Office365 on Janik von Rotz

ADFS Login Customization

Fri, 18 Oct 2013 13:04:41 +0000

The purpose of this article is to show the intention and implemention of the most common modifications for the ADFS login page.

Out of the box the login form should look like this:

The f.e. is by default the page url, this can confuse the user, due they expect something like “your login” or “Office365 Login”.

To add a logo you simply edit the web.config file.


<!--
<add key=”logo” value=”logo.png” />
-->

This label is part of the page’s localization, that means you have to edit the language resource file.

The localization files are stored under App_GlobalResources there you’ll find one file for every language CommonResources.en.resx.

Edit the file of your language an replace the “hint” with you definition.

In the root folder of the login page in the folder MasterPages is a file named MasterPage.master. This file defines the look of the login page. To hide the title just comment this part out.

<!--
<div class="GroupLargeMargin">
<div class="TextSizeXLarge">
<asp:Label ID="STSLabel" runat"server"></asp:Label>
</div>
</div>
-->

With Office365 and ADFS it’s possible to login from the microsoft Office365 login page or via a smart link to get directly redirected to the ADFS login page.

The Office365 login page will process the username you enter and if it’s a on premise user you’ll get redirected to the ADFS login page. By default the ADFS login page doesn’t care about the username you’ve provided at the Office365 login page. To populate the username into the login field the ADFS page has be modified like this:

Process username from the url parameter.


public void Application_BeginRequest()
{


HttpRequest request = HttpContext.Current.Request;
HttpResponse response = HttpContext.Current.Response;

if ( !String.IsNullOrEmpty( request.Params["username"] ) )
{
     HttpCookie cookie = new HttpCookie( "Office365Username", request.Params["username"] );
     cookie.Expires = DateTime.UtcNow.AddMinutes( 10 );
     Response.Cookies.Add( cookie );
}

Add the username parameter to the username box.


using System;

Paste the following code:


using System.Web;

Find the following and set your cursor to the next line down:


protected void Page_Load( object sender, EventArgs e )
{

Paste the following code:


HttpCookie cookie = Context.Request.Cookies.Get( "Office365Username" );

if ( null != cookie && !String.IsNullOrEmpty( cookie.Value ) )
{
     UsernameTextBox.Text = cookie.Value;
     cookie.Expires = DateTime.UtcNow.AddDays( -1 );
     cookie.Value = "";
     Context.Response.Cookies.Add( cookie );
}

Save and Close FormsSignIn.aspx.cs

Manage access rights to the Office365 portal

Mon, 30 Sep 2013 14:24:08 +0000

In addition to my last script showing how to manage the user licenses in Office365 I’ve written a new script for assign, remove or replace the access rights in the office365 portal.

The script has the same structure as the license management script, feel free as always to copy and alter this script or asking me questions about it.

<#
$Metadata = @{
    Title = "Set Office365 User Rights"
    Filename = "Set-O365UserRights.ps1"
    Description = @"
Manage Office365 portal access rights with ActiveDirectory groups.
Assign Administration roles to the members of specified AD groups or by a users userprincipalname.
"@
    Tags = "powershell, activedirectory, office365, user, rights"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-13"
    LastEditDate = "2013-09-26"
    Url = "https://gist.github.com/janikvonrotz/6218401"
    Version = "3.0.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#

    $MsolRoleConfig = @{
        ADGroup = "S-1-5-21-1744926098-708661255-2033415169-37011" # O365F_Billing Administrator
        MsolRoleName = "Billing Administrator" # Get-MsolRole
    },
    @{
        User = "admin@vbluzern.onmicrosoft.com" # O365F_Billing Administrator
        MsolRoleName = "Company Administrator" # Get-MsolRole
    }

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    Import-Module MSOnline
    Import-Module MSOnlineExtended
    Import-Module ActiveDirectory

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # import credentials
    $Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

