Powershell on Janik von Rotz

Find dead links in your markdown files

Mon, 11 Nov 2019 22:24:02 +0100

The markdown ecosystem is growing. Markdown has become an universal standard with various extensions. Software repositories, websites, documentation systems, all store their content in markdown. This blog is written in markdown as well.

Of course there are downsides to markdown. Portability comes at the cost of missing features. Thus you have to built them on your own. If you run a blog you probably reference tons of other stuff on the internet. Links that point to usefult resources or nowhere. I wanted to find out which links in my markdown documents are dead.

I ended up with this simple Powershell function:

function Test-MarkdownLinks([String]$Path){

    $unreachable = @()

    # Get markdown files recursively
    $files = Get-ChildItem -Path $path -Recurse -Include "*.md"

    $files | %{
        $fileName = $_.Name
        Write-Host "Analyzing $fileName"

        $urls = Select-String -Path $_  -Pattern "\[.+\]\((http.*?)\)" | %{$_.matches.Groups[1]} | Select 

        $urls | %{
            $url = $_.Value
            Write-Host "Requesting url $url"

            try {
                $request = Invoke-WebRequest -Uri $url
            } catch {
                Write-Error "Found dead url $url in $fileName"
                $unreachable += $url
            }
        }
    }

    # Output urls
    return $unreachable
}

$deadlinks = Test-MarkdownLinks -Path "/Users/janikvonrotz/awesome-powershell"

The function finds all markdown files recursively from a folder, regexes all http(s) urls and then runs a simple get request. If it fails the url is treated as dead. At the end of the process the function returns all dead urls.

Forward Windows event log entries to syslog server

Thu, 02 Nov 2017 12:41:37 +0000

Syslog is the defacto standard for sending log messages in an IP network. Instead of pulling log messages from a remote computer as you would do it in a windows environment, the log files are sent by remote computers to a central log repository. This way of managing log files has become the standard for Linux / Unix environments. As our IT systems tends to become hybrids, the questions arises how it possible to send syslog messages from a windows computer. In this post I will present you a simple approach.

In the scenario we want to forward all security related messages from the windows log to the syslog server using PowerShell. To do so 3 script files are required.

First we need a function to send the message. Use PowerShell Gallery - Send-SyslogMessage function from the Posh-SYSLOG module.

Second a function is required for writing local log files. This one is optional, but recommended. The Write-Log cmdlet has been presented in a previous post.

Third and last the script that is forwarding the windows log messages to our syslog server.

Send-SecurityEventsToPRTG.ps1

param(
    [String]$ServerName = "SYSLOG_HOSTNAME"
)

Import-Module (Join-Path $PSScriptRoot "Send-SyslogMessage.ps1")
Import-Module (Join-Path $PSScriptRoot "Write-Log.ps1")

$LogName = "security"
$EndTime = Get-Date
$StartTime = $EndTime.AddHours(-1)
$LogCycle = 10
$LogFilePath = Join-Path $PSScriptRoot "$(Get-Date -Format yyyy-M-dd) $($MyInvocation.MyCommand.Name).log"

try {

    Write-Warning "Delete log files older than $LogCycle days"
    Get-ChildItem -Path $PSScriptRoot | Where-Object {($Now - $_.LastWriteTime).Days -gt $LogCycle -and $_.extension -eq ".log"} | Remove-Item

    Write-Host "Crawl for log entries"
    $Events = Get-EventLog -LogName $LogName -After $StartTime -Before $EndTime
    
    $Message = "$($Events.length) events have been found in the $LogName log that are forwarded to the server $ServerName"
    Write-Host $Message
    Write-Log -Path $LogFilePath -Message $Message -Component $MyInvocation.MyCommand.Name -Type Info

    $Events | %{

        switch($_.EntryType) {
            "SuccessAudit" { [Syslog_Severity]$Severity = "Informational" }
        }

        Send-SyslogMessage -Server $ServerName -Message $_.Message -Severity $Severity -Facility ([Syslog_Facility]::logaudit) -Hostname $env:COMPUTERNAME -ApplicationName "EventLog" -Timestamp $_.TimeGenerated -MessageID $_.EventID
    }

} catch {

    Write-Error ($_ | Out-String)
    Write-Log -Path $LogFilePath -Message ($_ | Out-String) -Component $MyInvocation.MyCommand.Name -Type Error
}

This examples crawls the security log messages from the last hour and forwards each to the server. Yet only one severity type is supported, the switch statement can be extended easily with additional types. Success and failure of this script are logged locally. Below is screenshot of the log file using CMTrace.

The script is intended to run on an hourly schedule. In case the windows scheduler is used to execute the script make sure that the job runs with the highest privileges available. Otherwise the script won’t be able to read the security log.

PowerShell - Logging in CMTrace format

Thu, 26 Oct 2017 07:15:24 +0000

CMTrace is probably the first choice for a log viewer in a Microsoft environment. When working with System Center Configuration Manager there aren’t any alternatives available. In a recent scenario I had to write log files in the CMtrace format. There are already many cmdlets available to do so, however, most of them did not work well or were overengineered. There I’ve taken a look at the CMTrace format specs and wrote a PowerShell function to create compatible log files.

Write-Log.ps1

function Write-log {

    [CmdletBinding()]
    Param(
          [parameter(Mandatory=$true)]
          [String]$Path,

          [parameter(Mandatory=$true)]
          [String]$Message,

          [parameter(Mandatory=$true)]
          [String]$Component,

          [Parameter(Mandatory=$true)]
          [ValidateSet("Info", "Warning", "Error")]
          [String]$Type
    )

    switch ($Type) {
        "Info" { [int]$Type = 1 }
        "Warning" { [int]$Type = 2 }
        "Error" { [int]$Type = 3 }
    }

    # Create a log entry
    $Content = "<![LOG[$Message]LOG]!>" +`
        "<time=`"$(Get-Date -Format "HH:mm:ss.ffffff")`" " +`
        "date=`"$(Get-Date -Format "M-d-yyyy")`" " +`
        "component=`"$Component`" " +`
        "context=`"$([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)`" " +`
        "type=`"$Type`" " +`
        "thread=`"$([Threading.Thread]::CurrentThread.ManagedThreadId)`" " +`
        "file=`"`">"

    # Write the line to the log file
    Add-Content -Path $Path -Value $Content
}

No big matter, isn’t it? We want to see it in action. Here is an example script that cycles its log history and writes an error entry whenever the script throws an error.

Example.ps1

$LogCycle = 30
$LogFilePath = Join-Path $PSScriptRoot "$(Get-Date -Format yyyy-M-dd) $($MyInvocation.MyCommand.Name).log"

Write-Warning "Delete log files older than $LogCycle days"
Get-ChildItem -Path $PSScriptRoot | Where-Object {($Now - $_.LastWriteTime).Days -gt $LogCycle -and $_.extension -eq ".log"} | Remove-Item

try {

    throw "Something failed."

} catch {

    Write-Error ($_ | Out-String)
    Write-Log -Path $LogFilePath -Message ($_ | Out-String) -Component $MyInvocation.MyCommand.Name -Type Error
}

And finally the log entry opened in the CMTrace viewer:

Configuration Manager - Configure requirement rules for deployment types with PowerShell

Fri, 20 Oct 2017 09:49:46 +0000

Configuration Manager applications can be equipped with powerful requirement rules. For example an application must be installed only if there is enough disk space on the target device or only if the device is the users primary device. The second example is an important requirement rule when working with user device affinity. Configuring this kind of rule is done in a few seconds using the management console. However, scripting the rule with PowerShell is much more difficult. As of today the cmdlets provided by Microsoft for automating Configuration Manager assets do not support building requirement rules for deployment types. But as always there is a workaround. In my case I’ve decided to create an application template containing all requirement rules and copy specific rules from there to other applications.

Once the template requirement rules are created, they can be copied using the script below.

Copy-CMDeploymentTypeRule

$SiteCode = "SITECODE"
$ProviderMachineName = "FQDN" 
if((Get-Module ConfigurationManager) -eq $null) {
    Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
}
if((Get-PSDrive -Name $SiteCode -PSProvider CMSite -ErrorAction SilentlyContinue) -eq $null) {
    New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $ProviderMachineName
}
Set-Location "$($SiteCode):\"

$RuleName = "Primary device Equals True"
# use * for all rules
$SourceApplicationName = "Application Requirement Rules Template"
$DestApplicationName = "VLC (2.2.6)"
$DestDeploymentTypeIndex = 0

# get the applications
$SourceApplication = Get-CMApplication -Name $SourceApplicationName | ConvertTo-CMApplication
$DestApplication = Get-CMApplication -Name $DestApplicationName | ConvertTo-CMApplication

# get requirement rules from source application
$Requirements = $SourceApplication.DeploymentTypes[0].Requirements | Where-Object {$_.Name -match $RuleName}

# apply requirement rules
$Requirements | ForEach-Object {
    
    $RuleExists = $DestApplication.DeploymentTypes[$DestDeploymentTypeIndex].Requirements | Where-Object {$_.Name -match $RuleName}
    if($RuleExists) {

        Write-Warning "The rule `"$($_.Name)`" already exists in target application deployment type"

    } else{
        
        Write-Host "Apply rule `"$($_.Name)`" on target application deployment type"

        # create new rule ID
        $_.RuleID = "Rule_$( [guid]::NewGuid())"

        $DestApplication.DeploymentTypes[$DestDeploymentTypeIndex].Requirements.Add($_)
    }
}

# push changes
$CMApplication = ConvertFrom-CMApplication -Application $DestApplication
$CMApplication.Put()

The ConvertTo-CMApplication cmdlet converts CM application objects to SDK objects. Using SDK objects offers more options to configure a CM application.

