Microsoft-Infrastructure on Janik von Rotz

Monitor and audit Active Directory user and group management

Thu, 12 Oct 2017 15:54:08 +0000

Traceability is key when collaborating in the Active Directory (AD). Multiple admins changing and updating permissions and policies makes it difficult being compliant with the company’s policies. It is important to monitor mutations in the directory. By default audit policies are disabled for Domain Controllers (DC) and must be enabled explicitly. Enabling auditing for the DCs is quite easy, querying the logs for a specific event is a bit more difficult.

In this guide you’ll learn how to enable auditing for a specific case and how to query the audit logs for a specific event.

The tutorial assumes that there is a:

Domain Controller.
Group policies, security groups, users, …
Admins with DC access.

Enable Auditing

Let’s start by have a look on the already enabled audit categories.

Log into the DC.
Open PowerShell as admin.
Run auditpol /get /category:*

The command returns a list of audit categories and its status. These settings have been enabled by either the auditpol tool or via GPOs.

In our scenario we would like to track management of users and groups, which is part of the Audit Account Management. To enable this audit category create a new group policiy for the DC.

Open the GPO management console.
Right-click the Domain Controllers organizational unit.
Create new GPO and open it in the GPO editor.
Enable logging for subcategories: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Audit: Force audit policy subcategory settings...
Increase the security log size to 4GB: Computer Configuration > Windows Settings > Security Settings > Event Log > Maximum security log size: 4268032
Then navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Account Management
Enable the required audit categories.
Make a gpupdate /force on the DC.
Run auditpol /get /Category:* and double-check whether the settings are correct.

If you open the security event log on the DC there should be events logging account management mutations.

Source: Microsoft Docs - Monitoring Active Directory for Signs of Compromise

Query Audit Logs

As mentioned querying the event log is a bit more difficult. The event log viewer offers limited features for filtering events and searching by specific keywords. In contrast with PowerShell it is possible to filter and search the event log by any property and keyword.

Here is a simple example:

$LogName = "security"
$StartTime = Get-Date("2017-10-12 12:50")
$EndTime = Get-Date("2017-10-12 13:00")
$SearchKey = "username"

Get-WinEvent -FilterHashtable @{LogName=$LogName; StartTime=$StartTime;EndTime=$EndTime} | Where-Object {$_.Message -match $SearchKey} | select Id, TimeCreated, Message | Format-List

Source: Hey, Scripting Guy! Blog - Filtering Event Log Events with PowerShell

Install SharePoint 2013 Three-tier Farm – Installing and Configuring Office Web Apps Server

Tue, 25 Mar 2014 09:18:05 +0000

This post of is part of my Install SharePoint 2013 Three-tier Farm project.

With Windows Server 2012 the deployment of Offic Web Apps Server got a lot easier.

Installation

First install the prerequisites.

Add-WindowsFeature Web-Server,Web-Mgmt-Tools,Web-Mgmt-Console,Web-WebServer,Web-Common-Http,Web-Default-Doc,Web-Static-Content,Web-Performance,Web-Stat-Compression,Web-Dyn-Compression,Web-Security,Web-Filtering,Web-Windows-Auth,Web-App-Dev,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Includes,InkandHandwritingServices,NET-Framework-Features,NET-Framework-Core

Download the Office Web Apps Server Installer from http://go.microsoft.com/fwlink/p/?LinkId=256561

And install the Office Web Apps Server

Deploy a new Web Apps Server Farm with PowerShell.

New-OfficeWebAppsFarm -InternalUrl "http://example.org" -ExternalUrl "http://example.org" -EditingEnabled -AllowHttp:$true

Update

In order to update a Office Web Apps Server installation you have to remove the existing Office Web Apps Farm.

Remove-OfficeWebAppsMachine

Now you can install the required updates.

If the installation has been finished create the Office Web Apps Farm again according to your settings.

New-OfficeWebAppsFarm -InternalUrl "http://example.org" -ExternalUrl "http://example.org" -EditingEnabled -AllowHttp:$true

The check wether Office Web Apps are running open your browser on:

http://example.org/hosting/discovery

Source

Microsoft Technet: Deploy Office Web Apps Server Update Office Web Apps Server 2013

Install .NET Framework 3.5 on Windows Server 2012 and Windows Server 2012 R2

Tue, 11 Mar 2014 07:30:44 +0000

To install the .Net Framework 3.5 on Windows Server 2012 and Windows Server 2012 R2 you have to enable the install feature from the online source.

