Exchange on Janik von Rotz

Finally! Manage Exchange mailbox permissions with Active Directory groups

Mon, 27 Jan 2014 19:04:37 +0000

I’ve tried many ways to assign permissions for an Active Directory group on a Exchange (2010) mailbox, but it’s simply not possible.

Fortunately nothing’s impossible with PowerShell.

The following script can handle this issue by:

<#
$Metadata = @{
	Title = "Synchronize Service Mailbox Access Groups"
	Filename = "Sync-ServiceMailboxAccessGroups.ps1"
	Description = ""
	Tags = "powershell, activedirectory, exchange, synchronization, access, mailbox, groups, permissions"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2014-01-27"
	LastEditDate = "2014-01-27"
	Url = ""
	Version = "0.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

Import-Module ActiveDirectory

# Connect Exchange Server
$ExchangeServer = (Get-RemoteConnection ex1).Name
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://$ExchangeServer/PowerShell/" -Authentication Kerberos
Import-PSSession $PSSession

$Config = @{
    OU = "OU=Mailbox,OU=Exchange,OU=Services,OU=vblusers2,DC=vbl,DC=ch"

    ADGroupFilter = @{
        NamePrefix = "EX_"
        NameInfix = ""
        NameSuffix = ""
    }

    ADGroup = @{
        NamePrefix = "EX_"
        PermissionSeperator = "#"
    }

    ADGroupMailboxReferenceAttribute = "extensionAttribute1"

    MailBoxFilter = @{
        RecipientTypeDetails = "UserMailbox"
        ADGroupsAndUsers = "F_Mitarbeiter","F_Archivierte Benutzer"
        ExcludeDisplayName = "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042"
    }

} | %{New-Object PSObject -Property $_}

# get domain name
$Domain = "$(((Get-ADDomain).Name).toupper())"

# get ad user objects
$Config.MailBoxFilter.ADGroupsAndUsers = $Config.MailBoxFilter.ADGroupsAndUsers | %{
    Get-ADObject -Filter {(Name -eq $_) -or (ObjectGUID -eq $_)} | %{
        if($_.ObjectClass -eq "user"){$_.DistinguishedName
        }elseif($_.ObjectClass -eq "group"){ Get-ADGroupMember $_.DistinguishedName -Recursive}
    } | Get-ADUser -Properties Mail
}

# create mail list to filter mailboxes
$Config.MailboxFilter.AllowedMails = $Config.MailBoxFilter.ADGroupsAndUsers | %{"$($_.Mail)"}

# create SamAccountName list to filter mailbox permissions
$Config.ADGroupFilter.AllowedUsers = $Config.MailboxFilter.ADGroupsAndUsers | %{"$($Domain + $_.SamAccountName)"}

# get exisiting mailbox permission ad groups
$ADGroups = Get-ADGroup -Filter * -SearchBase $Config.OU -Properties $Config.ADGroupMailboxReferenceAttribute | where{$_.Name.StartsWith($Config.ADGroupFilter.NamePrefix) -and $_.Name.Contains($Config.ADGroupFilter.NameInfix) -and $_.Name.EndsWith($Config.ADGroupFilter.NameSuffix)}

# sync mailbox access groups for each mailbox
$Mailboxes = Get-Mailbox | where{$_.RecipientTypeDetails -eq $Config.MailBoxFilter.RecipientTypeDetails -and $Config.MailboxFilter.AllowedMails -notcontains $_.PrimarySmtpAddress.tolower() -and $Config.MailBoxFilter.ExcludeDisplayName -notcontains $_.DisplayName}

$RequiredADGroups = $Mailboxes | %{

    # set variables
    $ADPermissionGroups = @()
    $Mailbox = $_

    Write-Host "Parsing permissions on mailbox: $($_.Alias)"

    # get existing permission groups
    $ADPermissionGroups = $ADGroups | where{(iex "`$_.$($Config.ADGroupMailboxReferenceAttribute)") -eq $Mailbox.Guid}
    $ADExistingPermissionGroupTypes = $ADPermissionGroups| where{$_} | %{$_.Name.split("#")[1]}

