Detailed information on updating Directory Services Restore Mode (DSRM) passwords for Windows Server 2008 (R2) Domain Controllers leveraging NTDSUtil synchronize password is posted on the Directory Services Team Blog.

I put together a Powershell script that performs the following:

1. Discovers all the Windows 2008 & 2008 R2 Domain Controllers in the domain and creates a special DSRM account in AD with a random complex password for each of them (assuming one doesn’t already exist).
2.  Checks the date of the last password update for each account. Each account that is past the defined threshold is added to an update DC list.
3. Update the password on each od the DCs in the update DC list.
4. Use Powershell remoting to synchronize each of the DCs on the update DC list with the associated DC DSRM account in AD.

Note that this script creates one AD account per Domain Controller. This provides a simple solution for dealing with RODCs in the environment. Some may consider this overkill, but it also provides a simple method for tracking per DC DSRM password updates. Powershell Remoting must be enabled on all 2008 DCs for this to work.

The script uses Powershell remoting to run the ntdsutil command to synchronize the local DC DSRM password with the associated DC DSRM account the script created in Active Directory:
ntdsutil “set dsrm password” “sync from domain account <DCDSRMAccount>” q q

While I don’t often include a complete script solution, this seems to fit the bill.

Download the Powershell script: Update-DSRMp.txt

<# 
.SYNOPSIS
 NAME: Update-DSRMp.ps1
 This script creates & updates Active Directory with user accounts with which DCs running Windows 2008 
 synchronize their DSRM passwords.

.DESCRIPTION
 This script creates & updates Active Directory with user accounts with which DCs running Windows 2008 
 synchronize their DSRM passwords.

 This process is performed in the following stages:

 1. Enumerate all DCs in the AD forest. Identify Widnows 2008 DCs.
 2. Ensure there are special AD DSRM accounts for every DC (<DCName>DSRM). If a DC does not have a respective account, create it.
 3. Loop through all AD DSRM accounts and generate a random, complex, unique, 30-character password (default) and if the 
 account has not had the password updated in 90 days (default), update the AD DSRM account password.
 4. After checking the AD DSRM accounts exist and have recent passwords, connect to each DC and have the DC synchronize
 its (local) DSRM password with the respective AD DSRM account password.
 5. Log the DSRM password list to a secure location retaining history of older DSRM password lists. 

 NOTE: This script MUST be run on a Domain Controller.

.PARAMETER MaxPasswordAge
 This parameter sets when the DSRM password must be changed.
 DEFAULT: 60 (days)
 Example: Update-DSRMp.ps1 -MaxPasswordAge 90 

.PARAMETER PasswordLength
 This parameter configures how long the DSRM password should be.
 DEFAULT: 30 (characters)
 Example: Update-DSRMp.ps1 -PasswordLength 20 

.PARAMETER ForceUpdate
 By default the script will only perform a password change on the DSRM account if the 
 account password hasn't been updated within a predetermined threshold. 
 Using ForceUpdate forces an update on all account passwords.
 Example: Update-DSRMp.ps1 -ForceUpdate 

.PARAMETER Verbose
 Use this parameter to have the script provide additional detail regarding processing.
 Example: Update-DSRMp.ps1 -Verbose 

.PARAMETER Debug
 Use this parameter to have the script provide additional debug detail regarding processing.
 Example: Update-DSRMp.ps1 -Debug 

.EXAMPLE
 Update-DSRMp.ps1 -example 

.NOTES
 NAME: Update-DSRMp.ps1
 AUTHOR: Sean Metcalf 
 AUTHOR EMAIL: Sean Metcalf @t Metcorp Consulting [dot} com
 CREATION DATE: 10/04/2010
 LAST MODIFIED DATE: 10/26/2011
 LAST MODIFIED BY: Sean Metcalf
 INTERNAL VERSION: 01.11.10.26.19
 RELEASE VERSION: 2.0.1

#>
# This Powershell script leverages some features only available with Powershell version 2.0.
# As such, there is no guarantee it will work with earlier versions of Powershell.
# Requires -Version 2.0