Now you should be able to install the feature with server management console.

Install SharePoint 2013 Three-tier Farm - Installing and Configuring SharePoint SQL Server

Tue, 25 Feb 2014 13:52:33 +0000

This post of is part of my Install SharePoint 2013 Three-tier Farm project.

In this post I’ll show my best practice for an new SQL Server to run SharePoint properly.

Let’s get started with local user rights.

The Group Local Administrators members are:

Based on you standards and options I have the following system configurations for you:

And now it’s time to install the SQL server.

The SQL Server 2008 R2 as in my case requires the .Net Framework 3.5. To install it on Windows server 2012 run this command:

dism /online /enable-feature /featurename:NetFX3 /all /Source:d:sourcessxs /LimitAccess

Only after executing this command you’re able to install the .Net framework as usual with the wizard.

At this point where the SQL server installation I don’t want to provide you a step by step guide, as you might install another version or this guide gets obsolete.

I think the sql server configuration file is much more informative.

;SQLSERVER2008 Configuration File
[SQLSERVER2008]

; Specify the Instance ID for the SQL Server features you have specified. SQL Server directory structure, registry structure, and service names will reflect the instance ID of the SQL Server instance.

INSTANCEID="MSSQLSERVER"

; Specifies a Setup work flow, like INSTALL, UNINSTALL, or UPGRADE. This is a required parameter.

ACTION="Install"

; Specifies features to install, uninstall, or upgrade. The list of top-level features include SQL, AS, RS, IS, and Tools. The SQL feature will install the database engine, replication, and full-text. The Tools feature will install Management Tools, Books online, Business Intelligence Development Studio, and other shared components.

FEATURES=SQLENGINE,FULLTEXT,IS,BC,SSMS,ADV_SSMS

; Displays the command line parameters usage

HELP="False"

; Specifies that the detailed Setup log should be piped to the console.

INDICATEPROGRESS="False"

; Setup will not display any user interface.

QUIET="False"

; Setup will display progress only without any user interaction.

QUIETSIMPLE="False"

; Specifies that Setup should install into WOW64. This command line argument is not supported on an IA64 or a 32-bit system.

X86="False"

; Detailed help for command line argument ENU has not been defined yet.

ENU="True"

; Parameter that controls the user interface behavior. Valid values are Normal for the full UI, and AutoAdvance for a simplied UI.

UIMODE="Normal"

; Specify if errors can be reported to Microsoft to improve future SQL Server releases. Specify 1 or True to enable and 0 or False to disable this feature.

ERRORREPORTING="False"

; Specify the root installation directory for native shared components.

INSTALLSHAREDDIR="C:Program FilesMicrosoft SQL Server"

; Specify the root installation directory for the WOW64 shared components.

INSTALLSHAREDWOWDIR="C:Program Files (x86)Microsoft SQL Server"

; Specify the installation directory.

INSTANCEDIR="C:Program FilesMicrosoft SQL Server"

; Specify that SQL Server feature usage data can be collected and sent to Microsoft. Specify 1 or True to enable and 0 or False to disable this feature.

SQMREPORTING="False"

; Specify a default or named instance. MSSQLSERVER is the default instance for non-Express editions and SQLExpress for Express editions. This parameter is required when installing the SQL Server Database Engine (SQL), Analysis Services (AS), or Reporting Services (RS).

INSTANCENAME="MSSQLSERVER"

; Agent account name

AGTSVCACCOUNT="VBLSP1SQL_Agent"

; Auto-start service after installation.

AGTSVCSTARTUPTYPE="Automatic"

; Startup type for Integration Services.

ISSVCSTARTUPTYPE="Automatic"

; Account for Integration Services: DomainUser or system account.

ISSVCACCOUNT="NT AUTHORITYNetworkService"

; Controls the service startup type setting after the service has been created.

ASSVCSTARTUPTYPE="Automatic"

; The collation to be used by Analysis Services.

ASCOLLATION="Latin1_General_CI_AS"

; The location for the Analysis Services data files.

ASDATADIR="Data"

; The location for the Analysis Services log files.

ASLOGDIR="Log"

; The location for the Analysis Services backup files.