Source: Technet - Deployment Type Requirement mit Powershell hinzufügen

SCCM 1702 increase client log size and retention

Tue, 17 Oct 2017 13:46:41 +0000

With additional steps in an image deployment task sequence the log files will grow quite big. By default the Configuration Manager client keeps a log history of 0 and a size limit of 2 MB for each log file. In result you’ll find yourself missing important details when trying to debug a failed operating system deployment. At some point the log files will be cut off. In order to increase the log size and retention, parameters must be configured in two places.

First we need to inject a SMSTS configuration file into the boot image to set the log parameters. To do so we use a simple PowerShell script.

Copy-SMSTSConfigToBootImage.ps1

$BootImageFile = "C:\Program Files\Microsoft Configuration Manager\OSD\boot\x64\boot.wim"
$Index = "1"
$SMSIniFile = "D:\SCCM\Scripts\SMSTS.ini"

Write-Host "Start updating boot image: " (Get-Date).ToString()

Write-Host "Create temporary directory..."
$MountFolder = Join-Path $env:TEMP (Get-Random)
New-Item -ItemType Directory -Path $MountFolder | Out-Null
Write-Host "Created temporary directory: " $MountFolder

Write-Host "Mounting Windows-Image..." $BootImageFile
Mount-WindowsImage -Path $MountFolder -ImagePath $BootImageFile -Index $Index

Write-Host "Copy SMSTS.ini file..."
Copy-Item $SMSIniFile (Join-Path $MountFolder "Windows")

Write-Host "Dismount-WindowsImage..."
Dismount-WindowsImage -Path $MountFolder -Save -CheckIntegrity

Write-Host "Remove temporary directory..."
Remove-Item $MountFolder -Force

Write-Host "Complete upating boot image:" (Get-Date).ToString()

The script mounts a specified boot image and copies the SMSTS.init configuration file.

SMSTS.ini

[Logging]
LOGLEVEL=0
LOGMAXSIZE=5242880
LOGMAXHISTORY=3
DEBUGLOGGING=1
ENABLELOGGING=True

Once WinPE is unloaded and the selected windows image is being installed, we need set those parameters again. Only this time it is a bit easier.

Locate the Setup Windows and Configuration Manager step in your task sequence and set the installation properties as showed below below:

CCMLOGMAXSIZE=5242880 CCMLOGLEVEL=0 CCMLOGMAXHISTORY=3

The CM client MSI will detect these parameters and write them to the registry at HKLM:\SOFTWARE\Microsoft\CCM\Logging\@Global.

If you want to make sure the SMSTS.ini file has been loaded before installing an OS, press F8 before selecting the task sequence (debug mode must be enabled). A command line pops up and you can navigate to X:\Windows\ where the configuration file is stored.

I hope this tutorial works for you, otherwise ask me at any time.

Get unlinked GPOs with PowerShell

Fri, 06 Oct 2017 10:06:49 +0000

In terms of IT compliance having valid GPOs is essential. They must be update to date and the GPO directory should be free of any unlinked GPOs. Retrieving a list of unlinked GPOs in the management console is impossible. With PowerShell it is quite easy.

Take this function for example:

Get-UnlinkedGPOs.ps1

function Get-UnlinkedGPOs {

    Import-Module GroupPolicy
    
    $Report = @() 
    $GPOs = Get-GPO -All
    $GPOs | ForEach-Object { 

        $GPO = $_

	    Write-Progress -Activity "Get GPO settings" -status "Analyze GPO: $($GPO.DisplayName)" -percentComplete ([int]([array]::IndexOf($GPOs, $GPO)/$GPOs.Count*100))
        
        $GPOReport = ([XML]$($GPO | Get-GPOReport -ReportType Xml)).GPO

        If(($GPOReport.LinksTo -eq $null) -or (-not ($GPOReport.LinksTo | Where-Object{$_.Enabled -eq $true}))){
            $Report += $GPO
        }
    }
     
    If ($Report.Count -eq 0) {
        Wirte-Warning "No unlinked GPOs found" 
    }else{ 
        return $Report
    }
}

Make sure the group policy PowerShell module is installed.

Once the function is available in your shell you can things like: Get-UnlinkedGPOs | Select DisplayName, GpoStatus | Sort-Object DisplayName | Format-Table

Remove provisioned appx packages from Windows image for operating system deployment

Mon, 18 Sep 2017 09:51:20 +0000

While preparing a Windows image for SCCM deployment I looked for a viable solution to remove Windows apps from the image. SCCM offers a lot options to execute this kind of action such as running a task sequence or install an application. But none of the options worked out for me. Either they were too complicated to configure or simply didn’t work as expected. Today I’ve found a script on TechNet seemed to a good solution. This script showed me how easy it is to mount a windows image and remove the app packages directory from it. However, the script was outdated and didn’t offer the option to remove only selected apps. That’s why I’ve created my own remix of the script.

Let’s have a look:

Remove-SelectedAppxPackagesFromWIM.ps1

$pathToWIM = "D:\SCCM\OSD\OSImages\Windows 10 Enterprise (x64).wim"
$index = "1"
$appList = @(
    "Windows.ContactSupport",
    "microsoft.windowscommunicationsapps",
    "Microsoft.SkypeApp",
    "Microsoft.ZuneVideo",
    "Microsoft.ZuneMusic",
    "Microsoft.XboxIdentityProvider",
    "Microsoft.XboxApp",
    "Microsoft.WindowsStore",
    "Microsoft.WindowsMaps",
    "Microsoft.StorePurchaseApp",
    "Microsoft.People",
    "Microsoft.OneConnect",
    "Microsoft.Office.OneNote",
    "Microsoft.MicrosoftSolitaireCollection",
    "Microsoft.MicrosoftOfficeHub",
    "Microsoft.Messaging",
    "Microsoft.Getstarted",
    "Microsoft.DesktopAppInstaller",
    "Microsoft.BingWeather",
    "Microsoft.3DBuilder"
)
<#
"Microsoft.MicrosoftEdge"
#>

Write-Host "Start:" (Get-Date).ToString()

Write-Host "Create temporary directory..."
$pathMountFolder = Join-Path $env:TEMP (Get-Random)
New-Item -ItemType Directory -Path $pathMountFolder

Write-Host "Mounting Windows-Image..." $pathToWIM
Mount-WindowsImage -Path $pathMountFolder -ImagePath $pathToWIM -Index $index

Write-Host "Remove the built-in apps:"
$Apps = Get-AppxProvisionedPackage -Path $pathMountFolder | ForEach-Object {

    if($appList -contains $_.displayName) {

        Write-Host "Delete:" $_.DisplayName
        Remove-AppxProvisionedPackage -Path $pathMountFolder -PackageName $_.PackageName

    } else {

        Write-Host $_.DisplayName "is not in app list or already removed"
    }    
}

Write-Host "Dismount-WindowsImage..."
Dismount-WindowsImage -Path $pathMountFolder  -Save -CheckIntegrity

Write-Host "Remove temporary directory..."
Remove-Item $pathMountFolder -Force

Write-Host "Complete:" (Get-Date).ToString()

First, the script creates a temporary folder and mounts the windows image. Next, app packages from a predefined list are removed. Finally, the image is dismounted and the temporary folder deleted.

Manage the life cycle of your SCCM applications with PowerShell - Part 4 Remove Applications

Tue, 05 Sep 2017 08:32:11 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve shown you a script to distribute application content and deploy an application to its collections. In my final post I’ll show you the last part of the app life cycle - the termination.

Like the last script this one is also fairly simple. Provide the name of the application you would like to remove and the script is going to remove all assets related and the application itself. For security measures the script asks for confirmation before removing anything.

Remove-CMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
Import-Module ActiveDirectory
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$ApplicationName = "Visual Studio Code (1.15.1)" 
# use * for all applications

Get-CMApplication | Where-Object{ $_.LocalizedDisplayName -like $ApplicationName } | ForEach-Object {
    $Name = $_.LocalizedDisplayName
    $DeviceCollectionName = $Name + " Devices"
    $UserCollectionName = $Name + " Users"
    $ADGroupName = "DL_CM_$Name"
    
    Write-Host "`nStart removal of application $Name`n"

    $answer = Read-Host "Do you really want to remove the application $($Name)? (y/n)"

    if($answer -eq "y") {

        Write-Host "Remove application deployments."
        Get-CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) } | Remove-CMApplicationDeployment -Force

        Write-Host "Remove application package."
        Get-CMApplication -Name $Name | Remove-CMApplication -Force

        Write-Host "Remove AD group."
        Remove-ADGroup $ADGroupName -Confirm:$false

        Write-Host "Remove device and user collections"
        Remove-CMUserCollection -Name $UserCollectionName -Force
        Remove-CMDeviceCollection -Name $DeviceCollectionName -Force
    }
}

The only asset which is not removed is the application folder.

PowerShell nowadays is essential when administrating Microsoft products. In the long run there probably will be Microsoft products which can only configured properly using PowerShell cmdlets (see latest Exchange server). The Support for Configuration Manager is flawless, everything done in the management console can be done using PowerShell commands.

Manage the life cycle of your SCCM applications with PowerShell - Part 3 Deploy Applications

Fri, 01 Sep 2017 09:00:58 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve shown you a script that creates applications and all assets required to deploy it. This time I have a script to distribute the application content and deploy the application to its collections.

The script is fairly simple. It cycles through the applications catalog and checks whether they already have been distributed or deployed to its collection, if not it does so.

