Getting Your User Accounts Activity Under Control

Hi folks,

This is my first blog entry in 2015. Just wanted to share about my recent adventure.

All of you who manage messaging environment have test accounts that are being created and then abandoned and sitting in your AD forever. Or you may be want to avoid a situation when all of them are in use thus creating extra load on your messaging system, especially if there is too many of them.

This is where our good old friend PowerShell comes to play. In this scenario I used Get-ADUser command which is available in the Active Directory module which comes with Windows 2008 R2 and later.

The best way to identify user activity is to extract information about logons and password changes. I prefer to be using both as in some cases password for accounts (even test accounts, can you imagine this!) is set to never expire. So in addition to password set and changes related attributes I used LastLogon attribute.

Additionally it's worthy to mention scenario when you are in a forest with multiple domains (which is not the best practice according to Microsoft). You may connect to multiple servers or in my case I simply used global catalog to extract the information I needed. To user global catalog you will need to type server host name followed by the 3268 which corresponds to the port GC is listening for LDAP requests.

Please note the attribute msDS-UserPasswordExpiryTimeComputed which is used to calculate password expiration date.

And last, but not least don't forget to import AD module for PowerShell to be able to successfully execute the script.

My final code looks like this


Import-Module ActiveDirectory
Import-Csv D:\scripts\Users.txt | foreach {Get-ADUser -Identity $_.samAccountName –Properties * -Server GC01:3268} |
Select-Object "Displayname",SamAccountName,whenCreated,LastLogonDate,PasswordLastSet,PasswordExpired,PasswordNeverExpires,@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}} |Export-Csv D:\scripts\UserActivity.csv

And it produced a nice spreadsheet as below:

Please note user accounts with the blank value for LastLogon which indicates that user has never logged in to the AD domain. In addition to that some of the dates may be a long way in the past. Both may indicate that user accounts might not be in use and therefore a good candidates for deletion. But please make sure that you contact the account or service owners before doing so.

And, finally, my special thanks to the author of this great article which gave me a good hint on the way to go.

Enjoy.

Mailbox Permission Issues After Cross-Forest Migration

Hi folks,

I would love to share with you one old story that I had 3 years ago during the cross-forest Exchange migration (2007 to 2010).

After migration of mailboxes some of them cannot be disabled using Microsoft Exchange Shell or console. In order to resolve this problem Exchange Trusted Subsystem group had to be assigned Read All Properties and Write All Properties permissions on the domain container.

1. Launch ADSI Edit
2. Connect ADSI edit to the Default Naming Context
3. Right click the container that is corresponding to the domain DC=contoso,DC=com and go to the Security tab
4. Click on the Advanced button
5. On the Advanced Security Settings for contoso.com make sure you are on the Permissions tab and clock on the Add button
6. Select All Descendant objects in the Apply to section. In the list of permissions tick boxes next to Allow-Read all properties and Allow-Write all properties. Click OK
7. Wait for Active Directory replication to occur.

And it should do the magic.

Enjoy.

Removing Email Addresses With Obsolete SMTP Domain From Users Mailboxes

Hi folks,

Just wanted to share with you a quick way to remove obsolete SMTP addresses from mailboxes in your Exchange estate.

Imagine a situation when you decommissioning a certain SMTP domain from your organization. First you perform all of the activities to prevent your environment to receive email from this domain. These activities include changes in DNS (removing MX,SPF and PTR records) and also removing accepted domains from your Exchange and hygiene appliances. Additionally you may edit your email address policies to stop provisioning decommissioned SMTP domain to the new mailboxes.

However you are still left with the mailboxes that still contain this email address in their EmailAddresses  attribute. Of course you can attend each mailbox one-by-one and scrap these addresses out, however for bigger environments it won't work.

The below script will help you to remove obsolete email addresses from mailboxes of users located in the OU contoso.com/Staff which have email addresses with adatum.com suffix. The script will go through all the users which may have this domain and scrap it out. Please note that when running this script you may need to adjust the name of the SMTP domain you're removing as well as path to the OU where mailboxes are stored.


$Mailbox = Get-User -OrganizationalUnit contoso.com/Staff -RecipientTypeDetails UserMailbox    
    $Mailbox | foreach { 
    for ($i=$_.EmailAddresses.Count;$i -ge 0; $i--) 
    { 
    $_.EmailAddresses[$i].ProxyAddressString  
     
    if ($_.EmailAddresses[$i].ProxyAddressString  -like "smtp:adatum*" ) 
    { 
    $_.EmailAddresses.RemoveAt($i) 
    } 
     
    } 
    $_|set-mailbox 
    } 

Enjoy.