    # get existing and allowed mailbox permissions
    $MailboxPermissions = $Mailbox | Get-MailboxPermission | where{$Config.ADGroupFilter.AllowedUsers -contains $_.User}

    # create an ad group foreach permissiontype that is required
    $NewADPermissionGroupTypes = $MailboxPermissions | %{"$($_.AccessRights)".split(", ") | where{$_} | %{$_} | %{$_ | where{$ADExistingPermissionGroupTypes -notcontains $_}}}
    $NewADPermissionGroupTypes | Group | %{

        # create ad group name foreach permission type
        $Name = $config.ADGroup.NamePrefix + $Mailbox.Displayname + $Config.ADGroup.PermissionSeperator + $_.Name

        Write-PPEventLog -Message "Add service mailbox access group: $Name" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
        New-ADGroup -Name $Name -SamAccountName $Name -GroupCategory Security -GroupScope Global -DisplayName $Name  -Path $Config.OU -Description "Exchange Access Group for: $($Mailbox.Displayname)"
        Get-ADGroup $Name

    } | %{

        # set the reference from the adgroup to the mailbox
        iex "`$_.$($Config.ADGroupMailboxReferenceAttribute) = `"$($Mailbox.Guid)`""
        Set-ADGroup -Instance $_
        $ADGroup = $_

        # add existing members to the permission group
        $MailboxPermissions | where{$_.AccessRights -match $ADGroup.Name.split("#")[1]} | %{
            Add-ADGroupMember -Identity $ADGroup -Members ($_.User -replace "$Domain","")
        }

        # output ad permission groups
        $_
    }

    # check members foreach permission group
    $ADPermissionGroups | where{$_} | %{

        # get permission type
        $Permission = $_.Name.split("#")[1]

        # get existin ad user groups
        $ADPermissionGroupUsers = $_ | Get-ADGroupMember -Recursive | select @{L="User";E={$($Domain + $_.SamAccountName)}}
        $MailboxUsers =  $MailboxPermissions | where{$_.AccessRights -match $Permission} | select user

        # compare these groups and update members
        if($ADPermissionGroupUsers){
            $PermissionDiff = Compare-Object -ReferenceObject $ADPermissionGroupUsers -DifferenceObject $MailboxUsers -Property User

            # add member
            $PermissionDiff | where{$_.SideIndicator -eq "<="} | %{

                Write-PPEventLog -Message "Add mailbox permission: $Permission for user: $($_.User) on mailbox: $($Mailbox.Alias)" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
                Add-MailboxPermission -Identity $Mailbox.Alias -User $_.User -AccessRights $Permission
            }

            # remove member
            $PermissionDiff | where{$_.SideIndicator -eq "=>"} | %{

                Write-PPEventLog -Message "Remove mailbox permission: $Permission for user: $($_.User) on mailbox: $($Mailbox.Alias)" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
                Remove-MailboxPermission -Identity $Mailbox.Alias -User $_.User -AccessRights $Permission -Confirm:$false
            }
        }

        #output ad permission group to delete old ad permission groups
        $_
    }
}

$ADGroups | where{$RequiredADGroups -notcontains $_} | %{

    Write-PPEventLog -Message "Remove service mailbox access group: $Name" -Source "Synchronize Service Mailbox Access Groups" -WriteMessage
    Remove-ADGroup -Identity $_ -Confirm:$false
}

Remove-PSSession $PSSession
Write-PPErrorEventLog -Source "Synchronize Service Mailbox Access Groups" -ClearErrorVariable

Latest version of this script: https://gist.github.com/8653473

To run this script properly and use commands as Write-PPEventLog I recommend you to install my project PowerShell Profile.

Making Exchange Distribution Lists Externally Available

Tue, 12 Nov 2013 08:36:52 +0000

This might not be best practise but based on the situation you as administrator have to enable this feature.

Making distribution lists externally available is great for spammers, so if you enable this feature, do this as less as possible.

