershell
Get-ActiveDirectoryDomain -DirectoryContext $context
```

--------------------------------

### ADOptionalFeature

Source: https://context7.com/dsccommunity/activedirectorydsc/llms.txt

Enables forest-wide optional features such as the Active Directory Recycle Bin. Enabling the Recycle Bin is a prerequisite for `RestoreFromRecycleBin` to work correctly in other resources.

```APIDOC
## ADOptionalFeature — Enable optional AD forest features (e.g., Recycle Bin)

`ADOptionalFeature` enables forest-wide optional features such as the Active Directory Recycle Bin. Enabling the Recycle Bin is a prerequisite for `RestoreFromRecycleBin` to work correctly in other resources.

### Example Usage:

```powershell
Configuration ADOptionalFeature_Examples
{
    param (
        [Parameter(Mandatory)] [PSCredential] $EnterpriseAdminCred
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc

    node 'localhost'
    {
        ADOptionalFeature 'RecycleBin'
        {
            FeatureName                       = 'Recycle Bin Feature'
            ForestFQDN                        = 'contoso.com'
            EnterpriseAdministratorCredential = $EnterpriseAdminCred
        }
    }
}
```
```

--------------------------------

### Get Parent DN of an AD Object

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ADObjectParentDN.md

Use this cmdlet to retrieve the distinguished name of the parent container for a specified Active Directory object. Provide the full distinguished name of the object as input.

```powershell
Get-ADObjectParentDN -DN CN=User1,CN=Users,DC=contoso,DC=com
```

--------------------------------

### Create a New Domain-Local Group

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADGroup

This configuration demonstrates how to create a new domain-local group with specified scope, category, and description. Ensure the ActiveDirectoryDsc module is imported.

```powershell
Configuration ADGroup_NewGroup_Config
{
    param
    (
        [parameter(Mandatory = $true)]
        [System.String]
        $GroupName,

        [ValidateSet('DomainLocal', 'Global', 'Universal')]
        [System.String]
        $Scope = 'Global',

        [ValidateSet('Security', 'Distribution')]
        [System.String]
        $Category = 'Security',

        [ValidateNotNullOrEmpty()]
        [System.String]
        $Description
    )

    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADGroup 'ExampleGroup'
        {
            GroupName   = $GroupName
            GroupScope  = $Scope
            Category    = $Category
            Description = $Description
            Ensure      = 'Present'
        }
    }
}
```

--------------------------------

### Resolve Group Members' DistinguishedNames to SIDs

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Resolve-MembersSecurityIdentifier.md

This example translates all DistinguishedName values for the Members of a specified Active Directory group into their SID values. It requires the group's identity and specifies 'DistinguishedName' as the MembershipAttribute.

```powershell
Get-ADGroup -Identity 'GroupName' -Properties 'Members' | Resolve-MembersSecurityIdentifier -MembershipAttribute 'DistinguishedName'
```

--------------------------------

### Create New Forest or Child Domain with ADDomain

Source: https://context7.com/dsccommunity/activedirectorydsc/llms.txt

Use ADDomain to provision new Active Directory domains. Set DomainType to 'ChildDomain' and provide ParentDomainName for subordinate domains. Functional levels can be specified using strings like 'WinThreshold'.

```powershell
Configuration ADDomain_Examples
{
    param (
        [Parameter(Mandatory)] [PSCredential] $Credential,
        [Parameter(Mandatory)] [PSCredential] $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node 'DC01'
    {
        # Ensure the AD DS role and management tools are present
        WindowsFeature 'ADDS'  { Name = 'AD-Domain-Services';  Ensure = 'Present' }
        WindowsFeature 'RSAT'  { Name = 'RSAT-AD-PowerShell';  Ensure = 'Present' }

        # New forest — creates contoso.com at Windows Server 2016 functional level
        ADDomain 'NewForest'
        {
            DomainName                    = 'contoso.com'
            Credential                    = $Credential
            SafemodeAdministratorPassword = $SafeModePassword
            ForestMode                    = 'WinThreshold'   # Windows Server 2016
        }
    }

    node 'CHILDDC01'
    {
        WindowsFeature 'ADDS' { Name = 'AD-Domain-Services'; Ensure = 'Present' }
        WindowsFeature 'RSAT' { Name = 'RSAT-AD-PowerShell'; Ensure = 'Present' }

        # Child domain — creates child.contoso.com inside the existing forest
        ADDomain 'ChildDomain'
        {
            DomainName                    = 'child'
            ParentDomainName              = 'contoso.com'
            DomainType                    = 'ChildDomain'
            DomainMode                    = 'WinThreshold'
            Credential                    = $Credential
            SafemodeAdministratorPassword = $SafeModePassword
        }
    }
}
```

--------------------------------

### Create AD Computer Account and Generate ODJ Request File

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADComputer

This configuration creates an Active Directory computer account on a specified domain controller and in a specific organizational unit. It then generates an Offline Domain Join Request file to a specified path.