#####################
# Script Parameters #
##################### 

Param 
 (
 [int]$PasswordLength = 30,
 [int]$MaxPasswordAge = 60,
 [switch]$ForceUpdate,
 [switch]$Verbose,
 [switch]$Debug
 )

############################
# Configure Script Options #
############################
Write-Output "" `r
Write-Output "Reading configured script options..." `r
Write-Output "" `r

Switch ($Verbose) 
 { ## OPEN Switch Verbose
 $True { $VerbosePreference = "Continue" ; Write-Output "Script logging is set to verbose." `r }
 $False { $VerbosePreference = "SilentlyContinue" ; Write-Output "Script logging is set to normal logging." `r }
 } ## OPEN Switch Verbose 

Switch ($Debug) 
 { ## OPEN Switch Debug
 $True { $DebugPreference = "Continue" ; Write-Output "Script Debug logging is enabled." `r }
 $False { $DebugPreference = "SilentlyContinue" ; Write-Output "" `r }
 } ## OPEN Switch Debug 

Write-Verbose "Setting default options for script parameters... `r "
Write-Verbose "Setting Password Length to $PasswordLength characters `r "
Write-Verbose "Setting Max Password Age to $MaxPasswordAge days `r "

$DCDSRMPasswordLength = $PasswordLength 
$DateTime = Get-Date #Get date/time
$DCDSRMPassResetThreshold = $DateTime.AddDays(-$MaxPasswordAge) 

Write-Verbose "Check script parameters and based on setting configure proper script options & inform user... `r"

Switch ($ForceUpdate)
 { ## OPEN Switch ComputerType
 $True {Write-Output "Force Update is set to True. DC AD DSRM account passwords will be reset and their local DSRM accounts will be synchronized." `r} 
 $False {Write-Output "Force Update is set to False. Processing will occur normally." `r }
 } ## CLOSE Switch ComputerType

Write-Output "" `r 

###############################
# Set Environmental Variables #
###############################
# COMMON
write-output "Setting environmental variables..." `r
$CurrentComputerName = $env:ComputerName
$Computer = $env:ComputerName
$CurrentUserName = $env:UserName
$CurrentOS = $Env:os
$DomainDNS = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name #Get AD Domain (lightweight & fast method)
$ADDomain = $DomainDNS 
[Reflection.Assembly]::LoadWithPartialName(“System.Web”)
$TimeVal = get-date -uformat "%Y-%m-%d-%H-%M" 
$LogDir = "C:\temp\Logs\" #Standard location for script logs
$DateTime = Get-Date #Get date/time
$Separator = "#" #Create separation line
$Sepline = $Separator * 75 #Create separation line
[ref]$a = $null # Used for IP Address Validation
IF (!(Test-Path $LogDir)) {new-item -type Directory -path $LogDir} 

# Commonly Used
$HostName = "$Computer.$DomainDNS"

# Script Specific
[int] $2008R2DCCount = 0
[int] $2008DCCount = 0
[int] $2003R2DcCount = 0
[int] $2003DcCount = 0
[int] $2000DcCount = 0
[int] $DomainRODCsCount = 0

# Script Logging
$LogFileName = "UpdateDSRMp-$TimeVal.log"
$ReportName = "DSRMPasswords-$TimeVal.txt" 
$ReportNameCSV = "DSRMPasswordsp-$TimeVal.csv" 
$LogFile = $LogDir + $LogFileName
$ReportFile = $LogDir + $ReportName
$ReportFileCSV = $LogDir + $ReportNameCSV

#Set OU Path Variables
$DSRMOULevel1 = "Accounts"
$DSRMOULevel2 = "Service"
$DSRMOUName = "DCDSRM"
$DSRMOURoot = "OU=$DSRMOULevel2,OU=$DSRMOULevel1"
$DSRMBaseOU = "OU=$DSRMOUName," + $DSRMOURoot

$DSRMAccountOU = $DSRMBaseOU 
$DSRMAccountLDAP = "LDAP://$DSRMAccountOU"
$DSRMAccountADSI = [adsi]"$DSRMAccountLDAP,$ADDomainDistinguishedName"
$DSRMAccountLDAPPath = $DSRMAccountADSI.Path
$DSRMAccountPath1 = "'" + $DSRMAccountPath + "'"

