Monday, May 30, 2016

Use Splatting, Proxy, and Metadata in Powershell

Use Splatting, Proxy, and Metadata in Powershell

  • Splatting is the ability to use a dictionary or a list to supply parameters to a command.

    Example:
    $MailMessage = @{
        To = “me@mycompany.com
        From = “me@mycompany.com
        Subject = “Hi”
        Body = “Hello”
        Smtpserver = “smtphost”
        ErrorAction = “SilentlyContinue”
    }
    Send-MailMessage @MailMessage
  • Proxy commands are wrappers of existing commands in Windows PowerShell, and to make this possible, a number of different things had to be enabled in the language that can have interesting other uses.
  • Metadata provides information about the command and parameters of different commands, and provides a structure that you can use to “write” a command without typing out the whole script.

https://blogs.technet.microsoft.com/heyscriptingguy/2010/10/18/use-splatting-to-simplify-your-powershell-scripts/

Tuesday, April 19, 2016

Running Windows Explorer with different "RUNAS" credentials



As part of securing access to Active Directory, and following the Least Privileges Principle, it has been a goal of mine to be able to run all Administrative Tasks on a Management workstation while only logging in to the workstation using a generic, minimum Privileges user account.


While most management consoles can be launched in a "RUNAS" mode, it has been an Achilles Heel that it has always been thought that you could not run Windows Explorer in a RUNAS.   This prevents you from doing File System Permission management.


Well, my genius friend (who is an absolute wizard at Google Searches) has found an answer.


Follow the step below to do it. 
  1. Start the Registry Editor as an Administrative User.
  2. Navigate to, take ownership of, and grant yourself Full Control permission to the key HKEY_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}
    (This is "Elevated-Unelevated Explorer Factory")
  3. Rename the value RunAs to _RunAs.
  4. Close Regedit.
  5. runas /user:domain\username "c:\windows\explorer.exe /separate"
     
OR another description:

  1. Start -> Run -> regedit
  2. Navigate to the registry key: HKEY_CLASSES_ROOT\AppID{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}
  3. Right click on the registry key and click Permissions…
  4. Give Full Control permissions to the user logged in.
  5. Start -> Run -> dcomcnfg.exe -> Expand DCOM Config
  6. Right click and select properties of “Elevated-Unelevated Explorer Factory”, click the Identity tab and select “The launching user”

Friday, April 15, 2016

Active Directory Last Logon. Lots of confusion

I am sure that everyone who administrates AD runs into this problem at some point.

Here is an article that thoroughly lays it all out.

http://social.technet.microsoft.com/wiki/contents/articles/22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate.aspx

The summary of this article is, that if you want to find out the TRUE last logon activity for a user, it is best to use the command

Search-ADAccount -AccountInactive -DateTime ((get-date).adddays(-90)) -UsersOnly

If you are ONLY interested in dates that are more than 14 days ago, then you can safely use the "LASTLOGONDATE" attribute.  

Less than 14 days of viewing and you cannot rust this attribute.  You must get fancy and query all of the DC's individually. 

Sunday, February 21, 2016

6 Tips for troublsheooting Active Directory (Link)

I found this article quite helpful.  It contains some excellent detailed information.

https://redmondmag.com/articles/2009/07/01/6-tips-for-troubleshooting-active-directory.aspx

Especially detailed is the AD Diagnostics Registry settings:




Tuesday, December 29, 2015

Fix Trust Relationship if a simple Computer password reset is required

Fix Trust Relationship if a simple Computer password reset is required

http://blog.blksthl.com/2013/03/18/fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/

This is dead simple, but if you were not aware, you do not necessarily need to rejoin the domain if the trust relationship is broken with AD.  Just resetting the password is all .

Steps using Powershell:
  1. Login locally to the server
  2. Run the PowerShell command:
Reset-ComputerMachinePassword -Server -Credential

Restart-Computer


Thursday, December 24, 2015

Migrating Public Folders Exchang 2007 to 2013

There are lots of great blogs out there on how to do the overall migration of Public folders from previous versions of Exchange to 2013, but few of them detailed how to deal with a few choice issues that I encountered in a recent migration that I performed.


For a good, detailed, checklist of how to do the migration, see any of the following:






My migration was for 50,000 folders, and about 130GB of data.


