Remove Terminated User from GAL - Powershell

Quick Powershell script to remove disabled users from the Exchange 2007 Global Address List (GAL) without deleting the account / mailbox. This uses the Quest Active Roles powershell extensions for Active Directory.

### -----------------------------------------------------------------
### Written by Matt Brown
###
### Name: Remove Terminated Employees from GAL
###
### Version: v1.0, 02/2010
###
### Info: This script Finds Disabled Users and removes them from the GAL
###
### Requires: 1. Quest Powershell extensions for AD
###
### Note: If you are using Resource Mailboxes that are disabled you
###   will want to directly specify your staff OU.
### -----------------------------------------------------------------
$mydomain = 'domain.company.com/Staff'
get-qaduser -SearchRoot $mydomain -SizeLimit 3000 -Enabled:$false | set-qaduser -objectAttributes @{showinaddressbook=@()}

Exchange 2007 Alias update - Powershell

With a recent migration from an old email system I needed to bring over aliases from the old system that would be grandfathered for those users but not new users. This Powershell script checked the accounts to see if the alias was present and if not added it to the account as an accepted Email Address.

### -----------------------------------------------------------------
### Written by Matt Brown - 01/07/2010
###
### Powershell script to update Exchange Aliases
### from ones found old email system
###
### Requires Exchange Powershell extenstions
###
### Input file should contain csv row for alias and username
###      Example: username,alias
###               jdoe,jon.doe
### -----------------------------------------------------------------

$thedate = Get-Date -f yyyy-MM-dd_HH-mm
$filename = $thedate + "_output.rtf"
start-transcript -path $filename

# ---------------------------
# Add Quest AD Snapin
# ---------------------------
if(-not (Get-PSSnapin | where { $_.Name -match 'quest.activeroles.admanagement' })) {
 add-PSSnapin quest.activeroles.admanagement
}
if(-not (Get-PSSnapin | where { $_.Name -match 'Microsoft.Exchange.Management.PowerShell.Admin' })) {
 add-PSSnapin Microsoft.Exchange.Management.PowerShell.Admin
}

## Grab all the aliases in the file and group in an array by username
$MailAliases = @{}
Import-Csv "test.txt" | foreach { 
 $MailAliases[$_.Username] += @($_.Alias)
}

## set the domains we want to see for each alias
$Domains = @()
$Domains += "@domain.com"
$Domains += "@sub.domain.com"

## loop through the users and look for each alias
## with each domain in the current list if missing add
## it to the accepted addresses and update the user account
$x = $MailAliases.count
$length = $x
$MailAliases.keys | foreach {
 # Get the user account
 $User = Get-Mailuser -identity $_
 $updateuser = $false
 # Check each mail alias in the list
 $MailAliases[$_] | foreach {
  $ua = $_
  $Domains | foreach {
   $check = $ua + $_
   $needsadd = $true
   $User.EmailAddresses | foreach {
    if($_.SMTPAddress -eq $check) {
     # address found in list, will not be added
     $needsadd = $false
    }
   }
   if($needsadd -eq $true) {
    # address wasn't found, add to accepted addresses
    $User.EmailAddresses += $check 
    $updateuser = $true
   }
  }
 } 
 if($updateuser -eq $true) {
  # Now Update the User Account with new aliases
  #Write-Host $User.Name
  $User | Set-Mailuser
 }
}
#cleanup
Stop-Transcript

SMTP Relay with Exchange 2007 - part 2

Problem: I needed to add new applications / servers to the SMTP Relay Connector and document the additions.

Solution: Powershell script that reads a csv file with needed server / application / admin info. It then adds the IP address to the connector and logs the info to another CSV file.