################################################
# Import Active Directory Powershell Elements #
################################################
write-output "Configuring Powershell environment..." `r
Write-Verbose "Importing Active Directory Powershell module `r"
import-module ActiveDirectory

##################
# Start Logging #
##################
# Log all configuration changes shown on the screen during run-time in a transcript file. This
# inforamtion can be used for troubleshooting if necessary
Write-Verbose "Start Logging `r"
write-output "" `r
Start-Transcript $LogFile -force
write-output "" `r

## Process Start Time
$ProcessStartTime = Get-Date
write-output "" `r
write-output "Script initialized by $CurrentUserName and started processing at $ProcessStartTime" `r
write-output "" `r

#############################################
# Get Active Directory Forest & Domain Info #
#############################################

# Get Forest Info
write-output "Gathering Active Directory Forest Information..."
Write-Verbose "Performing Get-ADForest powershell command `r"
$ADForest = Get-ADForest

$ADForestApplicationPartitions = $ADForest.ApplicationPartitions
$ADForestCrossForestReferences = $ADForest.CrossForestReferences
$ADForestDomainNamingMaster = $ADForest.DomainNamingMaster
$ADForestDomains = $ADForest.Domains
$ADForestForestMode = $ADForest.ForestMode
$ADForestGlobalCatalogs = $ADForest.GlobalCatalogs
$ADForestName = $ADForest.Name
$ADForestPartitionsContainer = $ADForest.PartitionsContainer
$ADForestRootDomain = $ADForest.RootDomain
$ADForestSchemaMaster = $ADForest.SchemaMaster
$ADForestSites = $ADForest.Sites
$ADForestSPNSuffixes = $ADForest.SPNSuffixes
$ADForestUPNSuffixes = $ADForest.UPNSuffixes

# Get Domain Info
write-output "Gathering Active Directory Domain Information..." `r
Write-Verbose "Performing Get-ADDomain powershell command `r"
$ADInfo = Get-ADDomain

$ADDomainAllowedDNSSuffixes = $ADInfo.ADDomainAllowedDNSSuffixes
$ADDomainChildDomains = $ADInfo.ChildDomains
$ADDomainUsersContainer = $ADInfo.UsersContainer
$ADDomainDeletedObjectsContainer = $ADInfo.DeletedObjectsContainer
$ADDomainDistinguishedName = $ADInfo.DistinguishedName
$ADDomainDNSRoot = $ADInfo.DNSRoot
$ADDomainDomainControllersContainer = $ADInfo.DomainControllersContainer
$ADDomainDomainMode = $ADInfo.DomainMode
$ADDomainDomainSID = $ADInfo.DomainSID
$ADDomainForeignSecurityPrincipalsContainer = $ADInfo.ForeignSecurityPrincipalsContainer
$ADDomainForest = $ADInfo.Forest
$ADDomainInfrastructureMaster = $ADInfo.InfrastructureMaster
$ADDomainLastLogonReplicationInterval = $ADInfo.LastLogonReplicationInterval
$ADDomainLinkedGroupPolicyObjects = $ADInfo.LinkedGroupPolicyObjects
$ADDomainLostAndFoundContainer = $ADInfo.LostAndFoundContainer
$ADDomainName = $ADInfo.Name
$ADDomainNetBIOSName = $ADInfo.NetBIOSName
$ADDomainObjectClass = $ADInfo.ObjectClass
$ADDomainObjectGUID = $ADInfo.ObjectGUID
$ADDomainParentDomain = $ADInfo.ParentDomain
$ADDomainPDCEmulator = $ADInfo.PDCEmulator
$ADDomainQuotasContainer = $ADInfo.QuotasContainer
$ADDomainReadOnlyReplicaDirectoryServers = $ADInfo.ReadOnlyReplicaDirectoryServers
$ADDomainReplicaDirectoryServers = $ADInfo.ReplicaDirectoryServers
$ADDomainRIDMaster = $ADInfo.RIDMaster
$ADDomainSubordinateReferences = $ADInfo.SubordinateReferences
$ADDomainSystemsContainer = $ADInfo.SystemsContainer
$ADDomainUsersContainer = $ADInfo.UsersContainer