ASBACKUPDIR="Backup"

; The location for the Analysis Services temporary files.

ASTEMPDIR="Temp"

; The location for the Analysis Services configuration files.

ASCONFIGDIR="Config"

; Specifies whether or not the MSOLAP provider is allowed to run in process.

ASPROVIDERMSOLAP="1"

; A port number used to connect to the SharePoint Central Administration web application.

FARMADMINPORT="0"

; Startup type for the SQL Server service.

SQLSVCSTARTUPTYPE="Automatic"

; Level to enable FILESTREAM feature at (0, 1, 2 or 3).

FILESTREAMLEVEL="0"

; Set to "1" to enable RANU for SQL Server Express.

ENABLERANU="False"

; Specifies a Windows collation or an SQL collation to use for the Database Engine.

SQLCOLLATION="Latin1_General_CI_AS_KS_WS"

; Account for SQL Server service: DomainUser or system account.

SQLSVCACCOUNT="VBLSP1SQL_Engine"

; Windows account(s) to provision as SQL Server system administrators.

SQLSYSADMINACCOUNTS="VORDEFINIERTAdministratoren" "VBLSP1SQL_Admin"

; Default directory for the Database Engine backup files.

SQLBACKUPDIR="E:Microsoft SQL ServerBackup"

; Default directory for the Database Engine user databases.

SQLUSERDBDIR="E:Microsoft SQL ServerData"

; Provision current user as a Database Engine system administrator for SQL Server 2008 R2 Express.

ADDCURRENTUSERASSQLADMIN="False"

; Specify 0 to disable or 1 to enable the TCP/IP protocol.

TCPENABLED="1"

; Specify 0 to disable or 1 to enable the Named Pipes protocol.

NPENABLED="0"

; Startup type for Browser Service.

BROWSERSVCSTARTUPTYPE="Disabled"

; Specifies how the startup mode of the report server NT service.  When
; Manual - Service startup is manual mode (default).
; Automatic - Service startup is automatic mode.
; Disabled - Service is disabled

RSSVCSTARTUPTYPE="Automatic"

; Specifies which mode report server is installed in.
; Default value: “FilesOnly”

RSINSTALLMODE="FilesOnlyMode"

; Add description of input argument FTSVCACCOUNT

FTSVCACCOUNT="NT AUTHORITYLOCAL SERVICE"

The most important configurations are the data directories and the user service accounts. In the last post we created several service accounts, you can use them now as showed here:

You might have seen, the temdb is stored on the C drive and I know as s a best practice you should not have tempdb on the C drive because the OS has the paging file on C by default and you don’t want the mixed I/O affecting tempdb performance. But let’s be honest this action won’t affect our SharePoint installation in any way.

Now you should have installed the SQL server successfully. Open the management studio, log in and execute these statements:

-- Set Memory

EXEC sys.sp_configure N'show advanced options', N'1'  RECONFIGURE WITH OVERRIDE
GO
EXEC sys.sp_configure N'max server memory (MB)', N'10240'
GO
RECONFIGURE WITH OVERRIDE
GO
EXEC sys.sp_configure N'show advanced options', N'0'  RECONFIGURE WITH OVERRIDE
GO

-- Set-Permission

USE [master]
GO
CREATE LOGIN [VBLsp1_admin] FROM WINDOWS WITH DEFAULT_DATABASE=[master]
GO
EXEC master..sp_addsrvrolemember @loginame = N'domainsp1_admin', @rolename = N'dbcreator'
GO
EXEC master..sp_addsrvrolemember @loginame = N'domainsp1_admin', @rolename = N'securityadmin'
GO

-- Backup Compression

EXEC sys.sp_configure N'backup compression default', N'1'
GO
RECONFIGURE WITH OVERRIDE
GO

-- Max Parallelism

sp_configure 'show advanced options', 1;
GO
RECONFIGURE WITH OVERRIDE;
GO
sp_configure 'max degree of parallelism', 1;
GO
RECONFIGURE WITH OVERRIDE;
GO

Last but not least update the SQL server installation.

On the site https://sqlserverbuilds.blogspot.ch/ you’ll find the latest update definitions for your SQL server installation.