    # connect to office365
    Connect-MsolService -Credential $Credential

    $UserAndMsolRole = @(
        ($MsolRoleConfig | where{$_.ADGroup -ne $null} | %{$MsolRole = $_.MsolRoleName; $MsolRole = (Get-MsolRole | where{$_.Name -eq $MsolRole}); Get-ADGroupMember $_.ADGroup -Recursive |Get-ADUser | select UserPrincipalName, @{Name = "MsolRole"; Expression={$MsolRole}}}),
        ($MsolRoleConfig | where{$_.User -ne $null}| %{$MsolRole = $_.MsolRoleName; $_ | select @{L = "UserPrincipalName"; E = {$_.User}},@{L = "MsolRole"; E = {Get-MsolRole | where{$_.Name -eq $MsolRole}}}})
    )

    $MsolRoleMembers = Get-MsolRole | %{$MsolRole = $_; Get-MsolRoleMember -RoleObjectId $_.ObjectID -MemberObjectTypes User | where{$_.isLicensed} | select @{L = "UserPrincipalName"; E = {$_.EmailAddress}},@{L = "MsolRole"; E = {$MsolRole}}}

    (Get-MsolUser -All) | %{

        $MsolUser = $_
        $AlreadyAssigned = $MsolRoleMembers | where{$_.UserPrincipalName -eq $MsolUser.UserPrincipalName}
        $ToAssign = $UserAndMsolRole | where{$_.UserPrincipalName -eq $MsolUser.UserPrincipalName}

        if($AlreadyAssigned){

            if(($ToAssign) -and ($AlreadyAssigned.MsolRole.ObjectId -ne $ToAssign.MsolRole.ObjectId)){

                Write-Host "Replace role: $($AlreadyAssigned.MsolRole.Name) with: $($ToAssign.MsolRole.Name) for: $($MsolUser.UserPrincipalName)."
                Remove-MsolRoleMember -RoleMemberEmailAddress $MsolUser.UserPrincipalName -RoleMemberType User -RoleName $AlreadyAssigned.MsolRole.Name
                Add-MsolRoleMember -RoleMemberEmailAddress $MsolUser.UserPrincipalName -RoleMemberType User -RoleName $ToAssign.MsolRole.Name

            }elseif($ToAssign -eq $null){

                Write-Host "Remove role: $($AlreadyAssigned.MsolRole.Name) for: $($MsolUser.UserPrincipalName)."
                Remove-MsolRoleMember -RoleMemberEmailAddress $MsolUser.UserPrincipalName -RoleMemberType User -RoleName $AlreadyAssigned.MsolRole.Name

            }else{

                Write-Host "Role: $($AlreadyAssigned.MsolRole.Name) for: $($MsolUser.UserPrincipalName) is already assigned."

            }
        }elseif($ToAssign -and $MsolUser.IsLicensed){

            Write-Host "Assign role: $($ToAssign.MsolRole.Name) for: $($MsolUser.UserPrincipalName)."
            Add-MsolRoleMember -RoleMemberEmailAddress $MsolUser.UserPrincipalName -RoleMemberType User -RoleName $ToAssign.MsolRole.Name

        }elseif($ToAssign){

            throw "Not possible to assign role: $($ToAssign.MsolRole.Name) user: $($MsolUser.UserPrincipalName) has to be licensed."

        }
    }

}catch{

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}```

[https://gist.github.com/janikvonrotz/6763616](https://gist.github.com/janikvonrotz/6763616)

<h1>Requirements</h1>

<ul>
    <li><a href="https://codeberg.org/janikvonrotz/Powershell-Profile">Powershell-Profile</a></li>
    <li>Office365 with ADFS and DirSync</li>
</ul>

Handling user password change and expiration issues with Office365 and ADFS – Part 2

Mon, 23 Sep 2013 08:50:49 +0000

https://janikvonrotz.ch/2013/08/08/handling-user-password-change-and-expiration-issues-with-office365-and-adfs-part-1/

This is part two of my experience in handling the password change office365 architecture issue.

Last time I’ve built a simple script to notificate the users about the status of their passwords. In the mean time we (me and another employ of the “vbl Informatik”) built a simple website for the office365 users to change their password.