# Display gathered Active Directory Forest & Domain Information 
Write-Verbose "Displaying data gathered from Get-ADForest and Get-ADDomain `r"

write-output "Displaying gathered Active Directory Information..." `r
write-output ""`r
write-output $SepLine `r
write-output "Active Directory Forest Name : $ADForestName" `r
IF (!$ADForestDomains) {write-output "Active Directory Forest Domains : [No Child Domains Found]" `r} 
ELSE {write-output "Active Directory Forest Domains : $ADForestDomains" `r}
write-output "Active Directory Forest Mode : $ADForestForestMode" `r
write-output "------------------------------------------------------" `r
write-output "Active Directory Domain Name : $ADDomainName" `r 
write-output "Active Directory Domain Mode : $ADDomainDomainMode" `r 
write-output "------------------------------------------------------" `r
write-output "FSMO: AD Domain Naming Master : $ADForestDomainNamingMaster" `r 
write-output "FSMO: AD Domain Schema Master : $ADForestSchemaMaster" `r 
write-output "FSMO: AD Domain PDC Master : $ADDomainPDCEmulator" `r 
write-output "FSMO: AD Domain RID Master : $ADDomainRIDMaster" `r 
write-output "FSMO: AD Domain Infrastructure Master : $ADDomainInfrastructureMaster" `r 
write-output $Sepline `r
write-output ""`r

$DomainDNS = $ADDomainDNSRoot

####################################
# Get Active Directory Information #
#################################### 

### DOMAIN DC DISCOVERY ###
# Discover Domain Controllers in AD
[array]$DomainControllers = $ADDomainReadOnlyReplicaDirectoryServers 
[array]$DomainControllers += $ADDomainReplicaDirectoryServers
$DomainControllers = $DomainControllers -Replace(".$DomainDNS","")

$DomainControllers = $DomainControllers | Get-Unique
$DomainControllers = $DomainControllers | Sort-Object

$DomainControllersCount = $DomainControllers.Count

Write-Output "Processing the following $DomainControllersCount Domain Controllers in $DOmainDNS ... `r " 

# Get DC Operating System Versions
Write-Verbose "Discovering all 2008 R2 DCs in the domain $DomainDNS ... `r "
[array] $2008R2Dcs = Get-ADDomainController -Filter { OperatingSystem -like "Windows Server 2008 R2*" }

ForEach ($DC in $2008R2Dcs)
 { ## OPEN ForEach DC in 2008Dcs
 [array] $Domain2008R2DCs += $DC.Name
 } ## CLOSE ForEach DC in 2008Dcs

$2008R2DCCount = $Domain2008R2DCs.Count
$Domain2008R2DCs = $Domain2008R2DCs | sort
Write-Verbose "Found $2008R2DCCount DCs in $DomainDNS." `r

Write-Verbose "Discovering all 2008 DCs in the domain $DomainDNS ... `r "
[array] $2008Dcs = Get-ADDomainController -Filter { (OperatingSystem -like "Windows Server 2008*") -and (OperatingSystem -notlike "Windows Server 2008 R2*") }

ForEach ($DC in $2008Dcs)
 { ## OPEN ForEach DC in 2008Dcs
 [array] $Domain2008DCs += $DC.Name
 } ## CLOSE ForEach DC in 2008Dcs

$2008DCCount = $Domain2008DCs.Count
$Domain2008DCs = $Domain2008DCs | sort
Write-Verbose "Found $2008DCCount 2008 DCs in $DomainDNS. `r "

Write-Verbose "Discovering all 2003 R2 DCs in the domain $DomainDNS ... `r "
[array] $2003R2DCsInSiteArray = Get-ADDomainController -Filter { (OperatingSystem -like "Windows Server 2003 R2*") }
ForEach ($DC in $2003R2DCsInSiteArray)
 { ## OPEN ForEach DC in 2003DCsInSiteArray
 [array] $Domain2003R2DCs += $DC.Name
 } ## CLOSE ForEach DC in 2003DCsInSiteArray