Deploy-CMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$ApplicationName = "CM Console (1.0.0)" 
# use * for all applications
$Action = "Install"
# use Install or Uninstall
$Purpose = "Required"
# use Available or Required

$DistributionPointName = "sccm.domain.net"
$CMApplicationDeployment = Get-CMApplicationDeployment
Get-CMApplication | Where-Object{ $_.LocalizedDisplayName -like $ApplicationName } | ForEach-Object {
    $Name = $_.LocalizedDisplayName
    $DeviceCollectionName = "$Name Devices"
    $UserCollectionName = "$Name Users"

    Write-Host "`nDistribute and deploy application $Name`n"

    try {
        Start-CMContentDistribution -ApplicationName $Name -DistributionPointName $DistributionPointName
        Write-Host "Content distributed"
    } catch {
        Write-Warning "Content has already been distributed."
    }

    $UserCollectionDeployment = $CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) -and ($_.CollectionName -eq $UserCollectionName)}
    if(-not $UserCollectionDeployment) {
        Write-Host "Deploy to user collection."
        $UserCollectionDeployment = New-CMApplicationDeployment -Name $Name -CollectionName $UserCollectionName -DeployAction $Action -DeployPurpose $Purpose
    } else {
        Write-Warning "Application has already been distributed to the user collection."
    }

    $DeviceCollectionDeployment = $CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) -and ($_.CollectionName -eq $DeviceCollectionName)}
    if(-not $DeviceCollectionDeployment) {
        Write-Host "Deploy to device collection."
        $DeviceCollectionDeployment = New-CMApplicationDeployment -Name $Name -CollectionName $DeviceCollectionName -DeployAction $Action -DeployPurpose $Purpose
    } else {
        Write-Warning "Application has already been distributed to the device collection."
    }
}

The next post of this series is already the last post. Stay calm!

Manage the life cycle of your SCCM applications with PowerShell - Part 2 Create Applications

Tue, 29 Aug 2017 15:07:47 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve showed you a script that creates the package source folder structure and another that adds the service users for SCCM. As mentioned these scripts have only been published for a better understanding of the follow-up scripts.

This time I would like to present you the script that adds new applications to the SCCM catalog. Here are the main features of the script:

Populates the folder structure for the registered applications.
Creates a user and device collection for each application.
Supports MSI, Executables and Scripted Installers.
Configures deployment types for each application.
Maps collections with an AD security group.
Add application supersedence if configured.

The script uses a config file. In there all information are stored required to create an application. Let’s have a look:

AppConfigs.ps1

$AppConfigs = @{
    Name = "7-Zip"
    Description = "7-Zip ist ein freies Datenkompressionsprogramm mit einer hohen Kompressionsrate."
    Version = "17.00 beta"
    Category = "File Manager"
    Company = "7-Zip"
    Publisher = "Igor Pavlov"
    Url = "http://www.7-zip.de/"
    Deploy = @{
        Type = "msi"
        Install = "7z1700-x64.msi"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
    }
    Update = @{
        Supersedes = "7-Zip (16.04)"
        IsUninstall = $true
    }
},
@{
    Name = "CM Console"
    Description = "System Center Configuration Manager Console."
    Version = "1.0.0"
    Category = "Configuration Manager"
    Company = "Microsoft"
    Publisher = "Microsoft"
    Url = "https://www.microsoft.com/en-us/cloud-platform/system-center-configuration-manager"
    Deploy = @{
        Type = "script"
        Install = 'ConsoleSetup.exe /q TargetDir="C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole" EnableSQM=1 DefaultSiteServerName=sccm.domain.net'
        Uninstall = 'ConsoleSetup.exe /q TargetDir="C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole" /uninstall'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\Microsoft.ConfigurationManagement.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "7-Zip"
    Description = "7-Zip ist ein freies Datenkompressionsprogramm mit einer hohen Kompressionsrate."
    Version = "16.04"
    Category = "File Manager"
    Company = "7-Zip"
    Publisher = "Igor Pavlov"
    Url = "http://www.7-zip.de/"
    Deploy = @{
        Type = "msi"
        Install = "7z1604-x64.msi"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
    }
},
@{
    Name = "VLC Script"
    Description = "VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols."
    Version = "2.2.6"
    Category = "Video Player"
    Company = "VideoLAN"
    Publisher = "VideoLAN Organization"
    Url = "https://www.videolan.org/"
    Deploy = @{
        Type = "powershell"
        Install = "powershell.exe -ExecutionPolicy Bypass -File .\Application.ps1 -Install"
        Uninstall = "powershell.exe -ExecutionPolicy Bypass -File .\Application.ps1 -Uninstall"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "VLC"
    Description = "VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols."
    Version = "2.2.6"
    Category = "Video Player"
    Company = "VideoLAN"
    Publisher = "VideoLAN Organization"
    Url = "https://www.videolan.org/"
    Deploy = @{
        Type = "script"
        Install = "vlc-2.2.6-win32.exe /S"
        Uninstall = '"C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe" /S'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "Greenshot"
    Description = "Greenshot is the most awesome tool for making screenshots you can get on your Windows PC."
    Version = "1.2.9.129"
    Category = "Utility"
    Company = "Greenshot"
    Publisher = "Jens Klingen"
    Url = "http://getgreenshot.org/"
    Deploy = @{
        Type = "script"
        Install = 'Greenshot-INSTALLER-1.2.9.129-RELEASE.exe /VERYSILENT /NORESTART'
        Uninstall = '"C:\Program Files\Greenshot\unins000.exe" /VERYSILENT /NORESTART'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files\Greenshot\Greenshot.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
}

As you cans see the config supports different kind of deployment types (script, msi, powershell) and supersedence. When it comes to deployment types, the script can be extended easily.

The config file is used by the script to create and configure the applications.

Add-SCCMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
Import-Module ActiveDirectory
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$CM_OU = "OU=SCCM,OU=AccessGroups,OU=Admin,DC=go4ksow,DC=net"
$PackageSource = "D:\SCCM\Applications\"
$HostName = "sccm"
. "$PSScriptRoot\AppConfigs.ps1"

$Domain = Get-ADDomain
$CMApplications = Get-CMApplication
$CMCategories = Get-CMCategory -CategoryType AppCategories
$CMDeviceCollections = Get-CMDeviceCollection
$CMUserCollections = Get-CMUserCollection

$AppConfigs | ForEach-Object {
    $AppConfig = $_
    $AppConfig.AppName = $AppConfig.Name + " (" + $AppConfig.Version + ")"
    $ContentLocation = "\\$HostName\PackageSource\Applications\$($AppConfig.Company)\$($AppConfig.Name)\$($AppConfig.Version)"
    $ADGroupName = "DL_CM_$($AppConfig.AppName)"
    $DeviceCollectionName =  $AppConfig.AppName + " Devices"
    $UserCollectionName =  $AppConfig.AppName + " Users"

    Write-Host "`nAdd CM Application $($AppConfig.AppName)`n"

    $App = $CMApplications | Where-Object{ $_.LocalizedDisplayName -eq $AppConfig.AppName}
    if(-not $App) {
        Write-Host "Create the application: $($AppConfig.AppName)."
        $IconLocationFile = Join-Path $PackageSource "icon.jpg"
        $App = New-CMApplication -Name $AppConfig.AppName `
            -LocalizedDescription $AppConfig.Description `
            -SoftwareVersion $AppConfig.Version `
            -Publisher $AppConfig.Publisher `
            -LinkText $AppConfig.Url `
            -IconLocationFile $IconLocationFile
    } else {
        Write-Warning "Application: $($AppConfig.AppName) already exists."
    }

    $Category = $CMCategories | Where-Object{ $_.LocalizedCategoryInstanceName -eq $AppConfig.Category }
    if(-not $Category) {
        Write-Host "Create the application category: $($AppConfig.Category)."
        $Category = New-CMCategory -CategoryType AppCategories -Name $AppConfig.Category
    } else {
        Write-Warning "Category: $($AppConfig.Category) already exists."
    }

    $CategoryIsSet = $null
    $CategoryIsSet = $App.LocalizedCategoryInstanceNames[0] -eq $Category.LocalizedCategoryInstanceName
    if(-not $CategoryIsSet) {
        Write-Host "Set application category."
        $App | Set-CMApplication -AppCategory $Category.LocalizedCategoryInstanceName
    } else {
        Write-Warning "Application category is already set."
    }

    $Path = $null
    $Path = (Join-Path $PackageSource $AppConfig.Company)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create company application folder."
        New-Item -Path $Path -ItemType Directory | Out-Null
    }
    $Path = (Join-Path $Path $AppConfig.Name)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create application folder."
        New-Item -Path $Path  -ItemType Directory | Out-Null
    }
    $Path = (Join-Path $Path $AppConfig.Version)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create application version folder."
        New-Item -Path $Path  -ItemType Directory | Out-Null
    }

    $ADGroup = $null
    $ADGroup = Get-ADGroup $ADGroupName
    if(-not $ADGroup){
        Write-Host "Add AD group: $ADGroupName."
        $ADGroup = New-ADGroup -Name $ADGroupName -GroupScope DomainLocal -Path $CM_OU
    } else {
        Write-Warning "AD group: $ADGroupName already exists."
    }

    if($AppConfig.Deploy.type -eq "script") {

        $deployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add script deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ScriptText = $AppConfig.Deploy.DetectionScript
                ScriptLanguage = "PowerShell"
                ContentLocation = $ContentLocation
                InstallCommand = $AppConfig.Deploy.Install
                UninstallCommand = $AppConfig.Deploy.Uninstall
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
                ForceScriptDetection32Bit = $true
            }
           $DeployType = Add-CMScriptDeploymentType @param
        } else {
            Write-Warning "Script deployment type already exists."
        }
    }

    if($AppConfig.Deploy.type -eq "msi") {

        $DeployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add default deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ContentLocation = Join-path $ContentLocation $AppConfig.Deploy.Install
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
                Force = $true  
            }
            $DeployType = Add-CMMsiDeploymentType @param
        } else {
            Write-Warning "Script deployment type already exists."
        }
    }

    if($AppConfig.Deploy.type -eq "powershell") {

        $deployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add powershell deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ScriptText = $AppConfig.Deploy.DetectionScript
                ScriptLanguage = "PowerShell"
                ContentLocation = $ContentLocation
                InstallCommand = $AppConfig.Deploy.Install
                UninstallCommand = $AppConfig.Deploy.Uninstall
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
            }
           $DeployType = Add-CMScriptDeploymentType @param
        } else {
            Write-Warning "Powershell deployment type already exists."
        }