The whole project is now available on https://codeberg.org/janikvonrotz/ActiveDirectory-Password-Change

Checkout the instructions in the readme fileto set up the password change website.

If you have setup the website already I recommend you to include the site with a sharepoint webpart here’s an example:

Office365 ADFS Chrome Login fails

Tue, 10 Sep 2013 13:49:40 +0000

Today I experienced an exotic behaviour, a client couldn’t access his Office365 page due he wasn’t able to login on the ADFS authentication prompt.

After googling and binging (just kidding, NERD) I found a simple solution.

[caption id=“attachment_498” align=“aligncenter” width=“714”] To turn Extended Protection off, on the AD FS server, launch IIS Manager, then, on the left side tree view, access Sites -> Default Web Site -> adfs -> ls. Once you’ve selected the “/adfs/ls” folder, double-click the Authentication icon, then right-click Windows Authentication and select Advanced Settings… On the Advanced Settings dialog, choose Off for Extended Protection.[/caption]

Disabling the extended windows authentication protection solved this issue, but I have to admit I’m not quite sure about services depending on this settings, maybe you’ll experience some other errors related to the ADFS service.

ExchangeOnline OWA Policies - Disable OWA light

Mon, 09 Sep 2013 09:11:32 +0000

To alter the Exchange owa policies you can access them Using the Office365 administration site and navigate to the Exchange section. In the default policy editor are only limited options available.

In case you would like f.e. disable the outlook wep app light (which is not available in the web editor), you have to use the almighty PowerShell console.


Get-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" | Set-OwaMailboxPolicy -OWALightEnabled $false

Managed Metadata in SharePoint 2013/Office365

Wed, 04 Sep 2013 09:33:48 +0000

The Managed Metadata feature in SharePoint 2010/2013/Office365 enables a new way to manage your documents and other company related informations.

Yet most file systems store their files in an hierarchical structure, with SharePoint and the Managed Metadata Service you can setup a document management system.

To get into this Managed Metadata Service thing, I’ve found a great video.

Manage ActiveDirectory Distribution Groups

Tue, 27 Aug 2013 12:39:11 +0000

With Office365 connected with an ADFS you have to redesgin your Exchange distribution groups. ADFS only syncs distribution groups that have these definitions:

My idea was simple, I’m developing a script that creates for every OU and child OU I’m chosing in the ActiveDirectory structure a distribution list containing the users of the chosen OU recursively.

While developing this I’ve added some cool features, in addition you can:

By default the script will only add enabled users with an email address.

This script makes use of the PowerShell Profile environment, f.e. the function Send-PPErrorReport sends an error report per email when the script fails or produces problems.

<#
$Metadata = @{
    Title = "New ActiveDirectory Distribution Groups"
    Filename = "New-ADDistributionGroups.ps1"
    Description = "Create or update ActiveDirectory distribution groups"
    Tags = "powershell, activedirectory, distribution, groups, create, update"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-27"
    LastEditDate = "2013-09-30"
    Url = "https://gist.github.com/6352037"
    Version = "1.1.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

# set OUs where the distributions groups should be enabled
$OUs = @(
    @{Name = "OU=Betrieb,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Direktion,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Finanzen,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Personal,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Technik,OU=vblusers2,DC=vbl,DC=ch"}
)

