Category: PowerShell

Office 365 Azure AD Connect Upgrade

Administrators who have been using the tried and true DirSync utility from Microsoft will be pleasantly surprised by the upgrade / replacement by the Windows Azure AD Connect utility for password sync with Active Directory or Hybrid configurations. Here are the basics on an upgrade for a site with only password sync enabled:

Office 365 Azure AD Connect Upgrade

The way to see if your organization is ready for the upgrade is to check under Admin > Users > Active Users > Active Directory Synchronization > Manage in the Office 365 portal.
Click on the Upgrade link which will redirect to the download site for the Microsoft Azure Active Directory Connect utility.
Download and run the utility as administrator which will bring up the following welcome screen which requires agreement to continue the conversion process.
The tool will then examine the current DirSync setup for your organization.
Once done it will present you with the option to continue with the upgrade.
Enter your organization's Office 365 global administrator credentials.
Enter local domain administrator credentials
Then there is the option to enable hybrid configuration or start a manual first sync. Choose the first sync and continue.
After much labor on the part of the tool it will finish successfully.
Finally a couple notes to make life easier. First is to add a shortcut to the Synchronization Service Manager on the desktop pointing to the following:

%systemdrive%\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe
Second is to create a powershell script to start a manual sync as follows:

Set-ExecutionPolicy RemoteSigned
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

This will then begin to use the Azure AD Connect utility to run the password sync to Office 365 from local Active Directory domain. If you company needs any help with Office 365, Exchange or Active Directory then don't hesitate to contact us for assistance.

Easily Transfer FSMO Roles Between DCs

To understand the need to transfer FSMO roles it is necessary to understand FSMO. As per Wikipedia – “Flexible Single Master Operations (FSMO) is a specialized domain controller (DC) set of tasks, used where standard data transfer and update methods are inadequate. Active Directory (AD) normally relies on multiple peer Domain Controllers, each with a copy of the AD database, being synchronized by multi-master replication. The tasks which are not suited to multi-master replication, and are viable only with a single-master database, are the FSMOs.”

When adding a new DC to a domain it often becomes the primary DC which means that a transfer FSMO roles will need to migrate. There are several ways to get this done, but this is by far the easiest I have found. Run the following PowerShell script from the new DC:

Move-ADDirectoryServerOperationMasterRole -Identity “[New DC Computer Name]” –OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster

That command came from and special thanks go out to The Lazy Admin Blog.

Command Line Configuring TCP/IP Addressing

Recently had an issue where a client needed to have their IP address statically assigned and the thought came to mind that my Remote Monitoring software was able to give me command line access, so I thought I would try configuring TCP/IP addressing via the command line interface and not have to interrupt the end users work. Here is how to get it done:

netsh interface ip set address name="Local Area Connection" static [static IP] [subnet mask] [default gateway] 1

That gets the IP address, subnet mask and default gateway – so what about static DNS? Here is the next step:

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #1]

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #2] index=2

If your company need remote assistance or help planning / maintaining / configuring TCP/IP addressing in your network infrastructure, then contact us for assistance.

Share Users Office 365 Calendar

The old way to accomplish Exchange calendar sharing between users was to either connect to each individual users workstation to right click and share the calendar to users in the Global Access List (GAL) or to install their profile on your system and do the same. There have been some wonderful advances since the advent of Powershell that allow Office 365 calendar sharing permissions to be set remotely as follows:

How to share Office 365 Calendar via Powershell

1. Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly

2. Open Windows Azure Active Directory Module for Windows PowerShell as administrator

3. Type in the following to run signed scripts for Exchange Online:

Set-ExecutionPolicy RemoteSigned

4. Type in the following to enter the administrative credentials for Office 365:

$creds = Get-Credential

5. Enter the Office 365 Administrator credentials then click "OK" button. 6. Type in the following to connect to Office 365 via PowerShell:

Import-Module MsOnline

Connect-MsolService -Credential $creds

7. Type in the following to connect to Exchange Online via Powershell:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

Import-PSSession $Session

8. Type in the following command to change the calendar permissions:

Add-MailboxFolderPermission -Identity sharinguser@domain.com:\calendar -User recipient@domain.com -AccessRights Editor

Once this command has been executed for each individual recipient that will access the sharing users calendar, then you can have them right click to add the shared calendar in their Outlook. For a list of possible Access Rights see this great page by the University of Wisconsin. If your company is using Office 365 Calendar and needs help sharing them, then contact us for assistance.

