Exchange Powershell

List Members of a Dynamic Distribution List

admin — Mon, 12 Jul 2010 17:23:19 +0000

This post was inspired by a post found on www.howexchangeworks.com

But I have modified the commands some to get a better listing.

$group = Get-DynamicDistributionGroup –identity “AllStaff”

Get-Recipient –RecipientPreviewFilter $group.RecipientFilter | sort name | select name > d:\_temp\dlist_members.txt

These changes will give you an alphabetical list of members, with names only in the list. I find this easier for managers to use to verify list membership.

The list we have uses the PO filed to filter it. So we then just have to go to the user account and add specific text in the PO filed to add or remove them from the distribution list.

List of Hidden Distribution Group

admin — Tue, 06 Jul 2010 20:45:05 +0000

You may find that you need to get a list of all of the distribution groups in your Exchange Organization that are hidden from the GAL (Global Address List). The following command is a simple powershell command that will accomplish this.

get-distributiongroup | select name, hiddenfromaddresslistsenabled | WHERE {$_.HiddenFromAddressListsEnabled -eq $true }

This will give you a two columned list. The first column will contain the name of the distribtuion list, and the second column will contain the value of the HiddenFromAddressListsEnabled field.

How to hide a Distribution Group from the GAL with Powershell

admin — Tue, 06 Jul 2010 20:35:54 +0000

Here is a simple command that will save you some time. Instead of having to open up a GUI, you can just type this command in a PowerShell window and hide a Group from the GAL (Global Address List)

set-distributiongroup [GROUPNAME] -HiddenFromAddressListsEnabled $true

This will then hide the list from the GAL. No need to go into the GUI to get it done.

Script – Mailbox Audit

admin — Thu, 03 Jun 2010 17:58:15 +0000

This is a script I wrote that will look for specific email accounts in an OU, and then send an email to all the people who have access to those email accounts.

— Start of Script –
#$ErrorActionPreference = "SilentlyContinue" $smtpServer = "[REMOVED]" $smtp = new-object Net.Mail.SmtpClient($smtpServer) $emailFrom = "mkieffer@[REMOVED]"


$a = get-user -OrganizationalUnit "[REMOVED]/Corp/Email Accounts" | where {$_.DistinguishedName -notlike '*OU=Contacts,OU=Email Accounts,OU=[REMOVED]' -and $_.DistinguishedName -notlike '*OU=Resources,OU=Email Accounts,OU=[REMOVED]'} | sort name
foreach ($item in $a) {
$mailboxName = $item.name

$mailboxAddress = $item.WindowsEmailAddress

$body = "We are in the process of auditing access rights to shared mailboxes.  According to our audit, you have access to the mailbox ""$mailboxName"".
"

$smtpAddresses = get-mailbox $mailboxName | select -expand EmailAddresses | %{$_.SmtpAddress}

$body += "This mailbox has the following email addresses:

$smtpAddresses
Primary Contact:  [None Specified]
"

$body += "The Following employees have full access to this mailbox:`r`n"

$subject = ""

$emailTo = "mkieffer@[REMOVED]"

$subject = "Audit of mailbox $mailboxName ($mailboxAddress)"

echo "$mailboxName ($mailboxAddress)"

$b = get-mailboxpermission $item.Name | where {$_.AccessRights -like "*FullAccess*"}

$newEmailTo = ""

$emailcounter = 0

    foreach ($item2 in $b) {

        [String]$name = $item2.User

        $c = get-mailbox $name

        if ($c.OrganizationalUnit -eq "[REMOVED]/Corp/Users/Employees" -and $c.name -ne "Mike Kieffer" ) {

        [String]$email = $c.WindowsEmailAddress

        [String]$fname = $c.DisplayName

        echo "-->  $fname ($email)"

        $body += $fname

        $body += [char]13

        if ($emailcounter -gt 0) {$newEmailTo += ", "}

        $newEmailTo += $email

        $emailcounter = $emailcounter + 1

        }

    }

$body += "`r`nPlease reply to this email with the following information:

1- If this mailbox is still needed or if this mailbox can be deleted.

2- Who is the primary contact for this mailbox.

3- Who needs to be added or removed from accessing this mailbox.

4- If any of the email addresses associated with this mailbox are no longer used, and can be removed.

5- Is the name of ""$mailboxName"" still approrpiate for this mailbox.

Thanks, Mike Kieffer IT Sr. Systems Administrator " echo $subject echo $body echo $newEmailTo $smtp.Send($emailFrom, $newEmailTo, $subject, $body) }
— End of Script —

Of course, you will need to modify the script to work in your enviornment, but this is a good starting point. Suggestions are welcomed on how to increase the usability of this script and also the effectiveness of it.