To enable a exchange distribution list for external use I recommand to use this simple PowerShell command:

Set-DistributionGroup <groupname> -RequireSenderAuthenticationEnabled $false

Archive ActiveDirectory Users and their Mailbox

Mon, 14 Oct 2013 17:04:19 +0000

One of my company’s requirements is the retention time of 10 years for user accounts and their mailbox data, I have to admit, this might not be common or even recommended. However I have to deal with it.

One problem to face is the availabilty of user account names, by the number of about 500 employees there’s a hight change that two or even more people are having the same name.

To clean up the available names in the system I’ve written a script that renames a users identity and the mailboxes address. So let’s see what this script does:

#--------------------------------------------------#
# settings
#--------------------------------------------------#
$ExchangeServer = "vblw2k8mail05"
$FilterRecipientTypeDetails = @("UserMailbox","RemoteUserMailbox")

#--------------------------------------------------#
# functions
#--------------------------------------------------#

function Rename-ADUserAndMailbox{

    param(
        [Parameter(Mandatory=$true)]
        $ADUser,

        [Parameter(Mandatory=$true)]
        $MailBox
    )

    $ArchivedIdentity = ($($ADUser.SID).tostring() -replace "-","").substring(20)

    if(-not (Get-ADUser -Filter{SamAccountName -eq $ArchivedIdentity} -ErrorAction SilentlyContinue)){

        $NewName = "$($ADUser.Name) $($ADUser.SID)"
        $NewUserPrincipalName =  "$($ADUser.UserPrincipalName.split('@')[0]) $($ADUser.SID)@$($ADUser.UserPrincipalName.split('@')[1])"
        $NewSamAccountName = ($($ADUser.SID).tostring() -replace "-","").substring(20)

        Write-Host "Rename Name $($ADUser.Name) to $NewName"
        Rename-ADObject $ADUser -NewName $NewName

        Write-Host "Rename UserPrincipalName $($ADUser.UserPrincipalName) to $NewUserPrincipalName"
        Get-ADUser $ADUser.SamAccountName | Set-ADUser -UserPrincipalName $NewUserPrincipalName -Description "archived"

        Write-Host "Rename SamAccountName $($ADUser.SamAccountName) to $NewSamAccountName"
        Get-ADUser $ADUser.SamAccountName | Set-ADUser -SamAccountName $NewSamAccountName

        $NewPrimarySmtpAddress = "$($ADUser.UserPrincipalName.split('@')[0])$($ADUser.SID)@$($ADUser.UserPrincipalName.split('@')[1])" -replace "-",""
        $OldPrimarySmtpAddress = $Mailbox.PrimarySmtpAddress

        if($Mailbox.psObject.TypeNames -contains "Deserialized.Microsoft.Exchange.Data.Directory.Management.RemoteMailbox"){

            $NewRemoteRoutingAddress = "$($Mailbox.RemoteRoutingAddress.split("@")[0])$($ADUser.SID)@$($Mailbox.RemoteRoutingAddress.split("@")[1])" -replace "-",""
            $OldRemoteRoutingAddress = $Mailbox.RemoteRoutingAddress

            Get-RemoteMailbox $ADuser.Name | %{

                Write-Host "Rename PrimarySmtpAddress for $($_.PrimarySmtpAddress) to $NewPrimarySmtpAddress"
                Set-RemoteMailbox $_.Alias -PrimarySmtpAddress $NewPrimarySmtpAddress;

                Write-Host "Rename RemoteRoutingAddress for $($_.RemoteRoutingAddress) to $NewRemoteRoutingAddress"
                Set-RemoteMailbox $_.Alias -RemoteRoutingAddress $NewRemoteRoutingAddress

                Write-Host "Remove default mail addresses $OldRemoteRoutingAddress, $PrimarySmtpAddress on $($_.Alias)"
                Set-RemoteMailbox $_.Alias -EmailAddresses @{remove = $OldRemoteRoutingAddress, $OldPrimarySmtpAddress}
            }

        }elseif($Mailbox.psObject.TypeNames -contains "Deserialized.Microsoft.Exchange.Data.Directory.Management.Mailbox"){