CSV Files looks like this:
IP,Server,Admin,Application,fromaddr
10.0.0.1,SQL01,John Doe,SQL Mailer,jdoe@mydomain.com

Powershell script

----------------------------------

# Grab all our current connectors - should be 1 per hub server
$Connectors = Get-ReceiveConnector | where { $_.Name -eq "SMTP-Relay" }

# set value to current IP listed in first connector found
$ip = $connectors[0].RemoteIpRanges

# Open the File of IPs to add
$import = Import-Csv "1-NewSMTPRelayAddress.txt"
$updateConnector = $false

# Loop through CSV File
$import | Foreach {
 # Set Vars
 $newip = $_.ip

 # Update Documentation (IP, Server, Admin, Application, Date Access Granted)
 $thedate2 = Get-Date -f "yyyy-MM-dd HH:mm"
 $out = $newip + "," + $_.Server + "," + $_.Admin + ","
 $out += $_.Application + "," + $_.fromaddr + "," + $thedate2 + "`n"
 $out | out-file SMTP_Relay_Access.csv -append

 # add new ip to the list
 $ip += $newip

 # set a var so we know we need to update the connectors
 $updateConnector = $true
}


if($updateConnector) {
 # add those to all the connectors
 $Connectors | Set-ReceiveConnector -RemoteIPRanges $ip
 Write-host "The Following IPs are in the Connector" $ip

 # Log run and clear file
 $newname = $thedate + "_IPsAdded.txt"
 copy-item -path "1-NewSMTPRelayAddress.txt" -destination "Log\$newname"
 "IP,Server,Admin,Application,fromaddr" | out-file 1-NewSMTPRelayAddress.txt
} else {
 write-host "No addresses found in the file"
}

SMTP Relay with Exchange 2007 - Part 1

Problem: We needed to allow specific servers / applications to send through our Exchange servers without first authenticating.

Solution: In order to do this we setup a send connector on our Exchange HUB servers that allowed any of the specified IP's to send without authentication.

Powershell to setup the Exchange Connector:

$remoteserver = '10.0.0.1'
$emaildomain = 'mydomain.com'
$HubServers = get-exchangeserver | where { $_.ServerRole -match "HubTransport" }
$HubServers | new-ReceiveConnector -Name 'SMTP-Relay' -Usage 'Custom' -Bindings '0.0.0.0:25' -Fqdn 'mydomain.com' -RemoteIPRanges '10.0.0.1' -AuthMechanism Tls,ExternalAuthoritative -PermissionGroups ExchangeServers

Exchange 2007 Public Folder Setup - powershell

In this example I'm setting up a Public Folder structure for departmental Absence or Leave Calendars, Giving departments an shared calendar that can be used to track vacation, sick leave, holiday's, etc. What I do first is create the top level Public Folder called Absence Calendars. I then grant my username owner rights on that new Public Folder. Now I can do the rest of the setup (create calendar and setup permissions) directly from my outlook client. Note: I could optionally create a department Public Folder under the Absence Calendars folder if needed and then create the calendar under that.

New-PublicFolder -Name 'Absence Calendars' -Path '\' -Server 'mbx01.company.com' 
New-PublicFolder -Name 'Accounts Payable' -Path '\Absence Calendars' -Server 'mbx01.company.com' 
Add-PublicFolderClientPermission -User username -AccessRights owner -Identity "\Absence Calendars\Accounts Payable"

Once in Outlook open up the Folder List (Go -> Folder List) to see the public Folders (it's at the bottom). You should see the new folder created (in our case Absence Calendars). Right click on the Absence Calendars public folder and go to Create New Folder. In the Create New Folder dialog Choose Calendar Items and a name (I chose AP - Leave).


Now, right click on the new Calendar you just created and select "Change Sharing Permissions...". I usually set the department manager as the Editor and set everybody else to Author. This gives employees the ability to add items to the Calendar and allows the Manager to add / delete all the items. You may want to lock this down further by only allowing the employee's the ability to see the calendar and have the manager add all items once approved. In this case you should set the Default to Reviewer, Anonymous to None, and Manager(s) to Editor.

Removing Other Users Folder from Outlook on Exchange

Question:
How do I remove another user's data folder or inbox that I have showing up in my outlook profile? When I right click and go to close folder it tells me to go to account settings and when I go to account settings it only show's my account.

Answer:
1. Select your Main Outlook Profile (Mailbox - )
2. Right click and go to Properties for "Mailbox - "
3. Under General Tab click on the Advanced Button
4. Click on the Advanced Tab
5. Under Mailboxes, find the mailbox you want to remove and click remove.
6. Click ok and the mailbox should be gone.