        $ScriptPath = Join-Path $Path "Application.ps1"
        if(-not (Test-Path $ScriptPath)) {
            Write-Host "Add powershell deployment script."
            @'
Param(
  [switch]$Install,
  [switch]$Uninstall
)

if($Install) {
    Start-Process -FilePath ".\vlc-2.2.6-win32.exe" -ArgumentList "/S" -Wait
}

if($Uninstall) {
    Start-Process -FilePath "C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe" -ArgumentList "/S" -Wait
}
'@ | Set-Content -Path $ScriptPath
        } else {
            Write-Warning "PowerShell deployment script already exists."
        }
    }

    $LimitingCollection = $CMDeviceCollections | Where-Object{ $_.Name -eq "All Systems" }
    $DeviceCollection = $CMDeviceCollections | Where-Object{ $_.Name -eq $DeviceCollectionName }
    if(-not $DeviceCollection) {
        Write-Host "Create the device collection."
        $DeviceCollection = New-CMDeviceCollection -Name $DeviceCollectionName -LimitingCollectionId $LimitingCollection.CollectionID -RefreshType 4 -Comment "Application Collection"
    } else {
        Write-Warning "Device collection already exists."
    }

    $QueryRule = 'select *  from  SMS_R_System where SMS_R_System.SecurityGroupName = "' + $Domain.Name + '\\' + $ADGroup.Name + '"'
    $Rule = Get-CMDeviceCollectionQueryMembershipRule -Name $DeviceCollectionName
    if(-not $Rule -and $ADGroup) {
        Write-Host "Add device collection membership rule."
        Add-CMDeviceCollectionQueryMembershipRule -CollectionName $DeviceCollectionName -RuleName "Active Directory Membership" -QueryExpression $QueryRule
    } elseif(-not $ADGroup) {
        Write-Warning "Could not create device colleciton membership rule as AD groups does not exist."
    } else {
        Write-Warning "Device collection membership rule already exists."
    }

    $LimitingCollection = $null
    $LimitingCollection = $CMUserCollections | Where-Object{ $_.Name -eq "All Users" }
    $UserCollection = $CMUserCollections | Where-Object{ $_.Name -eq $UserCollectionName }
    if(-not $UserCollection) {
        Write-Host "Create the user collection."
        $UserCollection = New-CMUserCollection -Name $UserCollectionName -LimitingCollectionId $LimitingCollection.CollectionID -RefreshType 4 -Comment "Application Collection"
    } else {
        Write-Warning "User collection already exists."
    }

    $QueryRule = $null
    $QueryRule = 'select *  from  SMS_R_User where SMS_R_User.SecurityGroupName = "' + $Domain.Name + '\\' + $ADGroup.Name + '"'
    $Rule = $null
    $Rule = Get-CMUserCollectionQueryMembershipRule -Name $UserCollectionName
    if(-not $Rule -and $ADGroup) {
        Write-Host "Add user collection membership rule."
        Add-CMUserCollectionQueryMembershipRule -CollectionName $UserCollectionName -RuleName "Active Directory Membership" -QueryExpression $QueryRule
    } elseif(-not $ADGroup) {
        Write-Warning "Could not create user colleciton membership rule as AD groups does not exist."
    } else {
        Write-Warning "User collection membership rule already exists."
    }

    if($AppConfig.Update) {
        if(-not $App.IsSuperseding) {
            Write-Host "Add application supersedence for $($AppConfig.Update.Supersedes)."
            $SupersedingDeploymentType = Get-CMDeploymentType -DeploymentTypeName $AppConfig.AppName -ApplicationName $AppConfig.AppName
            $SupersededDeploymentType = Get-CMDeploymentType -DeploymentTypeName $AppConfig.Update.Supersedes -ApplicationName $AppConfig.Update.Supersedes
            $DeploymentTypeSupersedence = Add-CMDeploymentTypeSupersedence -SupersedingDeploymentType $SupersedingDeploymentType -SupersededDeploymentType $SupersededDeploymentType -IsUninstall:$AppConfig.Update.IsUninstall
        } else {
             Write-Warning "This application already supersedes another application."
        }
    }
}

The script creates all assets required to deploy an application and reduces the probability of misconfiguration drastically. Here’s a screenshot of the assets for the VLC player package:

The application package has PowerShell deployment type. Instead of an exectable a PowerShell is called to install the Application. Using a script allows to make additional configurations before and after the installation or uinstallation of the package.

In my next post I will share the script for deploying the created applications. Stay focused!

Manage the life cycle of your SCCM applications with PowerShell - Part 1 Service Accounts and Package Source

Tue, 29 Aug 2017 12:19:29 +0000

I’m currently planning and building a System Center Configuration Manager (SCCM) infrastructure for a local hospital. SCCM is a complex system composed of various components to make the client and software life cycle management feasible. While configuring SCCM is a tedious job which is done once, managing applications is a recurring process. That’s why the application life cycle is the perfect candidate for scripted automation. With the most recent SCCM release Microsoft made it a lot easier to use the power of PowerShell. I’ve developed a few scripts which help creating, deploying and deleting SCCM applications. Configuring applications manually can be very bothersome and is always at risk for misconfiguration. The benefit for automation is huge.

In my first post of this series I want to show you how I’ve scripted the service users and package source share for SCCM. It’s not necessary that you run these scripts in your installation. I share them for a better understanding of the follow-up script. Furthermore, this posts intends to be a template for admins who are not sure how to configure their SCCM installation.

Separation of concerns is an important key principal of Microsoft products. That’s why SCCM requires a lot of service users in order to run the system. Based on their guidelines I’ve written a script to create the necessary required accounts. Let’s have a look:

Create-CMServiceAccounts.ps1

Import-Module ActiveDirectory
Import-Module PowerUp

$OU = "OU=ServiceAccounts,OU=Admin,DC=example,DC=net"
$Domain = "example.net"
$Users = @(
    @{
        DisplayName = "SCCM Site"
        Name = "sccm_site"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the sccm primary site and its roles."
    }
     @{
        DisplayName = "SCCM Active Directory Discovery"
        Name = "sccm_discovery"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Discovers users, groups and system in the Active Directory."
    }
    @{
        DisplayName = "SCCM Active Directory Forest"
        Name = "sccm_forest"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Discovers Active Directory forests and publishes information in the system container."
    }
    @{
        DisplayName = "SCCM Proxy Access"
        Name = "sccm_proxy"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Connects site roles with the proxy server."
    }
    @{
        DisplayName = "SCCM Capture OSI"
        Name = "sccm_captureosi"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Stores the captured operating system images."
    }
    @{
        DisplayName = "SCCM Client Push"
        Name = "sccm_clientpush"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Installs the sccm client on existing windows clients."
    }
    @{
        DisplayName = "SCCM Exchange Connection"
        Name = "sccm_exchange"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Conencts the site with the Exchange server."
    }
    @{
        DisplayName = "SCCM Reporting Service"
        Name = "sccm_report"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the SCCM reporting service."
    }
    @{
        DisplayName = "SCCM Domain Join"
        Name = "sccm_domainjoin"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Joins systems during the installation to the domain."
    }
    @{
        DisplayName = "SCCM SQL Service"
        Name = "sccm_sql"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the SQL server."
    }
    @{
        DisplayName = "SCCM Network Access"
        Name = "sccm_network"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Accesses the packages source and loads files required for installation and deployment."
    }
    @{
        DisplayName = "SCCM WSUS"
        Name = "sccm_wsus"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Connects the site with the WSUS server."
    }
)

$Users | ForEach-Object {
    Write-Host "Create AD Service Account: $($_.Name) with Password: $($_.Password)"
    New-ADUser -Name $_.DisplayName -DisplayName $_.DisplayName -AccountPassword (ConvertTo-SecureString -AsPlainText $_.Password -Force) -Enabled $true -Path $OU -CannotChangePassword $_.CannotChangePassword -ChangePasswordAtLogon $_.ChangePasswordAtLogon -PasswordNeverExpires $_.PasswordNeverExpires -SamAccountName $_.Name -UserPrincipalName "$($_.Name)@$Domain" -Description $_.Description
}

As you can see the script requires two PowerShell modules. One ist the default Active Directory module and the other is the PowerUp module, which has been published by me. The PowerUp module is only required for the Get-RandomPassword function and can easily be ditched for something else, such as a static password list.