If you are unable to delete some of the users from the mailboxes during the audit, you may find this post helpful: Cannot remove ACE on object…

Script – Check Message Queue

admin — Thu, 03 Jun 2010 17:49:43 +0000

Here is a simple script I wrote that checks the message queue and then sends an email if the message queue goes over a specified limit.

— Start of Script —
function check_queue { $a = get-transportserver | get-queue | measure-object MessageCount -max


if ($a.Maximum -gt 25)

	{

	send_email $a.Maximum

	Exit

	}

start-sleep -s 60

check_queue

}
function send_email

{param ($queue_size)
$emailFrom = "[REMOVED]"

$emailTo = "[REMOVED]"

$subject = "QUEUE SIZE HIGH"

$body = "Message Queues are high, max value $queue_size"

$smtpServer = "[REMOVED]"

$smtp = new-object Net.Mail.SmtpClient($smtpServer)

$smtp.Send($emailFrom, $emailTo, $subject, $body)
}

check_queue
— End of Script —

In this script, replace the [REMOVED] with the data that is needed. You can then run this script as a scheduled task in a PowerShell window.

All you have to do is use the start-job command.

[PS] D:\_ps-scripts>start-job ./queue_check.ps1

WARNING: column “Command” does not fit into the display and was removed.

Id Name State HasMoreData Location
– —- —– ———– ——–
1 Job1 Running True localhost

And to remove the job, you just use the stop-job and remove-job command.

Exchange – Cannot remove ACE on object … because it is not present.

admin — Thu, 03 Jun 2010 16:05:37 +0000

I have run into a problem while doing some routine maintenance on some shared mailboxes for the company I work for. During the maintenance process, we audit the list of users that have full mailbox rights to any shared mailbox. In the process, I was trying to remove full permissions from several user accounts. Here is what the Manage Full Access Permission screen looked like.

If you notice, that last one on the list has a weird Icon associated with it. The icon is that of a user account with a small blue question mark in it.

But when you try to delete the message, you get the following screen that contains the following error

Summary: 1 item(s). 0 succeeded, 1 failed.
Elapsed time: 00:00:00

[REMOVED]\dtaylor
Failed

Error:
Cannot remove ACE on object “CN=MAIL ROOM,OU=Email Accounts,OU=[REMOVED]” for account “[REMOVED]\dtaylor” because it is not present.

Exchange Management Shell command attempted:
Remove-MailboxPermission -Identity ‘CN=MAIL ROOM,OU=Email Accounts,OU=[REMOVED]‘ -User ‘[REMOVED]\dtaylor’ -InheritanceType ‘All’ -AccessRights ‘FullAccess’

Elapsed Time: 00:00:00

Let me give you a little background. Several years ago, we had three domains. Two of the domains contained Exchange 2003 servers with mailboxes. We migrated all the mailboxes from the two domains to the domain that did not currently have an Exchange server in it. So basically we took three domains and consolidated to a single domain and migrated from Exchange 2003 to Exchange 2007. All three domains belonged to the same AD forest.

Solution
One way I found to get past this error was to copy the error message, and change the domain to the previous domain in the command. This would then delete the ACE for that user. This method works great, if the domain still exists in the organization so that it can do a SID lookup and then delete the ACE. (NOTE: I even tried to modify the command so instead of using [DOMAIN]\[USERNAME] I used the SID, but this did not work).

Exchange for some odd reason will always send the command to the Remove-MailboxPermission with the username in domain\username format. It will always do a lookup on the SID and then translate it to that format. So even by using the sid you get the same error. Here is an example:

[PS] >Remove-MailboxPermission -Identity ‘CN=MAIL ROOM,OU=Email Accounts,OU=[REMOVED]‘ -User ‘S-1-5-21-1398355167-[REMOVED]-15821′ -InheritanceType ‘All’ -AccessRights ‘FullAccess’

Confirm
Are you sure you want to perform this action?

Removing mailbox permission “[REMOVED]/Corp/Email Accounts/MAIL ROOM” for user “S-1-5-21-1398355167-[REMOVED]-15821″ with access rights “‘FullAccess’”.

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help
(default is “Y”):y

Remove-MailboxPermission : Cannot remove ACE on object “CN=MAIL ROOM,OU=Email Accounts,OU=[REMOVED]” for account “[REMOVED]\dtaylor” because it is not present.
At line:1 char:25

Notice that the first line has the SID in the remove-mailboxPermission command, but in the failed text, it has replaced the SID with the username.