In case you don’t know you SQL server version run this command:

SELECT SERVERPROPERTY('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition')

Install SharePoint 2013 Three-tier Farm - Deploy the SQL Server Backup Job

Fri, 07 Feb 2014 10:24:03 +0000

This post of is part of my Install SharePoint 2013 Three-tier Farm project.

A clean SQL Server maintenance plan should include three processes, backup, integrity check and index optimize.

You could simply set up a SQL Server maintenance plan within the SQL Server management studio. But be aware that there are better solutions, E.g. Ola Hallengren’s SQL Server Maintenance Solution is my absolutely favourite.

Ola Hallengren is a Microsoft MVP who has simplified the installation of SQL Server maintenance plans. There are many other MVP’s who even recommend his solutions over the SQL Server management solution:

Brent Ozar

However the installation of the SQL ServerMaintenance Solution is very easy. A little bit more difficult is the scheduling, that’s why I create a clone repository for Ola’s SQL scripts and added and example of how to schedule these jobs.

You’ll find the repository on GitHub: https://codeberg.org/janikvonrotz/SQL-Server-Maintenance

Finally! Manage Exchange mailbox permissions with Active Directory groups

Mon, 27 Jan 2014 19:04:37 +0000

I’ve tried many ways to assign permissions for an Active Directory group on a Exchange (2010) mailbox, but it’s simply not possible.

Fortunately nothing’s impossible with PowerShell.

The following script can handle this issue by:

<#
$Metadata = @{
	Title = "Synchronize Service Mailbox Access Groups"
	Filename = "Sync-ServiceMailboxAccessGroups.ps1"
	Description = ""
	Tags = "powershell, activedirectory, exchange, synchronization, access, mailbox, groups, permissions"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2014-01-27"
	LastEditDate = "2014-01-27"
	Url = ""
	Version = "0.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

Import-Module ActiveDirectory

# Connect Exchange Server
$ExchangeServer = (Get-RemoteConnection ex1).Name
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://$ExchangeServer/PowerShell/" -Authentication Kerberos
Import-PSSession $PSSession

$Config = @{
    OU = "OU=Mailbox,OU=Exchange,OU=Services,OU=vblusers2,DC=vbl,DC=ch"

    ADGroupFilter = @{
        NamePrefix = "EX_"
        NameInfix = ""
        NameSuffix = ""
    }

    ADGroup = @{
        NamePrefix = "EX_"
        PermissionSeperator = "#"
    }

    ADGroupMailboxReferenceAttribute = "extensionAttribute1"

    MailBoxFilter = @{
        RecipientTypeDetails = "UserMailbox"
        ADGroupsAndUsers = "F_Mitarbeiter","F_Archivierte Benutzer"
        ExcludeDisplayName = "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042"
    }

} | %{New-Object PSObject -Property $_}

# get domain name
$Domain = "$(((Get-ADDomain).Name).toupper())"

# get ad user objects
$Config.MailBoxFilter.ADGroupsAndUsers = $Config.MailBoxFilter.ADGroupsAndUsers | %{
    Get-ADObject -Filter {(Name -eq $_) -or (ObjectGUID -eq $_)} | %{
        if($_.ObjectClass -eq "user"){$_.DistinguishedName
        }elseif($_.ObjectClass -eq "group"){ Get-ADGroupMember $_.DistinguishedName -Recursive}
    } | Get-ADUser -Properties Mail
}

# create mail list to filter mailboxes
$Config.MailboxFilter.AllowedMails = $Config.MailBoxFilter.ADGroupsAndUsers | %{"$($_.Mail)"}

# create SamAccountName list to filter mailbox permissions
$Config.ADGroupFilter.AllowedUsers = $Config.MailboxFilter.ADGroupsAndUsers | %{"$($Domain + $_.SamAccountName)"}

# get exisiting mailbox permission ad groups
$ADGroups = Get-ADGroup -Filter * -SearchBase $Config.OU -Properties $Config.ADGroupMailboxReferenceAttribute | where{$_.Name.StartsWith($Config.ADGroupFilter.NamePrefix) -and $_.Name.Contains($Config.ADGroupFilter.NameInfix) -and $_.Name.EndsWith($Config.ADGroupFilter.NameSuffix)}