# list of users to exclude in distribution groups
$ExcludeUsers = "abascan","ba test","ba-service"

# list of distribution groups to exclude
$ExcludeOUs = "Verwaltungsrat"

# special configuration to handle special
$Configs = @(
    @{
        Name = "GL";
        Options = @("UpdateFromGroups");
        AddGroups = @("Geschäftsleitung Gruppe")
    },
    @{
        Name = "GL erw";
        Options = @("UpdateFromGroups");
        AddGroups = @("Erweiterte Geschäftsleitung Gruppe")
    },
    @{
        Name = "Alle";
        Options = @("UpdateFromGroups");
        AddGroups = @("Technik","Betrieb","Personal","Finanzen","GL","Kommunikation","Sekretariat")
    },
    @{
        Name = "Alle mit Arbeitsplatz";
        Options = @("UpdateFromGroups","RemoveGroups");
        AddGroups = @("Alle");
        RemoveGroups = @("SPO_365E1License")
    },
    @{
        Name = "Alle ohne Arbeitsplatz";
        Options = @("UpdateFromGroups");
        AddGroups = @("SPO_365E1License");
    },
    @{
        Name = "Fahrdienst A - Hermann M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Hermann M Gruppe");
    },
    @{
        Name = "Fahrdienst A - Segui M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Segui M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Nietlispach M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Nietlispach M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Zaugg D";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Zaugg D Gruppe");
    },
    @{
        Name = "Fahrdienst C - Habegger R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Habegger R Gruppe");
    },
    @{
        Name = "Fahrdienst C - Malbasic N";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Malbasic N Gruppe");
    },
    @{
        Name = "Fahrdienst D - Küchler P";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Küchler P Gruppe");
    },
    @{
        Name = "Fahrdienst D - Zimmermann L";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Zimmermann L Gruppe");
    },
    @{
        Name = "Fahrdienst E - Bechter K";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Bechter K Gruppe");
    },
    @{
        Name = "Fahrdienst E - Brunner R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Brunner R Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri René";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri René Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri Urs";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri Urs Gruppe");
    },
    @{
        Name = "Verkehrsdisponnenten";
        Options = @("UpdateFromGroups");
        AddGroups = @("F_Verkehrsdisponnenten");
    },
    @{
        Name = "Personalkommission";
        Options = @("UpdateFromGroups");
        AddGroups = @("Personalkommission Abteilung");
    }
)

# get all OUs recursive
$OUs = $OUs | %{Get-ADOrganizationalUnit -Filter "*" -SearchBase $_.Name} | where {-not ($ExcludeOUs -contains $_.Name)}

# check in every OU if a distribution group with the same name as the OU exist
$OUs | %{$OU = $_.DistinguishedName;
    if(Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"} | Where-Object{$_.DistinguishedName -like "*$OU"}){

        Write-Host "Update users in distribution group $($_.Name)."
        $ADGroup = Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"}
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $OU | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }else{

        Write-Host "Create distribution group $($_.Name)."
        New-ADGroup -Name $_.Name -SamAccountName $_.Name -GroupCategory Distribution -GroupScope Universal -DisplayName $_.Name -Path $($_.DistinguishedName) -Description "Distribution group for $($_.Name)."
        $ADGroup = Get-ADGroup $_.Name
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $_.DistinguishedName | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}
    }
}

# custom configuration
$Configs | %{

    $ADGroup = Get-ADGroup -Identity $_.Name
    $Config = $_

    if($_.Options -match "UpdateFromGroups"){

        Write-Host "Add users from $($Config.AddGroups) to $($ADGroup.Name)."
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        $Config.AddGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }

    if($_.Options -match "RemoveGroups"){

        Write-Host "Remove users from $($Config.RemoveGroups) in $($ADGroup.Name)."
        $ADGroupMembers = Get-ADGroupMember -Identity $ADGroup
        $Config.RemoveGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($ADGroupMembers -match $_) -and ($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique  | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}

    }
}

if($error){
    Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
}

Latest version of this script: https://gist.github.com/6352037

Create a Office365 user license report

Fri, 23 Aug 2013 12:14:46 +0000

With over 350 users in the Office365 cloud as in my case it’s difficult being aware of which licenses I really need.

To help my out I’ve made an ActiveDirectory group which holds the allowed Office365 users. And with this PowerShell script I look up every Office365 user and his licenses and check if this users is allowed to use Office365.