            Get-Mailbox $ADuser.Name | %{

                Write-Host "Rename PrimarySmtpAddress for $($_.PrimarySmtpAddress) to $NewPrimarySmtpAddress"
                Set-Mailbox $_.Alias -PrimarySmtpAddress $NewPrimarySmtpAddress

                Write-Host "Remove default mail addresses $PrimarySmtpAddress on $($Mailbox.Alias)"
                Set-Mailbox $_.Alias -EmailAddresses @{remove = $OldPrimarySmtpAddress}
            }
        }
    }
}

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

# open remote connection
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://$ExchangeServer/PowerShell/" -Authentication Kerberos

# import
Import-PSSession $PSSession -AllowClobber

$Mailboxes = Get-Mailbox
$RemoteMailboxes = Get-RemoteMailbox

# disable mailbox and remote mailbox
Get-ADUser -Filter{Enabled -eq $false} -Properties mail | where{$_.mail -ne $null} |
    %{$ADUser = $_; $Mailboxes | where{$_.Name -eq $ADuser.Name -and $_.HiddenFromAddressListsEnabled -eq $false -and $FilterRecipientTypeDetails -contains $_.RecipientTypeDetails}} |%{
        Write-host "Hide mailbox $($_.Name) from address lists.";
        Set-Mailbox $_.Name -HiddenFromAddressListsEnabled:$true;
        Rename-ADUserAndMailbox -ADUser $ADUser -MailBox $_
    }

# disable remote mailbox
Get-ADUser -Filter{Enabled -eq $false} -Properties mail | where{$_.mail -ne $null} |
    %{$ADUser = $_; $RemoteMailboxes | where{$_.Name -eq $ADuser.Name -and $_.HiddenFromAddressListsEnabled -eq $false -and $FilterRecipientTypeDetails -contains $_.RecipientTypeDetails}} | %{
        Write-host "Hide remotemailbox $($_.Name) from address lists.";
        Set-RemoteMailbox $_.Name -HiddenFromAddressListsEnabled:$true;
        Rename-ADUserAndMailbox -ADUser $ADUser -MailBox $_
}

# destroy pssession
Remove-PSSession $PSSession

if($error){
    Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
}

Latest version of this script: https://gist.github.com/6780143

As always I recommand you to install my project PowerShell Profile to run this script properly.

ExchangeOnline OWA Policies - Disable OWA light

Mon, 09 Sep 2013 09:11:32 +0000

To alter the Exchange owa policies you can access them Using the Office365 administration site and navigate to the Exchange section. In the default policy editor are only limited options available.

In case you would like f.e. disable the outlook wep app light (which is not available in the web editor), you have to use the almighty PowerShell console.


Get-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" | Set-OwaMailboxPolicy -OWALightEnabled $false

Manage ActiveDirectory Distribution Groups

Tue, 27 Aug 2013 12:39:11 +0000

With Office365 connected with an ADFS you have to redesgin your Exchange distribution groups. ADFS only syncs distribution groups that have these definitions:

My idea was simple, I’m developing a script that creates for every OU and child OU I’m chosing in the ActiveDirectory structure a distribution list containing the users of the chosen OU recursively.

While developing this I’ve added some cool features, in addition you can:

By default the script will only add enabled users with an email address.

This script makes use of the PowerShell Profile environment, f.e. the function Send-PPErrorReport sends an error report per email when the script fails or produces problems.

<#
$Metadata = @{
    Title = "New ActiveDirectory Distribution Groups"
    Filename = "New-ADDistributionGroups.ps1"
    Description = "Create or update ActiveDirectory distribution groups"
    Tags = "powershell, activedirectory, distribution, groups, create, update"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-27"
    LastEditDate = "2013-09-30"
    Url = "https://gist.github.com/6352037"
    Version = "1.1.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

# set OUs where the distributions groups should be enabled
$OUs = @(
    @{Name = "OU=Betrieb,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Direktion,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Finanzen,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Personal,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Technik,OU=vblusers2,DC=vbl,DC=ch"}
)