# sync mailbox access groups for each mailbox
$Mailboxes = Get-Mailbox | where{$_.RecipientTypeDetails -eq $Config.MailBoxFilter.RecipientTypeDetails -and $Config.MailboxFilter.AllowedMails -notcontains $_.PrimarySmtpAddress.tolower() -and $Config.MailBoxFilter.ExcludeDisplayName -notcontains $_.DisplayName}

$RequiredADGroups = $Mailboxes | %{

    # set variables
    $ADPermissionGroups = @()
    $Mailbox = $_

    Write-Host "Parsing permissions on mailbox: $($_.Alias)"

    # get existing permission groups
    $ADPermissionGroups = $ADGroups | where{(iex "`$_.$($Config.ADGroupMailboxReferenceAttribute)") -eq $Mailbox.Guid}
    $ADExistingPermissionGroupTypes = $ADPermissionGroups| where{$_} | %{$_.Name.split("#")[1]}

    # get existing and allowed mailbox permissions
    $MailboxPermissions = $Mailbox | Get-MailboxPermission | where{$Config.ADGroupFilter.AllowedUsers -contains $_.User}

    # create an ad group foreach permissiontype that is required
    $NewADPermissionGroupTypes = $MailboxPermissions | %{"$($_.AccessRights)".split(", ") | where{$_} | %{$_} | %{$_ | where{$ADExistingPermissionGroupTypes -notcontains $_}}}
    $NewADPermissionGroupTypes | Group | %{

        # create ad group name foreach permission type
        $Name = $config.ADGroup.NamePrefix + $Mailbox.Displayname + $Config.ADGroup.PermissionSeperator + $_.Name

        Write-PPEventLog -Message "Add service mailbox access group: $Name" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
        New-ADGroup -Name $Name -SamAccountName $Name -GroupCategory Security -GroupScope Global -DisplayName $Name  -Path $Config.OU -Description "Exchange Access Group for: $($Mailbox.Displayname)"
        Get-ADGroup $Name

    } | %{

        # set the reference from the adgroup to the mailbox
        iex "`$_.$($Config.ADGroupMailboxReferenceAttribute) = `"$($Mailbox.Guid)`""
        Set-ADGroup -Instance $_
        $ADGroup = $_

        # add existing members to the permission group
        $MailboxPermissions | where{$_.AccessRights -match $ADGroup.Name.split("#")[1]} | %{
            Add-ADGroupMember -Identity $ADGroup -Members ($_.User -replace "$Domain","")
        }

        # output ad permission groups
        $_
    }

    # check members foreach permission group
    $ADPermissionGroups | where{$_} | %{

        # get permission type
        $Permission = $_.Name.split("#")[1]

        # get existin ad user groups
        $ADPermissionGroupUsers = $_ | Get-ADGroupMember -Recursive | select @{L="User";E={$($Domain + $_.SamAccountName)}}
        $MailboxUsers =  $MailboxPermissions | where{$_.AccessRights -match $Permission} | select user

        # compare these groups and update members
        if($ADPermissionGroupUsers){
            $PermissionDiff = Compare-Object -ReferenceObject $ADPermissionGroupUsers -DifferenceObject $MailboxUsers -Property User

            # add member
            $PermissionDiff | where{$_.SideIndicator -eq "<="} | %{

                Write-PPEventLog -Message "Add mailbox permission: $Permission for user: $($_.User) on mailbox: $($Mailbox.Alias)" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
                Add-MailboxPermission -Identity $Mailbox.Alias -User $_.User -AccessRights $Permission
            }

            # remove member
            $PermissionDiff | where{$_.SideIndicator -eq "=>"} | %{

                Write-PPEventLog -Message "Remove mailbox permission: $Permission for user: $($_.User) on mailbox: $($Mailbox.Alias)" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
                Remove-MailboxPermission -Identity $Mailbox.Alias -User $_.User -AccessRights $Permission -Confirm:$false
            }
        }

        #output ad permission group to delete old ad permission groups
        $_
    }
}

$ADGroups | where{$RequiredADGroups -notcontains $_} | %{

    Write-PPEventLog -Message "Remove service mailbox access group: $Name" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
    Remove-ADGroup -Identity $_ -Confirm:$false
}

Remove-PSSession $PSSession
Write-PPErrorEventLog -Source "Synchronize Service Mailbox Access Groups" -ClearErrorVariable

Latest version of this script: https://gist.github.com/8653473

To run this script properly and use commands as Write-PPEventLog I recommend you to install my project PowerShell Profile.