#--------------------------------------------------#
# modules
#--------------------------------------------------#

Import-Module MSOnline
Import-Module MSOnlineExtended
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

# declaration
$Licenses = @()

# import credentials
$Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

# SID is SPO_365Users
Write-Host "Get allowed ActiveDirectory users"
$AllowADUsers = Get-ADGroupMember "S-1-5-21-1744926098-708661255-2033415169-36655" -Recursive | Get-ADUser | where {$_.enabled -eq $true} | select userprincipalname # SPO_365Users

# connect to office365
Connect-MsolService -Credential $Credential

Write-Host "Get Office365 users"
$MSOUsers = Get-MsolUser -All

Write-Host "Get ExchangeOnline mailboxes"
# import session
$s = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://ps.outlook.com/powershell `
    -Credential $(Get-Credential -Credential $Credential) `
    -Authentication Basic `
    -AllowRedirection
Import-PSSession $s

# get upn of every mailbox
$MSOMailboxes = Get-Mailbox | select UserPrincipalName

$MSOUsers | foreach{

    Write-Progress -Activity "Report licenses" -status $_.UserPrincipalName -percentComplete ([int]([array]::IndexOf(([array]$MSOUsers), $_)/([array]$MSOUsers).count*100))

    $UserPrincipleName = $_.UserPrincipalName

    $License = $_ | Select-Object -Property UserPrincipalName,
    @{ Name = "Package";
        Expression = {
            $_.Licenses | ForEach-Object{$_.AccountSkuId}
        }
    },
    @{ Name = "Licenses";
        Expression = {
            $_.Licenses | ForEach-Object{
                $_.ServiceStatus | Where-Object{$_.ProvisioningStatus -ne "Disabled"}
            } | ForEach-Object{
                $_.ServicePlan.ServiceName
            }
        }
    },
    @{ Name = "IsAllowedOffice365User";
        Expression = {
            if($AllowADUsers -match $UserPrincipleName){$true}else{$false}
        }
    },
    @{ Name = "HasMailboxInCloud";
        Expression = {
            if($MSOMailboxes -match $UserPrincipleName){$true}else{$false}
        }
    }

    $Licenses += $License
}

$Licenses | Out-GridView

if($error){

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}

Latest version of this snippet: https://gist.github.com/6317367

ExchangeOnline Region Presettings

Wed, 21 Aug 2013 15:37:23 +0000

This post is part of my Office365 experience. Today I’ve made a script to get startet with the ExchangeOnline PowerShell console.

Every time a user logged in for the first time into the Office365 Outlook webapp, he had to set his regional configuration.

Despite it’s not a lot of effort to change that, the timezone settings can be very confusing.

Running this script on random windows machine will open a ExchangeOnline PowerShell remote session and import them in your local session.

After the import it’s the local session pretends to be live on the ExchangeOnline server, your able to run every PowerShell Exchange CMDlet. Yeapeeee :)

try{

    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#

    $Language = "de-CH"
    $TimeZone = "W. Europe Standard Time"
    $DateFormat = "dd.MM.yyyy"

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    Import-Module ActiveDirectory

    $Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

    $s = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://ps.outlook.com/powershell `
    -Credential $(Get-Credential -Credential $Credential) `
    -Authentication Basic `
    -AllowRedirection
    Import-PSSession $s

    $ADUsers = Get-ADUser -Filter {Mail -like "*"} -Properties sn, telephoneNumber, title
    $Mailboxes = $(Get-Mailbox)

    foreach($Mailbox in $Mailboxes){

        Write-Progress -Activity "Update settings" -status $($Mailbox.Name) -percentComplete ([Int32](([Array]::IndexOf($Mailboxes, $Mailbox)/($Mailboxes.count))*100))

        Write-Host "Set mailbox language settings for $($Mailbox.Name)"

        Set-MailboxRegionalConfiguration $Mailbox.Alias -Language $Language -TimeZone $TimeZone -LocalizeDefaultFolderName -DateFormat $DateFormat

        Write-Host "Set signature for $($Mailbox.Name)"

        $ADUser = $ADUsers | where{$_.UserPrincipalName -eq $Mailbox.UserPrincipalName} | select -First 1