# list of users to exclude in distribution groups
$ExcludeUsers = "abascan","ba test","ba-service"

# list of distribution groups to exclude
$ExcludeOUs = "Verwaltungsrat"

# special configuration to handle special
$Configs = @(
    @{
        Name = "GL";
        Options = @("UpdateFromGroups");
        AddGroups = @("Geschäftsleitung Gruppe")
    },
    @{
        Name = "GL erw";
        Options = @("UpdateFromGroups");
        AddGroups = @("Erweiterte Geschäftsleitung Gruppe")
    },
    @{
        Name = "Alle";
        Options = @("UpdateFromGroups");
        AddGroups = @("Technik","Betrieb","Personal","Finanzen","GL","Kommunikation","Sekretariat")
    },
    @{
        Name = "Alle mit Arbeitsplatz";
        Options = @("UpdateFromGroups","RemoveGroups");
        AddGroups = @("Alle");
        RemoveGroups = @("SPO_365E1License")
    },
    @{
        Name = "Alle ohne Arbeitsplatz";
        Options = @("UpdateFromGroups");
        AddGroups = @("SPO_365E1License");
    },
    @{
        Name = "Fahrdienst A - Hermann M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Hermann M Gruppe");
    },
    @{
        Name = "Fahrdienst A - Segui M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Segui M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Nietlispach M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Nietlispach M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Zaugg D";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Zaugg D Gruppe");
    },
    @{
        Name = "Fahrdienst C - Habegger R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Habegger R Gruppe");
    },
    @{
        Name = "Fahrdienst C - Malbasic N";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Malbasic N Gruppe");
    },
    @{
        Name = "Fahrdienst D - Küchler P";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Küchler P Gruppe");
    },
    @{
        Name = "Fahrdienst D - Zimmermann L";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Zimmermann L Gruppe");
    },
    @{
        Name = "Fahrdienst E - Bechter K";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Bechter K Gruppe");
    },
    @{
        Name = "Fahrdienst E - Brunner R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Brunner R Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri René";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri René Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri Urs";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri Urs Gruppe");
    },
    @{
        Name = "Verkehrsdisponnenten";
        Options = @("UpdateFromGroups");
        AddGroups = @("F_Verkehrsdisponnenten");
    },
    @{
        Name = "Personalkommission";
        Options = @("UpdateFromGroups");
        AddGroups = @("Personalkommission Abteilung");
    }
)

# get all OUs recursive
$OUs = $OUs | %{Get-ADOrganizationalUnit -Filter "*" -SearchBase $_.Name} | where {-not ($ExcludeOUs -contains $_.Name)}

# check in every OU if a distribution group with the same name as the OU exist
$OUs | %{$OU = $_.DistinguishedName;
    if(Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"} | Where-Object{$_.DistinguishedName -like "*$OU"}){

        Write-Host "Update users in distribution group $($_.Name)."
        $ADGroup = Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"}
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $OU | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }else{

        Write-Host "Create distribution group $($_.Name)."
        New-ADGroup -Name $_.Name -SamAccountName $_.Name -GroupCategory Distribution -GroupScope Universal -DisplayName $_.Name -Path $($_.DistinguishedName) -Description "Distribution group for $($_.Name)."
        $ADGroup = Get-ADGroup $_.Name
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $_.DistinguishedName | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}
    }
}

# custom configuration
$Configs | %{

    $ADGroup = Get-ADGroup -Identity $_.Name
    $Config = $_

    if($_.Options -match "UpdateFromGroups"){

        Write-Host "Add users from $($Config.AddGroups) to $($ADGroup.Name)."
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        $Config.AddGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }

    if($_.Options -match "RemoveGroups"){

        Write-Host "Remove users from $($Config.RemoveGroups) in $($ADGroup.Name)."
        $ADGroupMembers = Get-ADGroupMember -Identity $ADGroup
        $Config.RemoveGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($ADGroupMembers -match $_) -and ($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique  | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}

    }
}

if($error){
    Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
}

Latest version of this script: https://gist.github.com/6352037

Exchange Update Offline Address Book

Tue, 27 Aug 2013 10:54:43 +0000

Since Exchange 2010 the graphical console doesn’t support the same functionality as the PowerShell Exchange console, it’s possible that there occur some exotic errors or a lack of functionality while working with the graphical console. I recommend to use only the Exchange PowerShell console for administrative work.