Scheduled Windows Server Restart

There have been innumerable times that I have had to schedule a Windows Server restart for after hours so that I don’t have to log back in after hours to do this manually. So here is a quick command to schedule a reboot at 11:59 PM (copy & paste for greater degree of simplicity):

schtasks /CREATE /SC once /TN “Windows Server Restart” /TR “shutdown /r /t 0 /f” /ST 23:59 /RL highest

This should be done within an administrative command prompt. Leave the server logged in for it to complete successfully (this is highly recommended not to do) or change the one setting in the Task Scheduler to run the Windows Server Restart task as a particular user.

Network Ransomware Infection Best Practices

After several clients have faced this issue, it time to write out some best practices for how to immediately deal with an infection from one of the Cryptolocker / Cryptowall network ransomware infection variants. These usually infect a single workstation on the network, encrypt all local files, encrypt all network file shares and leave an instruction file on how to pay for the decrypt key in every folder. A good backup of the network file servers is key for this network ransomware infection not to do devastating damage to a company.

Steps for cleaning up after the network ransomware infection:

1. Login to file server and find one of the instruction files (usually HELP_DECRYPT.txt or decrypt_instruction.html) on the affected network share.
2. Right click on the file, chose Properties and click on the Details tab. The Owner listed is most likely the username for the person using the only infected computer on the network.
3. Isolate this machine from the network, deep virus clean or wipe / reload the operating system to get rid of the infection.
4. It is also good to run basic virus scanning on all workstation and servers on the network to determine if further infection has happened. Clean as needed.
5. It is good to know all the infected files on the file server, so here is a Powershell script to do so (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | select fullname >> C:\TEMP\InfectedFiles.txt

6. Send a copy of an encrypted file and of one of the instruction files to your Antivirus vendor because obviously they missed something.
7. Next comes the cleaning of the instruction files, so more Powershell to automate this (change the instruction file as needed):

get-childitem [local path of file share] -include HELP_DECRYPT.* -recurse | foreach ($) {remove-item $.fullname}

8. Use backup software to restore affected file shares to an alternate location.
9. Copy / replace files into their original location from the alternate location.
10. Test to make sure that users are able to get back into their files.

If your company has been infected with a network ransomware infection or would like to be proactive about protecting your important company files from disaster, then contact us for assistance.

Exchange User Calendar Adding Permissions

Had a request to allow all users access to the new hires Exchange user calendar and some researched determined that this was not a job for the Exchange Managememt Console GUI. Instead it required a bit of PowerShell scripting to get the job done. It is best to run Get-MailboxDatabase before editing the script to retrieve the [Database Name] and [Username]. Here is the final product for accomplishing this task:

Add Exchange User Calendar Permissions via Powershell

$mailboxes = Get-Mailbox -Database “[Database Name]”
$AccessRights = “Reviewer”
$newusername = “[Username]”

foreach ($mailbox in $mailboxes) {

$calendar = (($mailbox.SamAccountName)+ “:\” + (Get-MailboxFolderStatistics -Identity $mailbox.SamAccountName -FolderScope Calendar | Select-Object -First 1).Name)

Write-Host “Updating calendar permission for $mailbox…” -ForegroundColor Yellow

add-MailboxFolderPermission -User $newusername -AccessRights $AccessRights -Identity $calendar

}

If your company is using on-premise Microsoft Exchange User Calendar or needs any help migrating to Office 365, then contact us for assistance.