The issues that I ran into were (but not limited to):

  •     Needing a System Attendant mailbox on each server hosting Public Folders
  •     Spaces at the end of the names of folders
  •     Invalid characters in the Alias attribute, and
  •     Invalid SMTP email addresses in Mail-Enabled Public Folders

Each of these had to be fixed before I could start the migration.


System Attendant Mailbox required

This is actually fairly well documented, but I had missed it and the symptoms in no way pointed me to the root cause of the problem.

Basically, each server that hosts a Public Folder requires this System Attendant mailbox.  In my case I had no Mailbox Databases on the PF servers.

The symptom is that in the detailed log of the PublicFolderMigrationRequest indicated "

Transient Error: MapiExceptionUnknownUser: Unable to make connection to the server. (hr=0x80004005, ec=1003)


This was resolved by creating a mailbox database on each server, and then also restarting the "Microsoft Exchange System Attendant" service.  That created the system attendant ID automatically.


Spaces at the end of a folder name


The first problem was identified when I ran the command


Get-PublicFolder -Recurse | Export-CSV C:\PFs\2010_PFStructure.csv -NoTypeInformation

  This was easy to fix following this article:


The issue with this simple script is that the script in this article runs against all folders.


Get-PublicFolder -Identity "\" -Recurse -ResultSize Unlimited | Foreach { Set-PublicFolder -Identity $_.Identity -Name $_.Name.Trim() }


To improve this, I modified the command to skip folders that did not need to be updated.  Speeds up the command significantly. I also added a log file entry for each folder being processed.

$Logfile = "Fix-Trimmed-Names-001.log"
Get-PublicFolder -Identity "\" -recurse -ResultSize Unlimited | %{
  write-host "Scanning $($_.identity)";
  add-content $logfile -value "Scanning $($_.identity)";
  if ($_.name -ne $_.name.trim() ) {
    write-host "fixing [$($_.name)]" -foregroundcolor yellow;
    add-content $logfile -value "fixing [$($_.name)]"
    Set-PublicFolder -Identity $_.Identity -name $_.name.trim()
  }
}


 Invalid characters in the Alias attribute

 The Alias property of a Public Folder cannot contain Spaces, Periods, Commas, @, and even an Apostrophe.   The following script removed these characters.  (Note that the script is a little rough, but you can figure it out).


[PS] >type .\Fix-Alias-001.ps1
$Names = get-mailpublicfolder -resultsize unlimited |?{$_.Alias -like "* *"}
#$Names = get-mailpublicfolder -resultsize unlimited |?{$_.Alias -like "*.*"}

foreach ($name in $Names) {
  $newAlias = $name.alias
  $newAlias = $newAlias.replace(" ","_")
  $newAlias = $newAlias.replace("@","&")
  $newAlias = $newAlias.replace("(","{")
  $newAlias = $newAlias.replace(")","}")
  $newAlias = $newAlias.replace(",","~")
  $newAlias = $newAlias.replace(".","~")
  $newAlias = $newAlias.replace("'","~")
  set-mailpublicfolder -identity $name.identity -alias "$newalias"
}


Invalid SMTP email addresses in Mail-Enabled Public Folders

 This seems to have occurred for reasons similar to the Alias issue.  I was told that the users did not intentionally create Public Folders as Email-Enabled, therefore, rather than dig into fixing each of the mailboxes to change teh SMTP name, we elected to simply run a "Disable-MailPublicFolder" against each of the mail-enabled public folders.   End of issue.

Tuesday, October 20, 2015

Disabling the Windows Server 2012 Lock Screen Timeout

Found this great article.

http://blog.scosby.com/post/2012/12/13/Disabling-Windows-Server-2012-Lock-Screen-Timeout.aspx

Disabling the Windows Server 2012 Lock Screen Timeout

In Server 2012 by default, the lock screen will put the monitors to sleep after 1 minute. I found myself waking the monitors too frequently. An initial web search led me to a MSDN forum post for Windows 8 that unlocked a missing Power Settings feature in Server 2012.   1.       Open the following registry key     a.       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7   2.       Set the following value     a.       Attributes => 2
  3.       Now open Control Panel>Power Options>Change Plan Settings>Change Advanced Power Settings     a.       The new Display section “Console lock display off timeout” is now available.     b.      Configure your “Plugged in” value accordingly (0 to disable) – I haven’t tested to see if the monitor sleep setting still applies when the screen is locked.



Also, to set the timeout in a GPO:

Configuring a Power Plan with Group Policy Preferences (by Alan Burchill)

FellTheForce@8