To get the sid to do this, I went into AD Users and Computers and then after selecting the advanced view did an Attribute Editor lookup on the sIDHistory field.

So what do you do to remove the ACE for this account? The problem is that no matter what input you give the remove-MailboxPermission cmdlet, it will always do a lookup and resolve the sid to a username format. But if the sid it does the lookup on is not the primary sid for that account it will fail. To solve this problem you have to remove the ability for the cmdlet to resolve the sid in the first place. To do this, you have to remove the sIDHistory from the AD account.

Microsoft has a script on their site called “How To Use Visual Basic Script to Clear SidHistory“. If you run this script, it will remove the sid history, then when you look at the FULL Permissions, you will see a unresolved SID instead of the username. The remove-mailboxpermission cmdlet can then remove the ACE from that mailbox.

NOTE: I would record the sid value in the sIDHistory field somewhere, because chances are you will find other accounts that now show that sid as having full mailbox rights. You will then want to have a history of the sid so you can then grant permission to the correct account when you see an unresolved sid.

Delete all messages after date from mailbox

admin — Tue, 24 Nov 2009 23:16:59 +0000

I was asked to delete everything from a mailbox called familydomains that was older than 2009. Here is the Exchange Powershell command that I used to delete everything earlier than 12/31/2008 to a PST file located in my C:\temp directory.

export-mailbox familydomains -PSTFolderPath C:\temp\ -DeleteContent -endDate 12/31/2008

The advantage to doing it this way is that no emails are actually deleted. They are moved from the mailbox to the PST file, so they can be imported, or viewed through Outlook at a later date if the end user changes their mind.

Project Professional 2007 – Error

admin — Mon, 23 Nov 2009 16:42:01 +0000

I got a call from a user that was trying to use the web interface on a Project Server install, and was getting this error message when she was trying to edit a project that she created several days before:

Project Professional 2007 is currently running under a profile that does not match your current Project Web Access login. Restart Project Professional with a different profile, or exit Project Professional and then let Project Web Access automatically start Project Professional.

The client computer had not been rebooted since receiving this error, so I had her reboot her computer and the error message did not return.

Command to list all messages to a specific domain for the day

admin — Fri, 20 Nov 2009 22:21:07 +0000

If you want to list all of the messages sent to a recipient with a specific domain, you can run this command. It will export a list of all message from 8:00AM – 5:00PM on 10/17/2009 that were to someone on the domainname.com domain. The list will be saved to c:\send.xls

get-transportserver | Get-MessageTrackingLog -ResultSize Unlimited -Start “10/17/2009 8:00AM” -End “11/17/2009 5:00PM” -eventid Send | WHERE {$_.recipients -like “*domainname.com*”} > “c:\send.xls”

IBM X3550 7978-AC1

admin — Fri, 13 Nov 2009 17:41:25 +0000

We were having some issues with one of our X3550 servers from IBM. The server kept doing a blue screen and hard stop. The errors we were seeing indicated that it was probably the RAID controller, the system board raid controller. To start trouble shooting the process, I ran UpdateXpress version 4.07 to update the firmware on all devices. While it was updating the firmware on the ServeRAID 8k-l the system hard stopped again.

After a re-boot the server was saying that the BIOS on the RAID controller was corrupt and giving a Error Code: 86. The solution suggested was to re-flash the bios from the OS. Well, controller card having issues also controlled the OS drive. I therefore tried to use UpdateXpress again (booting form the UpdateXpress CD) and it was unable to flash the RAID BIOS.

I then called IBM support and had a technician come on-site to update the bios. He change a jumper setting, and then downloaded 4 floppy images and was able to flash the ServeRAID bios.

I asked him for the article number so if it happened again, I could fix the problem myself. The article number is MIGR 5073641, and if you do a search on IBM.com you will find instructions on how to do the process, including the downloads for the Floppy Diskettes he used.

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5073641

He was told to use the Floppy Disks instead of the CD download (something to do with the CD Drivers). In order for this to work, he had to put a jumper on J63 on the system board. This jumper is located by the RAID controller in the middle of the system board. After the jumper was set, you then boot to floppy disk #1 (downloaded from the link above). It then asks for the other diskettes in order, and then flashes the ServeRAID bios. When it has finished flashing the RAID card BIOS, then you power off the server and remove the J63 jumper. The RAID card should now have a valid BIOS and you should now be able access the drives on that controller.

I then suggest that you run UpdateXpress again and make sure that all of the systems are updated.