Exchange 2007 - Blackberry Enterprise Server (BES) Setup

Here are a couple things I had to do to get the Blackberry Enterprise Server (BES) running with Exchange 2007. This stuff wasn't clear in the install guide. Especially number 1 below.

1. Give the BESAdmin account permission on my exchange databases. I had to do it on all of our databases. Here's the command for Database07

add-adpermission -user BESAdmin –identity “Database07” -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

2. Give the BESAdmin account extended rights

Add-ADPermission -Identity "BESAdmin" -User "BESAdmin" -AccessRights GenericRead,GenericWrite,ExtendedRight -extendedrights Send-As,Receive-As,Receive-As,ms-Exch-Store-Admin

3. Add the BESAdmin to the Exchange View Only Administrators Group in Active Directory.

Powershell: Exchange 2007 - BES - Blackberry Enterprise Server

Here a quick little snippet from a script I run when setting up users for our BES (Blackberry Enterprise Server) environment with Exchange 2007. Essentially, the script is just giving the BESAdmin account Send-As permission on the AD Account. You could do this on your entire User OU in the domain, but for security purposes we've decided to only set the permission for the Blackberry users.

# Open the File of User Names and Put it in the Pipeline
$import = Import-Csv "NewBlackBerryAccounts.txt"
$domain = "mydomain.com"

# Loop Through the CSV File, creating accounts
$import | Foreach {
   # Set Vars
   $StrUserName = $_.Username

   $user = get-qaduser $StrUserName@$domain
   if($user) {
      $dn = $user.DN
      Add-ADPermission -Identity $dn -User 'mydomain\BESAdmin' -ExtendedRights 'Send-as'
   } else {
      write-host Username $_.Username not found
   }
}

Powershell: Monitor IIS Application Pool or Site

We have an exchange IIS Application Pool stopping every so often because of some Entourage client problems. It would cause the Application Pool to stop and therefore break owa access, which was a problem.

So while we are working with Microsoft on a permanent solution I quickly put together a powershell script to run every 30 seconds and check the state of the application pool. If the MSExchangeOWAAppPool is stopped, then the script starts it. It uses the IIS Provider Tools snapin for powershell.

### -----------------------------------------------
### Written by Matt Brown - 12:46 PM 11/3/2008
### Powershell script to check MSExchangeOWAAppPool
### Requires IIS Administration Provider Tools
### -----------------------------------------------

### Make sure Snapin is loaded
$add = 1
get-PSSnapin * | foreach {
 if($_.Name -match 'IIsProviderSnapIn') {
  $add = 0
 }
}
if($add) {
 add-PSSnapin IIsProviderSnapIn
}

#######################################
######## Check AppPool State ##########
#######################################
Write-Host "`n"
Write-Host "#####################################"
Write-Host "Running check on MSExchangeOWAAppPool"
Write-Host "#####################################"
while($true) {

 $state = Get-WebItemState IIS:\AppPools\MSExchangeOWAAppPool
 if($state -eq "Stopped") {
  Start-WebItem IIS:\AppPools\MSExchangeOWAAppPool
  $now = Get-Date –f "yyyy-MM-dd HH:mm:ss"
  $MsgBody = "CAS01 AppPool needed a restart " + $now
  Write-Host $MsgBody
 }
 Start-Sleep -s 30
}

Update GAL Display Name - powershell

We recently decided to change on how our Global Address list is displayed from using the format to the , format.

Powershell made quick work of this task and took about 10 minutes with 2500 users. Here's the script.

###=====================================
### Update Exchange Global Address List Display
### - Matt Brown, 2008
###=====================================
$Users = Get-User -ResultSize unlimited |
 where {
   ($_.RecipientTypeDetails -eq "MailUser")
   -or ($_.RecipientTypeDetails -eq "UserMailbox")
 }

ForEach ($Person in $Users) {
   $NewName = $User.LastName + ", "
   $NewName += $User.FirstName + " "
   $NewName += $user.Initials
  
   # get rid of trailing spaces caused by blank initials
   $NewName = $NewName.Trim()
   Set-User $User -Name $NewName -DisplayName $NewName
   $NewName = $Null
}

Don't forget to update the OAB after this is done so your outlook clients will update.