Mistakes Importing Active Directory User List

Had a lower level technician try to import a large Active Directory user list of incoming freshman into a high school’s Active Directory via Powershell and mistakes were made. Basically there was no UserPrincipalName created which made logon to workstations difficult. Here is the PowerShell script used to fix the issue:

Powershell Script to Import Active Directory User List

Import-Module ActiveDirectory
$ADUsers = Get-ADUser -Filter * -SearchBase ‘OU=Employees,DC=Domain,DC=local’
foreach ($ADUser in $ADUsers) {
$GivenName = $ADUser.GivenName
$SurName = $ADUser.Surname

if (($GivenName -ne $null) -or ($SurName -ne $null))
{
$newSAM = $GivenName.Substring(0,1).ToLower() + $SurName.ToLower()
$newUPN = $newSAM + “@domain.local”

Set-ADUser $ADUser -SamAccountName $newSAM -UserPrincipalName $newUPN

Write-Host “Changes to the user $($GivenName) $($SurName) were made!”
}
}

For ideas on how to correctly import a large number users into Active Directory, look at how to format the spreadsheet and then how to write the PowerShell script at these links.
If your company is using Active Directory User List for import or need help managing / maintaining your active directory domain, then contact us for assistance.

Office 365 / Active Directory User Changes Name

There is often the case that a female user will have a name change due to change in marital status. Here is the basics of how to change their name in both Active Directory and Office 365.

Active Directory User Changes Name objects

Open Active Directory Users and Computers
Find the user needing the changed name, right click on them and choose the “Rename” option.
Change the user’s name as needed then press Enter then in the window that opens make all the further changes needed and click the “OK” button.
Click on the View menu at the top and check the “Advanced Features” option.
Double click on the users new name to open their Properties. Change the email address if needed in the General tab.
Choose the “Attribute Editor” tab, scroll down the list to “proxyAddress” attribute and double click it. Click on the current SMTP:old.email@company.com and click the “Remove” button then change it to a smtp:old.email@company.com then click the “Add” button.
Type in SMTP:new.email@company.com for the user and then click the “Add” button. Click the “OK” button on this window and the one beneath it.
Make sure to also rename the users Redirected Folder if there is one created via Group Policy
Run a manual sync of the DirSync tool via the Microsoft Forefront Identity Manager console.

Changes to Office 365

Make sure the Windows Azure Active Directory Module for Windows PowerShell is installed properly
Open Windows Azure Active Directory Module for Windows PowerShell as administrator
Type in the following to run signed scripts for Exchange Online:

Set-ExecutionPolicy RemoteSigned
Type in the following to enter the administrative credentials for Office 365:

$creds = Get-Credential
Enter the Office 365 Administrator credentials then click “OK” button.
Type in the following to connect to Office 365 via PowerShell:

Import-Module MsOnline

Connect-MsolService -Credential $creds
Type in the following to connect to Exchange Online via Powershell:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $creds -Authentication Basic -AllowRedirection

Import-PSSession $Session
Type in the following to change the username for login to Office 365:

Set-MsolUserPrincipalName -UserPrincipalName old.email@company.com -NewUserPrincipalName new.email@company.com
Login to the portal as administrator and make sure the changes have take effect.

If your company has an Active Directory user changes name in your domain or Office 365 user changes name, then contact us for assistance.

Category: PowerShell

Office 365 Azure AD Connect Upgrade

Office 365 Azure AD Connect Upgrade

Easily Transfer FSMO Roles Between DCs

Command Line Configuring TCP/IP Addressing

Share Users Office 365 Calendar

How to share Office 365 Calendar via Powershell

Scheduled Windows Server Restart

Network Ransomware Infection Best Practices

Steps for cleaning up after the network ransomware infection:

Exchange User Calendar Adding Permissions

Add Exchange User Calendar Permissions via Powershell

Mistakes Importing Active Directory User List

Powershell Script to Import Active Directory User List

Office 365 / Active Directory User Changes Name

Active Directory User Changes Name objects

Changes to Office 365

Recent Posts

Archives

Categories

Category: PowerShell

Office 365 Azure AD Connect Upgrade

How to share Office 365 Calendar via Powershell

Steps for cleaning up after the network ransomware infection:

Add Exchange User Calendar Permissions via Powershell

Powershell Script to Import Active Directory User List

Active Directory User Changes Name objects

Changes to Office 365

Recent Posts

Archives

Categories

Evaluation Signup