These service accounts must be configured in the SCCM console and will be granted different access rights on the package source share. The package source share is the folder structure where you store all the files required by SCCM to deploy operating systems and applications. Let’s check out the script to build the folder structure:

Create-CMPackageSourceShare.ps1

# set the parameters
$Source = "D:\SCCM"
$ShareName = "PackageSource"
$NetworkAccount = "domain.net\sccm_network"
$SiteAccount = "domain.net\sccm_site"
$SystemAccount = "NT AUTHORITY\SYSTEM"
$LocalServiceAccount = "LOCALSERVICE"
$CaputreOSIAccount = "domain.net\sccm_captureosi"

# create the source directory
New-Item -ItemType Directory -Path "$Source"

# Application
New-Item -ItemType Directory -Path "$Source\Applications"
New-Item -ItemType Directory -Path "$Source\Applications\Adobe"
New-Item -ItemType Directory -Path "$Source\Applications\Citrix"
New-Item -ItemType Directory -Path "$Source\Applications\Microsoft"
New-Item -ItemType Directory -Path "$Source\Applications\Microsoft\Office 2016"

# App-V
New-Item -ItemType Directory -Path "$Source\App-V"
New-Item -ItemType Directory -Path "$Source\App-V\Packages"
New-Item -ItemType Directory -Path "$Source\App-V\Source"

# Device Applications
New-Item -ItemType Directory -Path "$Source\DeviceApplications"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450\x86"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450\x64"

# Import
New-Item -ItemType Directory -Path "$Source\Import"
New-Item -ItemType Directory -Path "$Source\Import\Baselines"
New-Item -ItemType Directory -Path "$Source\Import\MOFs"
New-Item -ItemType Directory -Path "$Source\Import\Task Sequences"

# Logs
New-Item -ItemType Directory -Path "$Source\Logs"
New-Item -ItemType Directory -Path "$Source\Logs\MDTLogs"
New-Item -ItemType Directory -Path "$Source\Logs\MDTLogsDL"

# Operating System Deployment
New-Item -ItemType Directory -Path "$Source\OSD"
New-Item -ItemType Directory -Path "$Source\OSD\BootImages"
New-Item -ItemType Directory -Path "$Source\OSD\Captures"
New-Item -ItemType Directory -Path "$Source\OSD\MDTSettings"
New-Item -ItemType Directory -Path "$Source\OSD\MDTToolkit"
New-Item -ItemType Directory -Path "$Source\OSD\OSImages"
New-Item -ItemType Directory -Path "$Source\OSD\OSInstall"
New-Item -ItemType Directory -Path "$Source\OSD\Prestart"
New-Item -ItemType Directory -Path "$Source\OSD\USMT"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages\HP"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP\Probook 450\Realtek Ethernet Controller Drivers"

# Script
New-Item -ItemType Directory -Path "$Source\Scripts"

# Tools
New-Item -ItemType Directory -Path "$Source\Tools"
New-Item -ItemType Directory -Path "$Source\Tools\PSTools"

# Windows Updates
New-Item -ItemType Directory -Path "$Source\WindowsUpdates"
New-Item -ItemType Directory -Path "$Source\WindowsUpdates\Office 2016"
New-Item -ItemType Directory -Path "$Source\WindowsUpdates\Windows 10"

# WSUS
New-Item -ItemType Directory -Path "$Source\WSUS"

# create the share
New-SmbShare -Name "$ShareName" -Path "$Source" -CachingMode None -ReadAccess Everyone -FullAccess $SiteAccount, $SystemAccount
# Get-SmbShare | where{$_.Name -eq "PackageSource"} | Remove-SmbShare

# set security permissions
$Acl = Get-Acl "$Source\Logs"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($NetworkAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\Logs" $Acl

$Acl = Get-Acl "$Source\OSD\Captures"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($CaputreOSIAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\OSD\Captures" $Acl

$Acl = Get-Acl "$Source\StateCapture"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($LocalServiceAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\StateCapture" $Acl

Of course you do not need all of these folders. Adjust the script according to your requirements and preferences.

Here’s a short explanation for each folder:

Application
This where the application installation files are stored.
Applications\[Vendor]\[Product]\[Version]

App-V
Source folder for App-V applications.
App-V\[Packages,Source]

Device Applications
Vendor specific applicatios, that are applied when deploying an image.
DeviceApplications\[Vendor]\[Product]\[Architecture]

Import
Going to import data into the SCCM database? Put them here.
Import\[Type]

Logs
Store important SCCM log files here.
Logs\[Type]

Operating System Deployment
Everything related for deploying os images.
OSD\[BootImages,Captures,MDTSettings,MDTToolkit,OSImages,OSInstall,Prestart]
Put driver files and source packages into these folders.
OSD\[DriverPackages,DriverSources]\[Vendor]\[Product and Version]\[Driver Type]

Script
PowerShell scripts for SCCM configurations.
Script

Tools
Any SCCM related tool.
Tools\[Type]

Windows Updates
Source folder for the software update deployment packages.
WindowsUpdates\[Product]

WSUS
This is the WSUS data folder.
WSUS

In the next post I will share the script to create new applications. Stay tuned!

XKCD PowerShell password generator

Fri, 11 Aug 2017 13:04:45 +0000

Through 20 ears of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

If you are a Hacker News binge reader such as me, you might have read this article: The Guy Who Invented Those Annoying Password Rules Now Regrets Wasting Your Time.

This article reminded my of how stupid current password guidelines are and that we need to change that. A few months ago I wrote a random password generator function and decided that it needs an update to make the generated passwords more memorable.

Inspiration for the new random password was the following XKCD comic:

So instead of using any kind of character for the password, simply put four random words together. To create this kind of password we need a word list with common nouns. I’ve created a german and english word list for you to download:

wordlist.de.txt wordlist.en.txt

Get-XKCDPassword.ps1

And here is the PowerShell function:

function Get-XKCDPassword {

    Param(
        [int]$words = 4,

        [string]$delimiter = "-",

        [ValidateSet("en","de")] 
        [string]$lang = "en",

        [switch]$FirstLetterUpperCase  
    )
    
    $password = ""
    $wordlist = @{
        de = "/wp-content/uploads/2017/08/wordlist.de_.txt"
        en = "/wp-content/uploads/2017/08/wordlist.en_.txt"
    }
    
    switch($words) {
        {$_ -ge 6 } { throw "Word parameter cannot be greater or equal 6." }
        5 { $range = (3,4) }
        4 { $range = (4,5) }
        3 { $range = (5,6) }
        2 { $range = (7,8) }
        {$_ -le 1 } { throw "Word parameter cannot be less or equal 1." }
    }

    $list = (((Invoke-WebRequest $wordlist[$lang]).Content -split "`n" | ForEach-Object{ 
        New-Object PSObject -Property @{
            Value = $_.ToLower()
            Length=$_.length
        }
    }) | Where-Object { ($_.Length -eq ($range[0] + 1)) -or ($_.Length -eq ($range[1] + 1)) })

    1..$words | ForEach-Object {
        $part =  (Get-Random $list).Value.Trim()

        if($FirstLetterUpperCase ) {
             $password += ((Get-Culture).TextInfo).ToTitleCase($part)
        } else {
            $password += $part
        }

        if($_ -lt $words){ 
            $password += $delimiter 
        }
    }

    return $password
}

Get-XKCDPassword -words 4 -delimiter "-" -lang "de" -FirstLetterUpperCase

Here are some results:

bite-bomb-pupil-basis
crime-wedge-alley-roll
side-filly-bloom-fairy
read-tribe-mouth-jail
knot-make-child-moth

And a few more in german:

Seite-Sorge-Saft-Nadel
Fluss-Glas-Alter-Rand
Nord-Maul-Wert-Nabel
Sand-Schal-Anruf-Rand
Sahne-Post-Name-Park

Create a PowerShell module and publish it to the Gallery in under 1 minute

Wed, 09 Aug 2017 11:26:58 +0000

This tutorial is basically a script that creates a PowerShell module and publishes it to the PowerShell Gallery. Another scripts tells you how to install the published module and make us of it.

Make sure that you either have PowerShell 5.0 installed or the PowerShellGet module installed and imported.

CreateAndPublish-PowerShellModule.ps1

# Go to the modules directory

Set-Location "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\"

# Create the module folder

if (!(Test-Path "./PowerUp")) {
    New-Item -ItemType Directory -Path "./PowerUp"
}

# Create the module

@'
function Get-RandomPassword {
    
    $numbers = 1..9
    $consonants = "b","c","d","f","g","h","k","l","m","n","p","r","s","t","v","w","x","z"
    $nopeletters = "j","q","y"
    $vocals = "a","e","i","o","u"
    $dotsandstuff = ",",".","-"
    $nopedotsandstuff = ";",":","_"

    return (Get-Random $consonants).ToString().ToUpper() + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $vocals) + 
    (Get-Random $numbers) +  
    (Get-Random $numbers) + 
    (Get-Random $numbers) + 
    (Get-Random $dotsandstuff)
}
'@ | Set-Content -Path "./PowerUp/PowerUp.psm1"

# Create the module manifest

New-ModuleManifest "./PowerUp/PowerUp.psd1" -RootModule "PowerUp" -FunctionsToExport Get-RandomPassword -ModuleVersion "1.0.0" -Author "Janik von Rotz" -Description "A collection of useful PowerShell functions."

# Test the module manifest

Test-ModuleManifest .\PowerUp\PowerUp.psd1

# Create an account at https://www.powershellgallery.com and copy the api key from your profile settings.

# Publish the module to the gallery

Publish-Module -Name PowerUp -NuGetApiKey API_KEY

InstallAndImport-PowerShellModule.ps1

# On another computer install the module from the gallery

Install-Module -Name PowerUp

# Import the module

Import-Module PowerUp

# Run the module function

Get-RandomPassword

Deploy PowerShell ActiveDirectory Module without installing the remote server tools

Wed, 09 Sep 2015 16:23:17 +0000

Make use of the PowerShell ActiveDirectory module always required to install the Remote Server Administration Tools. That sucks! We want it as simple as executing a script.

Let’s build a PowerShell script that adds the ActiveDirectory Powershell module on any computer.

For this setup we require one file and one folder (with its content).

The file is: Microsoft.ActiveDirectory.Management.dll (it’s stored somwhere here: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ActiveDirectory.Management)
And the folder is: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory

Ironically you’ll find these files on a computer where the Remote Server Administration Tools are installed.