```powershell
Configuration ADComputer_AddComputerAccountAndCreateODJRequest_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADComputer 'CreateComputerAccount'
        {
            DomainController = 'DC01'
            ComputerName     = 'NANO-200'
            Path             = 'OU=Servers,DC=contoso,DC=com'
            RequestFile      = 'D:\\ODJFiles\\NANO-200.txt'
            Credential       = $Credential
        }
    }
}
```

--------------------------------

### Get Common AD Parameters for Splatting

Source: https://github.com/dsccommunity/activedirectorydsc/blob/main/source/Modules/ActiveDirectoryDsc.Common/docs/Get-ADCommonParameters.md

Use this snippet to obtain connection parameters for cmdlets like Get-ADUser when using splatted parameters. It processes the current bound parameters to derive the necessary AD connection information.

```powershell
Get-CommonADParameters @PSBoundParameters
```

--------------------------------

### Enable Optional AD Forest Features with ADOptionalFeature

Source: https://context7.com/dsccommunity/activedirectorydsc/llms.txt

ADOptionalFeature enables forest-wide optional features, such as the Active Directory Recycle Bin. Enabling the Recycle Bin is a prerequisite for using the RestoreFromRecycleBin functionality in other DSC resources.

```powershell
Configuration ADOptionalFeature_Examples
{
    param (
        [Parameter(Mandatory)] [PSCredential] $EnterpriseAdminCred
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc

    node 'localhost'
    {
        ADOptionalFeature 'RecycleBin'
        {
            FeatureName                       = 'Recycle Bin Feature'
            ForestFQDN                        = 'contoso.com'
            EnterpriseAdministratorCredential = $EnterpriseAdminCred
        }
    }
}
```

--------------------------------

### Add Domain Controller to Existing Domain (No Local DNS)

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainController

This configuration adds a domain controller to an existing domain without installing the local DNS server service. It requires the Active Directory DSC module and PSDesiredStateConfiguration module. Ensure the provided credentials have the necessary permissions.

```powershell
Configuration ADDomainController_AddDomainControllerUsingInstallDns_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        WindowsFeature 'InstallADDomainServicesFeature'
        {
            Ensure = 'Present'
            Name   = 'AD-Domain-Services'
        }

        WindowsFeature 'RSATADPowerShell'
        {
            Ensure    = 'Present'
            Name      = 'RSAT-AD-PowerShell'

            DependsOn = '[WindowsFeature]InstallADDomainServicesFeature'
        }

        WaitForADDomain 'WaitForestAvailability'
        {
            DomainName = 'contoso.com'
            Credential = $Credential

            DependsOn  = '[WindowsFeature]RSATADPowerShell'
        }

        ADDomainController 'DomainControllerUsingExistingDNSServer'
        {
            DomainName                    = 'contoso.com'
            Credential                    = $Credential
            SafeModeAdministratorPassword = $Credential
            InstallDns                    = $false

            DependsOn                     = '[WaitForADDomain]WaitForestAvailability'
        }
    }
}
```

--------------------------------

### Create Active Directory Organizational Unit

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADOrganizationalUnit

This configuration defines how to create an Active Directory Organizational Unit. Ensure the ActiveDirectoryDsc module is imported. Parameters like Name, Path, Description, and ProtectedFromAccidentalDeletion can be configured.

```powershell
Configuration ADOrganizationalUnit_CreateADOU_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $Name,

        [Parameter(Mandatory = $true)]
        [System.String]
        $Path,

        [Parameter()]
        [System.Boolean]
        $ProtectedFromAccidentalDeletion = $true,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Description = ''
    )

    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADOrganizationalUnit 'ExampleOU'
        {
            Name                            = $Name
            Path                            = $Path
            ProtectedFromAccidentalDeletion = $ProtectedFromAccidentalDeletion
            Description                     = $Description
            Ensure                          = 'Present'
        }
    }
}
```

--------------------------------

### Add Read-Only Domain Controller with Password Replication Control

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainController

Use this configuration to add a read-only domain controller to an existing domain. It allows specifying accounts whose passwords can be replicated and those that are denied replication. Ensure the necessary Windows Features are installed and the domain is available before applying.