        # get phone number
        if($ADuser.telephoneNumber -eq $null){
            $telephoneNumber = "+41 41 369 65 65"
        }else{
            $telephoneNumber = $ADuser.telephoneNumber
        }

        $Html = get-Content -Path $(Get-ChildItem -Path $PStemplates.Path -Filter "vbl signature.html" -Recurse).FullName
        $Text = get-Content -Path $(Get-ChildItem -Path $PStemplates.Path -Filter "vbl signature.txt" -Recurse).FullName

        $Html = $Html -replace "%%Firstname%%",$ADUser.givenname `
            -replace "%%Lastname%%",$Aduser.sn `
            -replace "%%Title%%",$Aduser.title `
            -replace "%%PhoneNumber%%",$telephoneNumber `
            -replace "%%FaxNumber%%","041 369 65 00"

        $Text = $Text -replace "%%Firstname%%",$ADUser.givenname `
            -replace "%%Lastname%%",$Aduser.sn `
            -replace "%%Title%%",$Aduser.title `
            -replace "%%PhoneNumber%%",$telephoneNumber `
            -replace "%%FaxNumber%%","041 369 65 00"

        Set-MailboxMessageConfiguration -Identity $Mailbox.Alias -SignatureHtml $HTML -AutoAddSignature $true -SignatureText $TEXT

    }

    # delete pssession
    Remove-PSSession $s

}catch{

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}

https://gist.github.com/6294947

Office365 and ADFS: Activate licenses for users depending on AD group membership

Tue, 13 Aug 2013 07:48:44 +0000

On Office365 the users have to be licensed in order to get access to the Office365 application. I’ve developed a PowerShell script which add a license depending on the group membership in the ActiveDirectory.

<#
$Metadata = @{
    Title = "Set Office365 Licenses by ActiveDirectory Group Membership"
    Filename = "Set-O365UserLicensesByADGroup.ps1"
    Description = @"
Adding license to a Office365 user as long the user is in the correct ActiveDirectory group
or in the white list, the users is active, the user has a mailbox.
The script will remove inactive licenses or if necessary replace them.
"@
    Tags = "powershell, activedirectory, office365, user, license, activation"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-13"
    LastEditDate = "2013-09-30"
    Url = "https://gist.github.com/janikvonrotz/6218401"
    Version = "3.0.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# settings
#--------------------------------------------------#

$UsageLocation = "CH"

$WhiteList = @{
    UserPrincipalName = "admin@vbluzern.onmicrosoft.com"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.testoff368@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.test07@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.test@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.testoff367@vbl.ch"
    License = "vbluzern:STANDARDPACK"
}


$LicenseConfig = @{
    Name = "SharePoint Online Plan 1"
    License = "vbluzern:SHAREPOINTSTANDARD"
    ADGroupSID = "S-1-5-21-1744926098-708661255-2033415169-37562" # SPO_SharePointOnlinePlan1License
    Rule = ""
},
@{
    Name = "Enterprise Plan 1"
    License = "vbluzern:STANDARDPACK"
    ADGroupSID = "S-1-5-21-1744926098-708661255-2033415169-36657" # SPO_365E1License
    Rule = "MailBoxExistOnline"
}

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module MSOnline
Import-Module MSOnlineExtended
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

# import credentials
$Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

Write-Host "Get Office365 users"
# connect to office365
Connect-MsolService -Credential $Credential
$MsolUsers = Get-MsolUser -All

Write-Host "Get ExchangeOnline mailboxes"
# import session
$s = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://ps.outlook.com/powershell `
    -Credential $(Get-Credential -Credential $Credential) `
    -Authentication Basic `
    -AllowRedirection
$EOMailboxes = Invoke-Command -Session $s -ScriptBlock{Get-MailBox} | select UserPrincipalName | %{"$($_.UserPrincipalName)"}
# remove session"
Remove-PSSession $s

