Active Directory Meets Source Control with Fred Weinmann

Andrew sits down with Fred Weinmann, one of the most prolific PowerShell module authors in the community, for part one of a multi-episode series covering his projects. This episode focuses on the Active Directory Management Framework, or ADMF, a configuration-driven system Fred originally built while working as a field engineer at Microsoft for a large enterprise customer managing hundreds of Active Directory forests.

Fred walks through the problem ADMF was designed to solve: Active Directory is notoriously hard to manage consistently across environments, and most organizations just accept the chaos as the cost of doing business. The old approach at this particular customer involved zipping up scripts, RDPing into domain controllers, and running them manually. ADMF changed that by borrowing the test/apply concept from Desired State Configuration, but making it flexible enough to handle the messiness of real-world AD environments.

The conversation covers how ADMF is structured around components (like organizational units) and contexts, why generating a reference configuration from an existing environment is harder than it sounds, the protocol juggling required to handle Group Policy and schema updates, and why Fred would use raw LDAP instead of the built-in AD commands if he were starting from scratch today. Fred also touches on the credential provider plugin system, which lets teams plug in their own password management workflows for things like break-glass accounts.

Key Takeaways:

• ADMF follows a test-before-apply model borrowed from DSC, but trades DSC's all-or-nothing enforcement for a more selective, component-by-component approach that better fits the fluid reality of Active Directory management.
• Generating a configuration from an existing AD environment is tempting but potentially counterproductive. If you auto-generate your desired state from a domain that's accumulated years of cruft, you're not capturing what you want, you're just freezing what already exists.
• Performance at scale is a real consideration. The built-in Active Directory PowerShell module uses the AD Web Services protocol, which sends XML over the wire. Raw LDAP is significantly faster, and Fred says switching to it is the one architectural change he'd make if building ADMF over again.

Guest Bio:
Friedrich "Fred" Weinmann is a Cloud Solution Architect at Microsoft and one of the most recognized PowerShell community contributors working today. He is the creator of PSFramework, which underpins many other modules in the ecosystem, as well as tools like PSModuleDevelopment, PSUtil, and the Active Directory Management Framework. Fred is a frequent conference speaker, a longtime community collaborator, and someone Andrew credits with helping shape his own PowerShell journey.

Resource Links:

ADMF documentation and getting started guide: admf.one

ADMF on GitHub: github.com/ActiveDirectoryManagementFramework/ADMF

ADMF on PowerShell Gallery: powershellgallery.com/packages/ADMF

PSFramework (Fred's logging, configuration, and scripting infrastructure module): psframework.org

Fred Weinmann on GitHub: github.com/FriedrichWeinmann

Fred Weinmann on X: x.com/FredWeinmann

PDQ Community Discord: discord.gg/pdq

 

The PowerShell Podcast on YouTube: https://youtu.be/8SlIqUKP3hY