```powershell
Configuration ADDomainController_AddReadOnlyDomainController_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential,

        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $SafeModePassword
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        WindowsFeature 'InstallADDomainServicesFeature' 
        {
            Ensure = 'Present'
            Name   = 'AD-Domain-Services'
        }

        WindowsFeature 'RSATADPowerShell'
        {
            Ensure    = 'Present'
            Name      = 'RSAT-AD-PowerShell'

            DependsOn = '[WindowsFeature]InstallADDomainServicesFeature'
        }

        WaitForADDomain 'WaitForestAvailability'
        {
            DomainName = 'contoso.com'
            Credential = $Credential

            DependsOn  = '[WindowsFeature]RSATADPowerShell'
        }

        ADDomainController 'Read-OnlyDomainController(RODC)'
        {
            DomainName                          = 'contoso.com'
            Credential                          = $Credential
            SafeModeAdministratorPassword       = $SafeModePassword
            ReadOnlyReplica                     = $true
            SiteName                            = 'Default-First-Site-Name'
            DelegatedAdministratorAccountName   = 'contoso\adm.pvdi'
            AllowPasswordReplicationAccountName = @('pvdi.test1', 'pvdi.test')
            DenyPasswordReplicationAccountName  = @('SVC_PVS', 'TA2SCVMM')

            DependsOn                           = '[WaitForADDomain]WaitForestAvailability'
        }
    }
}
```

--------------------------------

### Create Cluster Computer Account and Enforce Enabled State

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADComputer

This configuration creates a disabled computer account, configures a cluster using that account, and then enforces the computer account to be enabled. It requires importing both ActiveDirectoryDsc and xFailoverCluster modules.

```powershell
Configuration ADComputer_CreateClusterComputerAccount_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -ModuleName ActiveDirectoryDsc
    Import-DscResource -ModuleName xFailoverCluster -ModuleVersion '1.14.1'

    node localhost
    {
        ADComputer 'ClusterAccount'
        {
            ComputerName      = 'CLU_CNO01'
            EnabledOnCreation = $false
        }

        xCluster 'CreateCluster'
        {
            Name                          = 'CLU_CNO01'
            StaticIPAddress               = '192.168.100.20/24'
            DomainAdministratorCredential = $Credential

            DependsOn                     = '[ADComputer]ClusterAccount'
        }

        ADObjectEnabledState 'EnforceEnabledPropertyToEnabled'
        {
            Identity    = 'CLU_CNO01'
            ObjectClass = 'Computer'
            Enabled     = $true

            DependsOn   = '[xCluster]CreateCluster'
        }
    }
}
```

--------------------------------

### Create Group Managed Service Account with Members

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADManagedServiceAccount

Configures a Group Managed Service Account and adds members using both SAM account names and distinguished names. Ensure the ActiveDirectoryDsc module is imported.

```powershell
Configuration ADManagedServiceAccount_CreateGroupManagedServiceAccountWithMembers_Config
{
    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADManagedServiceAccount 'AddingMembersUsingSamAccountName'
        {
            Ensure                    = 'Present'
            ServiceAccountName        = 'Service01'
            AccountType               = 'Group'
            ManagedPasswordPrincipals = 'User01', 'Computer01$'
        }

        ADManagedServiceAccount 'AddingMembersUsingDN'
        {
            Ensure                    = 'Present'
            ServiceAccountName        = 'Service02'
            AccountType               = 'Group'
            ManagedPasswordPrincipals = 'CN=User01,OU=Users,DC=contoso,DC=com', 'CN=Computer01,OU=Computers,DC=contoso,DC=com'
        }
    }
}
```

--------------------------------

### Configure ADDomainControllerProperties Content Freshness

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADDomainControllerProperties

This configuration sets the content freshness threshold for a domain controller to 100 days. Ensure the ActiveDirectoryDsc module is imported.

```powershell
Configuration ADDomainControllerProperties_SetContentFreshness_Config
{
    Import-DscResource -ModuleName ActiveDirectoryDsc

    node localhost
    {
        ADDomainControllerProperties 'ContentFreshness'
        {
            IsSingleInstance = 'Yes'
            ContentFreshness = 100
        }
    }
}
```

--------------------------------

### Enable AD Recycle Bin Feature Configuration

Source: https://github.com/dsccommunity/activedirectorydsc/wiki/ADOptionalFeature

This configuration enables the Active Directory Recycle Bin feature for a specified domain. It requires the forest FQDN and enterprise administrator credentials.

```powershell
Configuration ADOptionalFeature_EnableADRecycleBin_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $ForestFQDN,

        [Parameter(Mandatory = $true)]
        [System.Management.Automation.PSCredential]
        $EnterpriseAdministratorCredential
    )

    Import-DscResource -Module ActiveDirectoryDsc

    Node localhost
    {
        ADOptionalFeature RecycleBin
        {
            FeatureName                       = "Recycle Bin Feature"
            EnterpriseAdministratorCredential = $EnterpriseAdministratorCredential
            ForestFQDN                        = $ForestFQDN
        }
    }
}
```