Change Active Directory User Password Expiration Mode

Wed, 11 Dec 2013 17:35:45 +0000

To change an Active Directory users password expiration mode you can use this PowerShell snippet:

Import-Module ActiveDirectory

Get-ADGroupMember "Group1" -Recursive |
Get-ADUser -Properties PasswordNeverExpires |
where {$_.enabled -eq $true -and $_.PasswordNeverExpires -eq $false} |
select -First 50 | %{

    Write-Host $_.UserPrincipalName
    Set-ADUser $_ -PasswordNeverExpires $true
}

Latest version of this snippet: https://gist.github.com/7913696

Get Active Directory User Membership Groups Recursively

Wed, 11 Dec 2013 11:46:37 +0000

To get a users member shipments recursively I’ve written an extended function based on the already existing function Get-ADPrincipalGroupMembership it simply loops through the users member shipments and outputs the data in tree styled list.

This function is part of my PowerShell Profile project. Install this framework to get the latest version of this function.

<#
$Metadata = @{
	Title = "Get Active Directory Principal Group Membership Recurse"
	Filename = "Get-ADPrincipalGroupMembershipRecurse.ps1"
	Description = ""
	Tags = "powershell, activedirectory, get, prinicipal, group, membership, recurse"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2013-12-11"
	LastEditDate = "2013-12-11"
	Url = ""
	Version = "1.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

function Get-ADPrincipalGroupMembershipRecurse{

<#
.SYNOPSIS
    Get Active Directory principal group membership recursively.

.DESCRIPTION
	Get Active Directory principal group membership recursively.

.PARAMETER  ADUser
	Active Directory user to report.

.PARAMETER  ADGroup
	Looping parameter not required!

.PARAMETER  ADGroup
    Looping parameter not required!

.EXAMPLE
	PS C:> Get-ADPrincipalGroupMembershipRecurse -ADUser (Get-ADUser user1) | Out-GridView
#>

	[CmdletBinding()]
	param(

		[Parameter(Mandatory=$false)]
		[ValidateNotNullOrEmpty()]
		$ADUser,

		[Parameter(Mandatory=$false)]
		[ValidateNotNullOrEmpty()]
		$ADGroup,

        [Parameter(Mandatory=$false)]
        $Level = 0
    )

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    Import-Module ActiveDirectory

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # loop select for user parameter
    if($ADUser){

        # get membership groups of user and run this function
        $ADGroups = Get-ADPrincipalGroupMembership $ADUser | %{
            Get-ADPrincipalGroupMembershipRecurse -ADGroup $_ -Level ($Level+1)
        }

        # get max number of levels
        $Levels = ($ADGroups | %{$_.Level} | measure -Maximum).Maximum + 1

        # display the results in columns
        $ADGroups | %{

            # create a column item
            $Item = New-Object –TypeName PSObject

            # create a column for each level
            $Index = 1;while($Index -ne $Levels){

                # place the value in the right level
                if($_.Level -eq $Index){
                    $Item | Add-Member –MemberType NoteProperty –Name "Level $Index" –Value $_.Name
                }else{
                    $Item | Add-Member –MemberType NoteProperty –Name "Level $Index" –Value ""
                }

                $Index += 1
            }

            #output
            $Item
        }

    # loop select for group parameter
    }elseif($ADGroup){

        # show a progress
        Write-Progress -Activity "Collecting Data" -Status "$($_.Name)" -PercentComplete (Get-Random -Minimum 1 -Maximum 100)

        # return the item and its level
        $_ | select Name,@{L="Level";E={$Level}}

        # check for further membershipments of this group and loop this function
        Get-ADPrincipalGroupMembership $_ | %{
            Get-ADPrincipalGroupMembershipRecurse -ADGroup $_ -Level ($Level+1)
        }
    }
}

Making Exchange Distribution Lists Externally Available

Tue, 12 Nov 2013 08:36:52 +0000

This might not be best practise but based on the situation you as administrator have to enable this feature.

Making distribution lists externally available is great for spammers, so if you enable this feature, do this as less as possible.

To enable a exchange distribution list for external use I recommand to use this simple PowerShell command:

Set-DistributionGroup <groupname> -RequireSenderAuthenticationEnabled $false