Quickly Create OU Structure in the new AD domain

Hi folks,

This is a script that will help you creating OU infrastructure in the brand new Active Directory environment (of course it can also be used in creating OUs in existing AD, provided that you use OU names that are not in use). In addition to this it will protect newly created OUs from accidental deletion which is similar to this:

Make sure that you replace DC=contoso,DC=com with the right LDAP path of your domain and feel free to replace names for OUs (next to OU=) with the names that are in your environment

Import-Module ActiveDirectory

$objDomain =[ADSI]"LDAP://DC=contoso,dc=com "
$objOU = $objDomain.Create("organizationalUnit","ou=Clusters")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Servers")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Groups")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Security Groups,ou=Groups")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Distribution Groups,ou=Groups")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Services")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Staff")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Admins")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Workstations")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=SQL Servers,ou=Servers")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Exchange Servers,ou=Servers")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=Lync Servers,ou=Servers")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=CRM Servers,ou=Servers")
$objOU.SetInfo()

$objOU = $objDomain.Create("organizationalUnit","ou=BES Servers,ou=Servers")
$objOU.SetInfo()

Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

Enjoy

PowerShell commands to manipulate mailbox folders

Hi folks,

This is a short post in support to those of you you are using PowerShell to manipulate mailbox folders in Exchange 2010/2013.

The main thing to remember is that Get-MailboxFolder command can be run by the mailbox owners as per this Technet article . If you are trying to run the same command as an administrator you are getting the following error:

No RBAC manipulations will help you to overcome this.

Therefore if you are interested in retrieving user mailbox folders you will need to use Get-MailboxFolderStatistics command. By default, it retrieves all the information in the list format, which doesn't always fit the screen. Of course this can be exported to TXT file for further reviews. Additionally you can use certain parameters.

As an example this command I used to retrieve information about folders and their structure within a mailbox:

Get-MailboxFolderStatistics "Farhad Mahmudov" |select Name,Identity

More details about this command can be found here .

Additionally there are commands that allow you to manage mailbox folders permissions like Set-MailboxFolderPermission, Remove-MailboxFolderPermission, Add-MailboxFolderPermission and Get-MailboxFolderPermission.

Enjoy.

Quick Retrieving of Windows Updates installed in Exchange Environment

Hi folks,

I would love to share with you a quick and easy way to retrieve Windows updates installed in your Exchange 2010/2013 estate.

Instead of logging on locally to each server all you need is to execute Get-WmiObject -Class "win32_quickfixengineering" command against each server.

In my case I have simply added to the pipe all the Exchange servers that are domain members (usually Edge Transport servers are not added to the domain and the command should be executed against them separately). So if you don't run Edge servers in your environment there's no need to

So my command to retrieve this information looks like this (please note that I used Sort command to arrange patches based on server name and date of the installation)

Get-ExchangeServer | Where-Object {$_.ServerRole -ne "Edge"} |foreach {Get-WmiObject -Class "win32_quickfixengineering" -ComputerName $_.Name} |sort Source,InstalledOn

Optionally you can export the information to CSV file (screenshots below) to get more comprehensive report or use Select-Object command to limit it to certain parameters you're interested in.

Enjoy

Deleting Items from Mailbox Dumpster

Hi folks,

Let me share with you about another task that you usually don't do on day to day basis.

As an intro I would love to share with you link to this article which explains what is Dumpster 2.0 is and how it is used in Exchange 2010 and 2013 environments. In couple words, after being deleted messages are being stored in dumpster for further restore and legal purposes.

Every now and then we need to delete items from dumpster to free up space used by them. Please note that this will create white space in the mailbox which can be reused for the new messages that arrive to the mailbox.

To check how much deleted messages are stored in mailbox you can run command like this:

Get-MailboxStatistics "Farhad Mahmudov" |select *size*

or even a nicer one like this

Get-MailboxStatistics "Farhad Mahmudov" |select DisplayName,TotalDeletedItemSize,TotalItemSize

In any case you will have information of how much data you have in mailbox altogether as well as deleted items size:

To remove data from dumpster you need to run the Search-Mailbox command with parameters as follows and confirm when prompted:

Search-Mailbox -Identity "Farhad Mahmudov" -SearchDumpsterOnly -DeleteContent

This may take some time depending on how much data you have in Recovered Items folder (dumpster) and give you output on how much data has been removed from the mailbox.

Optionally, you can double check this by running Get-MailboxStatistics command.

Enjoy.