$2003R2DcCount = $Domain2003R2DCs.Count
$Domain2003R2DCs = $Domain2003R2DCs | sort
Write-Verbose "Found $2003DcCount 2003 DCs in $DomainDNS. `r "

Write-Verbose "Discovering all 2003 DCs in the domain $DomainDNS ... `r "
[array] $2003DCsInSiteArray = Get-ADDomainController -Filter { (OperatingSystem -like "Windows Server 2003*") -and (OperatingSystem -notlike "Windows Server 2003 R2*") }
ForEach ($DC in $2003DCsInSiteArray)
 { ## OPEN ForEach DC in 2003DCsInSiteArray
 [array] $Domain2003DCs += $DC.Name
 } ## CLOSE ForEach DC in 2003DCsInSiteArray

$2003DcCount = $Domain2003DCs.Count
$Domain2003DCs = $Domain2003DCs | sort
Write-Verbose "Found $2003DcCount 2003 DCs in $DomainDNS. `r "

Write-Verbose "Discovering all 2000 DCs in the domain $DomainDNS ... `r "
[array] $2000DCsInSiteArray = Get-ADDomainController -Filter { OperatingSystem -like "Windows 2000 Server*"}
ForEach ($DC in $2000DCsInSiteArray)
 { ## OPEN ForEach DC in 2000DCsInSiteArray
 [array] $Domain2000DCs += $DC.Name
 } ## CLOSE ForEach DC in 2000DCsInSiteArray

$2000DcCount = $Domain2000DCs.Count
$Domain2000DCs = $Domain2000DCs | sort
Write-Verbose "Found $2000DcCount 2000 DCs in $DomainDNS. `r "

write-output "Out of the $DomainControllersCount DCs in $DomainDNS: `r "
Write-Output "$DomainRODCsCount are RODCs & $DomainWritableDCsCount are writable DCs `r "
write-output "$2008R2DCCount are running Windows Server 2008 R2 `r "
write-output "$2008DCCount are running Windows Server 2008 `r "
write-output "$2003R2DcCount are running Windows Server 2003 R2 `r "
write-output "$2003DcCount are running Windows Server 2003 `r "
write-output "$2000DcCount are running Windows 2000 Server `r "

Write-Output "Building list of Windows 2008 DCs for updating `r "
$Domain2008DCsName = $Domain2008DCs + $Domain2008R2DCs 

# Set DSRM Account Path
$DSRMAccountPATH = $DSRMBaseOU +","+ $ADDomainDistinguishedName
Write-Verbose "DSRM Account path set to $DSRMAccountPATH `r "

######################
# Build Report Data #
######################

$ADReportData = 
@"

=========================================

ACTIVE DIRECTORY DSRM List
-------------------------------------
Report Generated on $DateTime by $CurrentUserName

Active Directory Forest: $ADForestName
Active Directory Domains: $ADForestDomains
Forest Functional Mode: $ADSchemaVersion

"@

################
# Check OU Path #
################
Write-Host "Checking to see if the target OU structure $DSRMAccountPATH exists..." `r
$ParentOUPath = $DSRMOURoot +","+ $ADDomainDistinguishedName
$DSRMBase1 = "OU=$DSRMOULevel1," + $ADDomainDistinguishedName

$DSRMOUCheck = test-path "AD:$DSRMAccountPATH"

IF ($DSRMOUCheck -eq $False)
 { ## OPEN IF DSRM OU doesn't exist
 Write-Host "OU structure $DSRMAccountPATH does not exist." `r
 Write-Host "Creating the OU structure for $DSRMAccountPATH ..." `r 
 New-ADOrganizationalUnit -Name $DSRMOULevel1 -Path $ADDomainDistinguishedName -ErrorAction SilentlyContinue
 New-ADOrganizationalUnit -Name $DSRMOULevel2 -Path $DSRMBase1 -ErrorAction SilentlyContinue
 New-ADOrganizationalUnit -Name $DSRMOUNAME -Path $ParentOUPath -ErrorAction SilentlyContinue
 } ## CLOSE IF DSRM OU doesn't exist
 ELSE
 { ## OPEN IF DSRM OU exists
 Write-Host "OU structure $DSRMAccountPATH does exist. Continuing..." `r
 } ## OPEN IF DSRM OU exists