Now create folder structure as below and place the files inside:

…/yourfolder/
- ActiveDirectory/
  - Place the folder files here
- Microsoft.ActiveDirectory.Management.dll
- Install-ActiveDirectoryModule.ps1

Then update the Install-ActiveDirectoryModule.ps1 file with the content below:

function Add-AssemblyToGlobalAssemblyCache{

    <#
    .SYNOPSIS 
	    Installing Assemblies to Global Assembly Cache (GAC)

    .DESCRIPTION 
	    This script is an alternative to the GACUTIL available in 
	    the .NET Framework SDK. It will put the specified assembly
	    in the GAC.

    .EXAMPLE
        Add-AssemblyToGlobalAssemblyCache -AssemblyName C:\Temp\MyWorkflow.dll
    
        This command will install the file MyWorkflow.dll from the C:\Temp directory in the GAC.

    .EXAMPLE
        Dir C:\MyWorkflowAssemblies | % {$_.Fullname} | Add-AssemblyToGlobalAssemblyCache
    
        You can also pass the assembly filenames through the pipeline making it easy
        to install several assemblies in one run. The command abobe  will install 
        all assemblies from the directory C:\MyWorkflowAssemblies, run this command

    .PARAMETER AssemblyName
	    Full path of the assembly file

    .PARAMETER PassThru
        If set, script will pass the filename given through the pipeline    

    .NOTES 
	    April 18, 2012 | Soren Granfeldt (soren@granfeldt.dk) 
		    - initial version

    .LINK 
        http://blog.goverco.com
    #>

    PARAM
    (
	    [Parameter(Mandatory=$true, ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)]
	    [ValidateNotNullOrEmpty()]
	    [string] $Name = "",

	    [switch]$PassThru
    )
 
	if ($null -eq ([AppDomain]::CurrentDomain.GetAssemblies() |? { $_.FullName -eq "System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" })){
		[System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a") | Out-Null
	}
	$PublishObject = New-Object System.EnterpriseServices.Internal.Publish
           
	foreach($Assembly in $Name){

        if ( -not (Test-Path $Assembly -type Leaf)){
            throw "The assembly '$Assembly' does not exist."
        }

        $LoadedAssembly = [System.Reflection.Assembly]::LoadFile($Assembly)

        if ($LoadedAssembly.GetName().GetPublicKey().Length -eq 0){
            throw "The assembly '$Assembly' must be strongly signed."
        }
          
        Write-Host "Installing: $Assembly"
        $PublishObject.GacInstall($Assembly)

        if($PassThru){$_}
    }
}

$moduledirectory = "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory"
$basepath = Split-Path -parent $MyInvocation.MyCommand.Definition

if(-not (Test-Path -Path $moduledirectory)){
    New-Item -Path $moduledirectory -ItemType directory | Out-Null
}

Copy-Item -Path (Join-Path $basepath "\ActiveDirectory\*") -Destination $moduledirectory -Recurse -Force

Add-AssemblyToGlobalAssemblyCache -Name (Join-Path $basepath "Microsoft.ActiveDirectory.Management.dll")

Got it! When executing the Install-ActiveDirectoryModule.ps1 on another computer it should install the PowerShell ActiveDirectory module.

Password Generator with PowerShell

Mon, 07 Sep 2015 15:03:41 +0000

Whenever I had to think of a secure password I followed these steps:

The right order of vocals and consonants makes it more easy to remember a password.
And so do three digits of a number.
Add one uppercase Letter. Likely as the first character.
Add a dot or another sign to expand to vocabulary even more.

As I’am using a PowerShell a lot I’ve created the function/script below to create such a password.

function Get-RandomPasswort{
    
    $numbers = 1..9
    $consonants = "b","c","d","f","g","h","k","l","m","n","p","r","s","t","v","w","x","z"
    $nopeletters = "j","q","y"
    $vocals = "a","e","i","o","u"
    $dotsandstuff = ",",".","-"
    $nopedotsandstuff = ";",":","_"

    return (Get-Random $consonants).ToString().ToUpper() + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $numbers) +  
    (Get-Random $numbers) + 
    (Get-Random $numbers) + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $vocals) + 
    (Get-Random $dotsandstuff)
}

Get the lastest version of this snippet here: https://gist.github.com/f437d7764a43b9de6c3a

Example

Create 10 new password is easily done.

1..10 | %{Get-RandomPasswort}
Zov683oxa.
Pev541imi-
Pim276ovo-
Vus211ixi.
Dab998inu.
Dup268awi.
Det893ema.
Xok762axa-
Lun996azu,
Gal196ere.

Compare Active Directory group membership

Fri, 31 Jul 2015 07:21:26 +0000

The following scripts allows you to compare the group membership of two users.

Import-Module ActiveDirectory

$user1 = "userRef"
$user2 = "userDif"

$members1 = Get-ADPrincipalGroupMembership -Identity $user1 | Select-Object name
$members2 = Get-ADPrincipalGroupMembership -Identity $user2 | Select-Object name

$result = Compare-Object -ReferenceObject $members1 -DifferenceObject $members2 -Property name

Write-Host "`n$user1 is member of these groups in addition:" -ForegroundColor Black -BackgroundColor Yellow

$result | Where-Object{$_.SideIndicator -eq "<="} | ForEach-Object{$_.name}

Write-Host "`n$user2 is member of these goups in addition:" -ForegroundColor Black -BackgroundColor Yellow

$result | Where-Object{$_.SideIndicator -eq "=>"} | ForEach-Object{$_.name}

Get the latest version of this script here: https://gist.github.com/051099188f24894502c1

Convert Directory Tree to Json with PowerShell

Tue, 28 Jul 2015 15:07:23 +0000

Today I wrote a simple script that converts a directory tree query with get-childitem into a json formatted data tree.

function Add-Tabstops{
    param($Count)
    $tabs = ""
    for($i=0; $i -lt $Count; $i++){$tabs += "  "}
    return $tabs
}

function Output-JsonChildren{
    param($Path, $Level = 1)
    return $(Get-ChildItem -Path $Path | Where-Object{$_} | ForEach-Object{
        (Add-Tabstops $Level) +
        "{`n" + 
        (Add-Tabstops ($Level+1)) +
        "`"name`"`: `"$($_.Name)`"," + 
        "`n" +
        (Add-Tabstops ($Level+1)) + 
        "`"children`": ["+ 
        $(if($_.psiscontainer){"`n" + (Output-JsonChildren -Path $_.FullName -Level ($Level+2))+ "`n" + (Add-Tabstops ($Level+1))}) +
        "]`n" + 
        (Add-Tabstops ($Level)) +
        "}"
    }) -join ",`n"
}

$JSON = Output-JsonChildren -Path "C:\Documents"

"["
$JSON
"]"

Find the latest version of this script here: https://gist.github.com/7c9e9ea0acd77c965b79

The output looks something like this:

[
  {
    "name": "Administration",
    "children": [
      {
        "name": "Organisation",
        "children": [
          {
            "name": "Available Abrevations.md",
            "children": []
          },
          {
            "name": "Kürzel Gemeinde und Organisationen.md",
            "children": []
          }
        ]
      },

PowerShell awesome list introduction

Mon, 01 Jun 2015 06:47:40 +0000

Awesome lists are a great thing on GitHub. It’s about collecting useful resources, packages and modules of a certain technology or subject. It’s the best way of introduction if you have to learn about a new technology. Here’s a good example of a awesome Node.js list by Sindre Sorhus aka the inventor of bower, grunt and many other web tech.

I thought it would be a good idea to do the same for PowerShell. Maybe you’ve got some inputs for me, simply post them in the comment section or make fork of the Awesome PowerShell repository and commit your inputs directly.

So here’s what I’ve got so far:

Awesome PowerShell

A curated list of delightful PowerShell packages and resources.

Inspired by the awesome list thing.

Modules

IDE

PowerGui - Powerfull IDE to execute scripts local and remote.
PowerShell Plus - An all in one IDE.

Package Managers

PsGet - Set of commands to install modules from central directory, local file or from the web.

Security

File System Security - Allows a much easier management of permissions on files and folders.

Frameworks

Carbon - DevOps for automating the configuration of Windows computers.
PowerShell PowerUp - A powerfull server management framework.
PSCX - Useful set of additional cmdlets

SharePoint

Client-side SharePoint - API for SharePoint 2010, 2013 and Online.
AutoSPInstaller - Automated SharePoint 2010/2013 installation script.

Webserver

PoSH Server - Secure, flexible and lightweight web server to meet your requirements.

Resources

Blogs

Hey, Scripting Guy! Blog - Popular Microsoft blog.
Learn Powershell | Achieve More - Personal blog of Boe Prox aka the Scripting Guy.
PowerShellMagazine - Awesome magazine.

ILIAS Synchronising Tool

Fri, 17 Oct 2014 18:27:19 +0000

My university Hochschule Luzern uses ILIAS as an open source e-learning and content management platform.

The main part of the publishing process for ILIAS looks like this: The lectureres publish their content (presentations, scripts, software, ..) to ILIAS and the students download it afterwards. It is possible to set up a notification for related changes. However the students still have to copy the files to the local computer manually.

To make this a bit easier, I’ve developed a synchronisation tool with PowerShell. It consists of four script files:

HSLUDriveConfig.ps1 Cofiguration file for WebDAV mount and sync task.

Mount-Drives.ps1 Mount the ILIAS directories of your choice to a local drive letter automatically.

Sync-Drives.ps1 Start the synchronisation task.

Dismount-Drives.ps1 Dismount the local ILIAS drives.

You can download the latest versions of these files here: https://gist.github.com/janikvonrotz/67e36431069bcc778262

To mount and sync your ILIAS directory follow the steps:

Customize the config file. Add your username, update the paths, names and letters and choice which folders you want to sync.
open your PowerShell console by looking for “PowerShell” in your windows search.
Execute this command on the console: Set-ExecutionPolicy Unrestricted
Now close PowerShell and double click the Mount script. It should mount your ILIAS drives now.
If everything went well, run the synchronisation script now. Every sync task should ask for confirmation. It was very important for me that I know what’s new in the directory and wether there’s conflict with an existing file or not.