# combine users and their license
$LicenseAndUser = ($LicenseConfig |
    %{$License = $_ ; Get-ADGroupMember $_.ADGroupSID -Recursive | Get-ADUser | where{$_.Enabled -eq $true} |
    %{$_ | select UserPrincipalName, @{Name = "License"; Expression = {$License.License}}, @{Name = "Rule"; Expression = {$License.Rule}}}
    }) + ($WhiteList | select  @{Name = "UserPrincipalName"; Expression = {$_.UserPrincipalName}},
    @{Name = "License"; Expression = {$_.License}},
    @{Name = "Rule"; Expression = {""}})


foreach($User in $MsolUsers){

    # first check whitelist
    $Config = $LicenseAndUser | where{$_.UserPrincipalName -eq $User.UserPrincipalName}

    if(($Config) -and ((($Config.Rule -eq "MailBoxExistOnline") -and ($EOMailboxes -contains $User.UserPrincipalName)) -or ($Config.Rule -eq ""))){

        if($User.IsLicensed -and ($User.Licenses.AccountSkuId -ne $Config.License)){

            Write-Host "Replace Office365 license: $($User.Licenses.AccountSkuId) with: $($Config.License) for user: $($User.UserPrincipalName)"
            $User.Licenses | %{Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -RemoveLicenses $_.AccountSkuId}
            Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $Config.License

        }elseif($User.IsLicensed){

            Write-Host "User: $($User.UserPrincipalName) is already licensed with: $($Config.License)"

        }else{

            Write-Host "Set Office365 license: $($Config.License) for user: $($User.UserPrincipalName)"
            Set-MsolUser -UserPrincipalName $User.UserPrincipalName -UsageLocation $UsageLocation
            Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $Config.License

        }

    }else{

        if($User.IsLicensed){

            Write-Host "Remove Office365 license: $($User.Licenses.AccountSkuId) from user: $($User.UserPrincipalName)"
            $User.Licenses | %{Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -RemoveLicenses $_.AccountSkuId}

        }else{

            Write-Host "User: $($User.UserPrincipalName) is not allowed"

        }
    }
}

if($error){

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}

You’ll get your Office365AccountName with this Office365 command Get-MsolAccountSku

Link to the newest version of this script: https://gist.github.com/janikvonrotz/6218401

Office365 SharePoint Backup und Restore Facts by IOZ AG

Mon, 12 Aug 2013 13:33:30 +0000

In diesem Blogbeitrag schildern wir Ihnen die Fakten der Datensicherung Ihrer SharePoint Online Plattform:

SiteCollection

Papierkorb

via IOZ AG Blog.

Handling user password change and expiration issues with Office365 and ADFS - Part 1

Thu, 08 Aug 2013 14:41:37 +0000

Recently I’ve setup a Office365 Service with ADFS (Active Directory Federation Service) and a DirSync Server.

Sadly I forgot about a huge disadvantage in this architecture, due to using ADFS as an authentication provider, it’s not possible to change a users password. The communication form the local ActiveDirectory environment to the cloud based Office365 services is only one directional.

That’s why there are only 2 options yet to handle the user password change and expiration:

At this time option 1 is active in my environment and option 2 is my goal.

In this post series want to show you the solution I’ve developed.

Let’s start with password expiration. Because Office365 doesn’t handle password expiration, that’s why I have to use another channel to show the users on which date their passwords expire: Let’s do it with an bulk e-mail job.

This part isn’t a lot of effort. There are 2 requirements, one is a must and the other is optional:

Now the script:

<#
$Metadata = @{
	Title = "Send Password Expiration Reminder"
	Filename = "Send-PasswordExpirationReminder.ps1"
	Description = ""
	Tags = "powershell, script, jobs"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "http://.janikvonrotz.ch"
	CreateDate = "2013-08-08"
	LastEditDate = "2013-11-25"
	Version = "2.1.0"
	License = @'
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#    
    Import-Module ActiveDirectory
	
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#   
    $TriggerDays = 25, 10, 5, 1
    $SendLinkOnDays = 25,10, 5, 1
	$DaysBeforeDisablingUsersWithPasswordNeverExpires = 180
	$ADGroup = "S-1-5-21-1744926098-708661255-2033415169-36648" # Memberof GroupName should be "SPO_PasswordNotification"   
    