$DSRMAccounts = Get-ADUser -Filter * -SearchBase $DSRMAccountPATH -Properties sAMAccountName,lastlogontimestamp -ErrorAction SilentlyContinue

#######################################
# Update AD DSRM Accounts & Passwords #
#######################################

$DSRMDescription = "This is a DC Service Account that is Disabled and is still being used. DO NOT DELETE. DO NOT MODIFY. POC: AD Team"
$DSRMUpdateRequired = $FALSE 
[array]$DCDSRMUpdateList = @()

write-host "Identifying Missing AD DSRM Accounts..." `r
ForEach ($DC in $Domain2008DCsName)
 { ## OPEN ForEACH - Read DC from $DomainControllers
 # Set the AD DSRM User Account naming template 
 $DSRMName = $DC + $DSRMOUName
 # IF there is not an AD DSRM account, create it
 TRY
 { ## OPEN TRY Check for Existing DSRM Account
 $DSRMAccountCheck = Get-ADUser $DSRMName -Properties PasswordLastSet -ErrorAction SilentlyContinue
 } ## CLOSE TRY Check for Existing DSRM Account

 CATCH
 { ## OPEN CATCH there is no Existing DSRM Account
 Write-Verbose "The account $DSRMName was not found in $DomainDNS `r "
 } ## CLOSE CATCH there is no Existing DSRM Account

 IF (!$DSRMAccountCheck)
 { ## OPEN IF - If there is not an existing account, create it 
 # Generate a random password $DCDSRMPasswordLength characters in length
 write-host "Generating $DCDSRMPasswordLength Character Random Password for AD DSRM Account..." `r
 $DSRMPass = [System.Web.Security.Membership]::GeneratePassword($DCDSRMPasswordLength,2)
 $DSRMPassword = ConvertTo-SecureString -AsPlainText $DSRMPass -Force
 # Create the AD DSRM User Accounts 
 write-host "There is no existing account for $DC ..." `r
 write-host "Creating new AD DSRM Account called $DSRMName for $DC ..." `r
 New-ADUser –name "$DSRMName" -SamAccountName "$DSRMName" -Path "$DSRMAccountPath" -DisplayName "$DSRMName" `
 -Description "$DSRMDescription" -Title "AD DC Service Account. DO NOT MODIFY." -Enabled $False -AccountPassword $DSRMPassword `
 -CannotChangePassword $True -PasswordNeverExpires $False
 ## -ChangePasswordAtLogon $False 
 $DSRMUpdateRequired = $TRUE
 write-host "Logging account information for $DC ..." `r
 $ADReportData += 
@"
 DC: $DC, Username: $DSRMName, Password: $DSRMPass

"@
 } ## CLOSE IF - If there is not an existing account, create it 
 ELSE 
 { ## OPEN ELSE IF the account already exists
 write-host "Account $DSRMName for $DC already exists. Checking Password Age to determine if update is required (ForceUpdate over-rides password age check)..." `r 
 # IF the account already exists & the password is older than $MaxPasswordAge days or ForceUpdate is Enabled, update the password 
 $DSRMPasswordLastSet = $DSRMAccountCheck.PasswordLastSet
 IF ( ($DSRMPasswordLastSet -le $DCDSRMPassResetThreshold) -or ($ForceUpdate -eq $True) ) 
 { ## OPEN IF - Only change the account password if it is older than $MaxPasswordAge days 
 # For accounts with passwords older than $MaxPasswordAge days, update the password
 # Generate a random password $DCDSRMPasswordLength characters in length
 write-host "Generating $DCDSRMPasswordLength Character Random Password for AD DSRM Account..." `r
 $DSRMPass = [System.Web.Security.Membership]::GeneratePassword($DCDSRMPasswordLength,2)
 $DSRMPassword = ConvertTo-SecureString -AsPlainText $DSRMPass -Force
 write-host "Password for account $DSRMName for $DC last changed on $DSRMPasswordLastSet which is older than $MaxPasswordAge days. Updating Password now..." `r
 Set-ADAccountPassword -Identity $DSRMName -Reset -NewPassword $DSRMPassword
 $DCDSRMUpdateList += $DC
 $DSRMUpdateRequired = $TRUE
 write-host "Logging account information for $DC ..." `r
 $ADReportData += 
@"
 DC: $DC, Username: $DSRMName, Password: $DSRMPass