Hopefully everything works fine, no guarantee. Always backup your data before syncing!

PowerShell PowerUp Package Manager

Fri, 16 May 2014 15:04:37 +0000

PowerShell PowerUp has now a built-in package manager.

Here’s a short example for a Notepad++ installation:

The main features of the package manager:

Offline package definitions
Multiple version management
Upgrade and downgrade definitions
Dependency installation
Full transparency of the install scripts
Simple, adaptable and dynamic package configurations

SharePoint PowerShell remoting double hop scenario

Wed, 30 Apr 2014 08:34:14 +0000

PowerShell remoting can be difficult to understand. There are many things to configure and unknown limitations. With multiple server to access from one remoting session it gets even more difficult.

For example my latest issue with a three tier SharePoint environment. I thought I configured everything correctly:

The user of the remote machine is administrator of the SharePoint machines.
The user of the remote machine is farm administrator.
The user of the remote machine is db_owner and shell_access on the SharePoint config database.
Both environments with remote PowerShell enabled.
The user of the remote machine is allowed to login on the remote machine.

However I still received an error when I’ve executed a SharePoint cmdlet via remoting session.

$Session = New-PSSession -ComputerName <ComputerName> -Credential (Get-Credential)
Invoke-Command -Session $Session -ScriptBlock {param ($Name) Add-PSSnapin -Name $Name} -ArgumentList "Microsoft.SharePoint.PowerShell"
Invoke-Command -Session $Session -ScriptBlock {Get-SPSite}

Cannot access the local farm. Verify that the local farm is properly configured, currently available, and that you
have the appropriate permissions to access the database before trying again.
    + CategoryInfo          : InvalidData: (Microsoft.Share...SPCmdletGetSite:SPCmdletGetSite) [Get-SPSite], SPCmdletE
   xception
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletGetSite

I’ve figuered that’s about the PowerShell remoting double hop issue. The remote SharePoint server can’t authenticate against the SQL server with the credentials I’m providing from the remoting shell.

This is only possible with the CredSSP authentication type. Here are the steps to configure CredSSP for a remote session.

On the server run:

Enable-WSManCredSSP -Role Server

On the client run:

Enable-WSManCredSSP -Role Client -DelegateComputer <server FQDN>

Now you should be able to run the SharePoint cmdlets on the client. Don’t forget to provide the new authentication type for the New-PSSession command.

$Session = New-PSSession -ComputerName <ComputerName> -Credential (Get-Credential) -Authentication Credssp
Invoke-Command -Session $Session -ScriptBlock {param ($Name) Add-PSSnapin -Name $Name} -ArgumentList "Microsoft.SharePoint.PowerShell"
Invoke-Command -Session $Session -ScriptBlock {Get-SPSite}

Backup Active Directory Group Policies with PowerShell

Tue, 22 Apr 2014 08:02:13 +0000

Based on my last Active Directory backup script I’ve developed a similar script to backup all group policies.

What it does:

Create a daily full snapshot of all group policy objects
Keep a daily, weekly and monthly snapshot
Notify me if something failed (requires PowerShell PowerUp)

<#
$Metadata = @{
    Title = "Backup Active Directory Group Policies"
    Filename = "Backup-ADGroupPolicies.ps1"
    Description = ""
    Tags = "backup, active, directory, group, object, policy"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2014-04-22"
    LastEditDate = "2014-04-22
    Url = ""
    Version = "0.0.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/ch/ or 
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    
    Import-Module ActiveDirectory
    Import-Module GroupPolicy
    
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#

    $Path = "C:\backup\GroupPolicy"

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # create backup file name
    $Filename = "GroupPolicyFull" + "#" + $((Get-Date -Format s) -replace ":","-") + ".bak"
    $Filepath = Join-Path $Path $Filename

    # backup active directory
    Get-GPO -All | ForEach-Object{
    
        $GPOFilepath = Join-Path $Filepath $_.DisplayName    
        New-Item -Path $GPOFilepath -ItemType Directory
        Backup-GPO -Guid $_.ID -Path $GPOFilepath    
    }
    
    # get dates for backup retention exclusion
    $Today = Get-Date -Format d
    $FirstDateOfWeek = Get-Date (Get-Date).AddDays(-[int](Get-Date).Dayofweek) -Format d
    $FirstDateOfMonth = Get-Date -Day 1 -Format d

    # delete all backups except for today, first day of week and first day of month
    Get-ChildItem $Path | select *,@{L="CreationTimeDate";E={Get-Date $_.CreationTime -Format d}} | Group-Object CreationTimeDate | %{
        
        # only one backup per day
        if($_.Count -gt 1){
            
            $_.Group | Sort-Object CreationTime -Descending | Select-Object -Skip 1     
        }
                
        # keep only required backups
        $_.Group | Where-Object{$_.CreationTimeDate -ne $Today -and $_.CreationTimeDate -ne $FirstDateOfWeek -and $_.CreationTimeDate -ne $FirstDateOfMonth}
            
    } | Remove-Item -Recurse -Force
    
}catch{

    Write-PPErrorEventLog -Source "Backup ActiveDirectory Group Policies" -ClearErrorVariable
}

Latest version of this script: https://gist.github.com/11167763

Backup Active Directory with PowerShell

Tue, 15 Apr 2014 13:57:06 +0000

Based on this Technet article I’ve developed a simple Active Directory backup tool with PowerShell.

What it does:

Create a full snapshot from Active Directory
Keep a daily, weekly and monthly snapshot
Notify me if something failed (requires PowerShell PowerUp)

<#
$Metadata = @{
	Title = "Backup ActiveDirecotry"
	Filename = "Backup-ActiveDirectory.ps1"
	Description = ""
	Tags = "backup, active, directory, ntsutil"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2014-04-15"
	LastEditDate = "2014-04-15"
	Url = ""
	Version = "0.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/ch/ or 
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    <#
    #--------------------------------------------------#
    # about
    #--------------------------------------------------#
    
    The restore and backup process is described here: http://technet.microsoft.com/en-us/library/dd581644(WS.10).aspx
    
    #>
    
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#
    
    $Path = "C:\Powershell-PowerUp\backup\ActiveDirectory"
    
    #--------------------------------------------------#
    # main
    #--------------------------------------------------#
    
    # create backup file name
    $Filename = "ADBackupFull" + "#" + $((Get-Date -Format s) -replace ":","-") + ".bak"
    $Filepath = Join-Path $Path $Filename
    
    # backup active directory
    Invoke-Expression 'ntdsutil "activate instance ntds" ifm "create full $Filepath" quit quit'
    
    # get dates for backup retention exclusion
    $Today = Get-Date -Format d
    $FirstDateOfWeek = Get-Date (Get-Date).AddDays(-[int](Get-Date).Dayofweek) -Format d
    $FirstDateOfMonth = Get-Date -Day 1 -Format d
    
    # delete all backups except for today, first day of week and first day of month
    Get-ChildItem $Path | select *,@{L="CreationTimeDate";E={Get-Date $_.CreationTime -Format d}} | Group-Object CreationTimeDate | %{
        
        # only one backup per day
        if($_.Count -gt 1){
            
            $_.Group | Sort-Object CreationTime -Descending | Select-Object -Skip 1     
        }
                
        # keep only required backups
        $_.Group | Where-Object{$_.CreationTimeDate -ne $Today -and $_.CreationTimeDate -ne $FirstDateOfWeek -and $_.CreationTimeDate -ne $FirstDateOfMonth}
            
    } | Remove-Item -Recurse -Force

}catch{

    Write-PPErrorEventLog -Source "Backup ActiveDirectory" -ClearErrorVariable
}

Latest version of this script: https://gist.github.com/10729700

Manage your SharePoint default settings with PowerShell

Fri, 04 Apr 2014 10:16:07 +0000

This post is part of my PowerShell PowerUp project.

The only way to deploy SharePoint default settings for site collections and sites manually is using predefined site templates or an ugly third party tool. And in case you’ll do that with site templates it’ll cost a lot of the time to update settings which were already set.

However with PowerShell it’s possible to deploy SharePoint default settings automatically and it’s a lot easier than you might think.

Today I want to show you my SharePoint default settings script. It does a lot of work for me:

Update Active Directory group display names
Set the navigation inheritance
Set a corporate site logo
Enable and disable versioning on selected lists and libraries
Add support for multilingualism globally
Enable selected installed languages on websites

There are some functions in the script which you can’t know f.g. Write-PPEventLog, these are custom functions and are part of my PowerShell PowerUp project.