    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # get mail config         
    $Mail = Get-PPConfiguration $PSconfigs.Mail.Filter | %{$_.Content.Mail | where{$_.Name -eq "PasswordReminder"}} | select -first 1

    # get days until password expires
    $MaxDays = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days 
    if($MaxDays -le 0){throw "Domain 'MaximumPasswordAge' password policy is not configured."}

    # Set days when an email should be sent to inform the users
    $TriggerDays = 25, 10, 5, 1
    $SendLinkOnDays = 25,10, 5, 1

    foreach($TriggerDay in $TriggerDays){    
    
        # Memberof GroupName should be "SPO_PasswordNotification"       
        Get-ADGroupMember $ADGroup -Recursive | 
        Get-ADUser -Properties Enabled, lastLogonTimestamp, PasswordNeverExpires, PasswordLastSet, Mail, DisplayName |
        Select *, @{L = "PasswordExpires";E = { 
            if($_.PasswordNeverExpires){
                $DaysBeforeDisablingUsersWithPasswordNeverExpires - ((Get-Date) - ($_.PasswordLastSet)).Days
            }else{
                $MaxDays - ((Get-Date) - ($_.PasswordLastSet)).Days
            }
        }} |
        where{($_.Enabled -eq $true) -and ($_.PasswordExpires -eq $TriggerDay)} | %{ 
                              
            # set subject
            $Subject = "Passwort Erinnerung: $($_.DisplayName) ihr Passwort läuft in $($_.PasswordExpires) Tagen ab"
            
            $BodyFont = "font-size: 11pt; font-family: Calibri"
            
            # create mail message
            $Body = "<p style = ""$BodyFont"">Guten Tag $($_.DisplayName) <br/> <br/> Ihr Passwort läuft am $(Get-Date (Get-Date).AddDays($_.PasswordExpires) -Format D) ab.</b></p>"          
            if($SendLinkOnDays -contains $TriggerDay){            
                $Body += "<p style = ""$BodyFont"">Bitte ändern Sie das Passwort bevor es abläuft. Rufen Sie dazu die folgende Seite auf: <a href=""https://vbluzern.sharepoint.com/Support/_layouts/15/start.aspx#/SitePages/Passwortwechsel.aspx"" target=""_blank"">Link</a></p>"
            }
             $Body += "<p style = ""$BodyFont"">ACHTUNG! Dieses E-Mail wurde von einem unbeaufsichtigtem Konto verschickt, Antworten an den Sender dieser E-Mail werden nicht bearbeitet.</p>"

            # send mail
            Write-PPEventLog "$($MyInvocation.InvocationName)`n`nSend password reminder to $($_.Mail)" -WriteMessage -Source "Send Password Expiration Reminder" 
            Send-MailMessage -To $_.Mail -From $mail.FromAddress -Subject $Subject -Body $Body -SmtpServer $Mail.OutSmtpServer -BodyAsHtml -Priority High -Encoding ([System.Text.Encoding]::UTF8)
        
        }        
    }
   
}catch{

	Write-PPErrorEventLog -Source "Send Password Expiration Reminder" -ClearErrorVariable
}

https://gist.github.com/6184059

For the memberof Group I recommend to use the SID instead of the DN. I’ll show you how the get the SID:


PS C:Userssa-spadmin> (Get-QADGroup "SPO_PasswordNotification").Sid

  BinaryLength AccountDomainSid                                                               Value
  ------------ ----------------                                                               -----
			28 S-1-5-21-1744926098-708661255-2033415169                                       S-1-5-21-1744926098-708661255-2033415169-36648

PS C:Userssa-spadmin> Get-QADUser -MemberOf "S-1-5-21-1744926098-708661255-2033415169-36648"

Part two: https://janikvonrotz.ch/2013/09/23/handling-user-password-change-and-expiration-issues-withoffice365-and-adfs-part-2/