"@
 } ## CLOSE IF - Only change the account password if it is older than 60 days 
 write-host "Password for account $DSRMName for $DC last changed on $DSRMPasswordLastSet which is less than $MaxPasswordAge days. Continuing..." `r 
 } ## CLOSE ELSE IF the account already exists

 } ## CLOSE ForEACH - Read DC from $DomainControllers

##################################################
# Connect to each DC to Update the DSRM Password #
##################################################
 write-host "Connecting to each DC to update DSRM passwords..." `r
 write-host ""

# This method only works if Powershell remoting is enabled...
#
# This component will connect to every DC in the $DCs list one by one and get #
# information from each DC. This is the block that does most of the work. #

 IF ($DSRMUpdateRequired -eq $TRUE) 
 { ## OPEN IF - Only have DCs pull DSRM password update if something has changed 
 write-host "Connecting to each DC to initiate synchronization of DSRM passwords..." `r
 write-host #SepLine

 IF ($ForceUpdate -Eq "True") { $DCDSRMUpdateList = $Domain2008DCsName }

 ForEach ($DC in $DCDSRMUpdateList) 
 { ## OPEN ForEach Loop every DC with a recent password update to update DSRMp

 TRY
 { $WinRMServiceCheck = Get-Service -name "WinRM" -ComputerName $DC }
 CATCH
 { Write-Output "WinRM service does not exist on $DC." `r}

 IF ($WinRMServiceCheck.Status -eq "Running")
 { ## OPEN IF - Check if WinRM service is running, if so, continue

 $ADDSRM = $ADDomainName +"\"+$DC + $DSRMOUName 
 $DCHostName = "$DC.$DomainDNS"

 #########################################
 # Update the DC's DSRM Password from AD #
 ######################################### 
 write-host "Connecting via Powershell to Remote Server: $DCHostName ..." `r
 $RemoteCommand = 'invoke-command -computer ' + $DC + ' -scriptblock { NTDSUTIL "SET DSRM PASSWORD" "SYNC FROM DOMAIN ACCOUNT ' + $ADDSRM + '" Q Q } ' 

 # Invoke-expression $RemoteCommand1 
 $NTDSResult = Invoke-expression $RemoteCommand
 write-host "Remote command sent..." `r
 write-host "" `r
 IF ($NTDSResult)
 { ## OPEN IF Command did run
 IF ($NTDSResult[2] -eq "Password has been synchronized successfully.")
 { ## OPEN IF - Command was successful
 Write-host "The DSRM Password for $DCHostName has been synchronized successfully." `r 
 } ## CLOSE IF - Command was successful
 ELSE { Write-host "An error occured and the DSRM Password has not been updated on $DCHostName." `r }
 } ## CLOSE IF Command did run
 write-host "" `r
 write-host "" `r 
 ###################################
 # Close Remote Powershell Session #
 ################################### 

 } ## CLOSE IF - Check if WinRM service is running, if so, continue
 ELSE 
 { ## OPEN ELSE - If WinRM service is not running
 Write-WARNING "$DC does not have the WinRM service enabled and running. Powershell Remoting is not possible. Run 'Enable-PSRemoting -Force' on the server." 
 } ## CLOSE ELSE - If WinRM service is not running 
 } ## CLOSE ForEach Loop every DC to update DSRMp
} ## CLOSE IF - Only have DCs pull DSRM password update if something has changed 

######################################
# Write the Data to the Report File #
######################################
write-host "Writing DSRM Report..." `r
$ADReportData | out-file $ReportFile

#################
# Stop Logging #
#################

#Stop logging the configuration changes in a transript file
Stop-Transcript

Write-output "Review the logfile $LogFile for script operation information." `r