For example: I had to update the offline address book, I’ve deleted some distribution groups, updated the address list and the offline book, all with the graphical console. Result the address book still wasn’t up to date in the Outlook client after downloading the offline address book.

So I did the same thing with PowerShell:


Get-OfflineAddressbook | Update-OfflineAddressbook
Get-ClientAccessServer | Update-FileDistributionService

And hurray everything worked.

ExchangeOnline Region Presettings

Wed, 21 Aug 2013 15:37:23 +0000

This post is part of my Office365 experience. Today I’ve made a script to get startet with the ExchangeOnline PowerShell console.

Every time a user logged in for the first time into the Office365 Outlook webapp, he had to set his regional configuration.

Despite it’s not a lot of effort to change that, the timezone settings can be very confusing.

Running this script on random windows machine will open a ExchangeOnline PowerShell remote session and import them in your local session.

After the import it’s the local session pretends to be live on the ExchangeOnline server, your able to run every PowerShell Exchange CMDlet. Yeapeeee :)

try{

    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#

    $Language = "de-CH"
    $TimeZone = "W. Europe Standard Time"
    $DateFormat = "dd.MM.yyyy"

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    Import-Module ActiveDirectory

    $Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

    $s = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://ps.outlook.com/powershell `
    -Credential $(Get-Credential -Credential $Credential) `
    -Authentication Basic `
    -AllowRedirection
    Import-PSSession $s

    $ADUsers = Get-ADUser -Filter {Mail -like "*"} -Properties sn, telephoneNumber, title
    $Mailboxes = $(Get-Mailbox)

    foreach($Mailbox in $Mailboxes){

        Write-Progress -Activity "Update settings" -status $($Mailbox.Name) -percentComplete ([Int32](([Array]::IndexOf($Mailboxes, $Mailbox)/($Mailboxes.count))*100))

        Write-Host "Set mailbox language settings for $($Mailbox.Name)"

        Set-MailboxRegionalConfiguration $Mailbox.Alias -Language $Language -TimeZone $TimeZone -LocalizeDefaultFolderName -DateFormat $DateFormat

        Write-Host "Set signature for $($Mailbox.Name)"

        $ADUser = $ADUsers | where{$_.UserPrincipalName -eq $Mailbox.UserPrincipalName} | select -First 1

        # get phone number
        if($ADuser.telephoneNumber -eq $null){
            $telephoneNumber = "+41 41 369 65 65"
        }else{
            $telephoneNumber = $ADuser.telephoneNumber
        }

        $Html = get-Content -Path $(Get-ChildItem -Path $PStemplates.Path -Filter "vbl signature.html" -Recurse).FullName
        $Text = get-Content -Path $(Get-ChildItem -Path $PStemplates.Path -Filter "vbl signature.txt" -Recurse).FullName

        $Html = $Html -replace "%%Firstname%%",$ADUser.givenname `
            -replace "%%Lastname%%",$Aduser.sn `
            -replace "%%Title%%",$Aduser.title `
            -replace "%%PhoneNumber%%",$telephoneNumber `
            -replace "%%FaxNumber%%","041 369 65 00"

        $Text = $Text -replace "%%Firstname%%",$ADUser.givenname `
            -replace "%%Lastname%%",$Aduser.sn `
            -replace "%%Title%%",$Aduser.title `
            -replace "%%PhoneNumber%%",$telephoneNumber `
            -replace "%%FaxNumber%%","041 369 65 00"

        Set-MailboxMessageConfiguration -Identity $Mailbox.Alias -SignatureHtml $HTML -AutoAddSignature $true -SignatureText $TEXT

    }

    # delete pssession
    Remove-PSSession $s

}catch{

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}

https://gist.github.com/6294947