<#
$Metadata = @{
	Title = "SharePoint Default Settings"
	Filename = "Set-SPDefaultSettings.ps1"
	Description = ""
	Tags = "powershell, script, sharepoint, default settings"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "http://www.janikvonrotz.ch"
	CreateDate = "2013-05-07"
	LastEditDate = "2014-04-04"
	Version = "3.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    if((Get-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue) -eq $null){Add-PSSnapin "Microsoft.SharePoint.PowerShell"}
    Import-Module ActiveDirectory
    
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#
    
    $Configuration = @{
        SPSite = "http://sharepoint.vbl.ch"
        SPADGroupFilter = "SP_*"
        SPADGroupContainer = "OU=SharePoint,OU=Services,OU=vblusers2,DC=vbl,DC=ch"
        SPNavigationWebExclude = "http://sharepoint.vbl.ch/Projekte"
        AllowedVersioningTypes = "Unternehmenswiki-Seite","Dokument","Wiki-Seite"
        DisabledVersioningTypes = "Survey"
        SupportedLanguages = "Deutsch", "Englisch"
    },
    @{
        SPSite = "http://sharepoint.vbl.ch/itwiki"
        SPADGroupFilter = "SP_*"
        SPADGroupContainer = "OU=SharePoint,OU=Services,OU=vblusers2,DC=vbl,DC=ch"
        AllowedVersioningTypes = "Unternehmenswiki-Seite","Dokument","Wiki-Seite"
        DisabledVersioningTypes = "Survey"
        SupportedLanguages = "Deutsch", "Englisch"
    },
    @{
        SPSite = "http://extranetvr.vbl.ch"
        SPADGroupFilter = "SP2_*"
        SPADGroupContainer = "OU=SharePoint,OU=Services,OU=vblusers2,DC=vbl,DC=ch"
        AllowedVersioningTypes = "Unternehmenswiki-Seite","Dokument","Wiki-Seite"
        DisabledVersioningBaseTypes = "Survey"
        SupportedLanguages = "Deutsch", "Englisch"
    }

    $Configuration | ForEach-Object{

        # get domain
        $ADDomain = ((Get-ADDomain).Name).ToUpper()
    
        # temp var for loops
        $Config = $_
            
            
        # update AD group names
              
        # SharePoint AD Groups 
        $ADGroups = Get-ADGroup -Filter * -SearchBase $_.SPADGroupContainer | Where-Object{$_.Name -like $Config.SPADGroupFilter}
            
        Get-SPUser -Limit All -Web $_.SPSite | Where-Object{$_.IsDomainGroup -and $_.Name -like "$($ADDomain)\$Config.SPADGroupFilter"} | ForEach-Object{
                
            $SPUser = $_
                    
            $ADGroups | Where-Object{
                
                # without claims
                (($_.SID -eq $SPUser.Sid) -or 
                                
                # claims
                ($SPUser.LoginName -like "*$($_.SID)")) -and 

                # check name
                ("$ADDomain\$(($_.Name).ToLower())" -ne $SPUser.Name.ToLower())
                
            } | ForEach-Object{
            
                Write-PPEventLog -Message "Change Displayname for SPGroup: $($SPUser.Name) to: " + "$ADDomain\$(($_.Name).ToLower())" -Source "SharePoint Default Settings" -WriteMessage        
                Set-SPUser $SPUser -DisplayName "$ADDomain\$(($_.Name).ToLower())"
            } 
        }       
         
        
        # website settings

        Get-SPSite | where{$_.Url -eq $Config.SPSite} | Get-SPWeb -Limit All  | ForEach-Object{

            # temp var for loops
            $SPWeb = $_


            # update navigation inheritance except for excluded sites

    	    if(
            ($_.Url).startsWith($Config.SPSite) -and     
            ($_.Url -ne $Config.SPSite) -and    
            ($Config.SPNavigationWebExclude -notcontains $_.Url)
            ){            
    		    $SPPublishingWeb = [Microsoft.SharePoint.Publishing.PublishingWeb]::GetPublishingWeb($_)
    		    $SPPublishingWeb.Navigation.InheritGlobal = $true
    		    $SPPublishingWeb.Navigation.GlobalIncludeSubSites = $true
    		    $SPPublishingWeb.Update()
            }
        

            # update Site Logo

            $_.SiteLogoUrl = $(Get-SPWeb $Config.SPSite).SiteLogoUrl
            $_.Update()
        

            # Enable versioning on lists

            $_.Lists | Where-Object{ $Config.DisabledVersioningBaseTypes -notcontains $_.basetype} | ForEach-Object{
            
                # get content types foreach list
                $Types = $_.ContentTypes | %{$_.Name}
            
                # enable versionging for document libraries and wiki sites
                if(($Types | where{$Config.AllowedVersioningTypes -contains $_}) -and ($_.EnableVersioning -eq $false)){
            
                    Write-PPEventLog -Message "Enable Versioning for: $($_.title) on: $($_.parentweb.title)." -Source "SharePoint Default Settings" -WriteMessage
                        
                    $_.EnableVersioning = $true
                    $_.MajorVersionLimit = 10   
                    $_.Update()   
                
                # disable versioning fore everything else
                }elseif(($_.EnableVersioning -eq $true) -and -not ($Types | where{$Config.AllowedVersioningTypes -contains $_})){
            
                    Write-PPEventLog -Message "Disable Versioning for: $($_.title) on: $($_.parentweb.title)." -Source "SharePoint Default Settings" -WriteMessage
            
                    $_.EnableVersioning = $false       
                    $_.Update()
                }
            }


            # Enable alternative languages

            # enable multilingualism globally
            $_.IsMultilingual = $true

            # get already enabled languages IDs
            $EnabledLanguageIDs = $_.SupportedUICultures | ForEach-Object{$_.LCID}

            # get regtional settings objects
            $SPRegionalSettings = New-Object Microsoft.SharePoint.SPRegionalSettings($_)

            # enable every installed and supported language as longs it's not yet enabled
            $SPRegionalSettings.InstalledLanguages | where{$Config.SupportedLanguages -contains $_.DisplayName -and $EnabledLanguageIDs -notcontains $_.LCID} | ForEach-Object{
                
                Write-PPEventLog -Message "Enable language: $($_.DisplayName) for SPWeb: $($SPWeb.Url)." -Source "SharePoint Default Settings" -WriteMessage
                $CultureInfo = New-Object System.Globalization.CultureInfo($_.LCID)
                $SPWeb.AddSupportedUICulture($CultureInfo)
            }            

            $SPWeb.Update()
        }  
    }
}catch{

    Write-PPErrorEventLog -Source "SharePoint Default Settings" -ClearErrorVariable
}

Latest version of this script: https://gist.github.com/7871902

SharePoint Export and Import Term Sets from Term Store

Tue, 01 Apr 2014 07:34:23 +0000

The SharePoint term store service is one of the most important parts of a SharePoint installation. It’s the best place to store an manage global metadata for your companies documents.

It’s not that hard to design a term set in Excel and import it afterwards with the built-in term store import wizard.

However there’s no tool or wizard that allows you to get a term set out of the term store.

It’s only possible with my PowerShell function (which is as always part of my PowerShell PowerUp project)

<#
$Metadata = @{
	Title = "Get SharePoint Managed Metadata Service Terms"
	Filename = "Get-SPManagedMetadataServiceTerms.ps1"
	Description = ""
	Tags = "powershell, function, sharepoint, managed, metadata, terms, export"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2014-03-31"
	LastEditDate = "2014-03-31"
	Url = ""
	Version = "1.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/ch/ or 
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

function Get-SPManagedMetadataServiceTerms{

<#
.SYNOPSIS
    List all Terms from Managed Metadata service.

.DESCRIPTION
	List all Terms form a specifified term store and optionally filter them by term group.

.PARAMETER Site
	Site running a taxonomy session.

.PARAMETER TermGroup
	Optionally filter the term group.

.EXAMPLE
	PS C:\> Get-SPManagedMetadataServiceTerms -Site "http://SharePoint.domain.com"

.EXAMPLE
	PS C:\> Get-SPManagedMetadataServiceTerms -Site "http://SharePoint.domain.com" -TermGroup "Wiki"

.LINK
    http://technet.microsoft.com/en-us/library/ee424396(v=office.14).aspx

#>

    [CmdletBinding()]
    param(

		[Parameter(Mandatory=$true)]
		[String]
		$Site,

		[String]
		$TermGroup
        
	)
    
    #--------------------------------------------------#
    # functions
    #--------------------------------------------------#

    function Add-ArrayLevelIndex{

        param(
    
            $Object,        
            $AttributeName,        
            $Level = 0
        )
    
        # check the child attribute containing the same type of objects
        $Objects = iex "`$Object.$AttributeName"
    
        # output this item
        $Object | select @{L="Object";E={$_}}, @{L="Level";E={$Level}}
    
        # output the child items of this object
        if($Objects){
    
            # add level
            $Level ++
        
            # loop trough the same function
            $Objects | %{Add-ArrayLevelIndex -Object $_ -AttributeName $AttributeName -Level $Level}

        }
    }

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------# 
    if((Get-PSSnapin 'Microsoft.SharePoint.PowerShell' -ErrorAction SilentlyContinue) -eq $null){Add-PSSnapin 'Microsoft.SharePoint.PowerShell'}

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#
    $SPTaxonomies = @()
    $TempTerm = New-Object -TypeName Psobject @{    
        Index = ""
        Term = ""
    }

    $i = 0;
    $TempTerms = while($i -ne 7){
        $i ++
        $e = $TempTerm.PSObject.Copy()
        $e.Index = $i
        $e
    }


    # get all taxonomy objects
    $SPTaxonomies = Get-SPTaxonomySession -Site $Site | %{

        $_.TermStores | %{
    
            $TermStore = New-Object -TypeName Psobject -Property @{
        
                TermStore = $_.Name
                "Term Group" = ""
                "Term Set Name" = ""
                "Term Set Description" = ""   
                LCID = ""             
                "Available for Tagging" = ""                
                Terms = ""      
            }        
        
        
            $_.Groups | Where{$_.Name -eq $TermGroup -or -not $TermGroup} | ForEach-Object{
            
                $Group = $TermStore.PSObject.Copy()
                $Group.'Term Group' = $_.Name                       
        
                $_.TermSets | %{
            
                    $TermSet = $Group.PSObject.Copy()
                    $TermSet.'Term Set Name' = $_.Name
                    $TermSet.'Term Set Description' = $_.Description
                                    
                    $TermSet.Terms = ($_.Terms | %{Add-ArrayLevelIndex -Object $_ -AttributeName "Terms" -Level 1})
            
                    $TermSet                  
                }        
            }        
        }
    }

    # get maximum of levels a term has
    # $Levels = ($SPTaxonomies | %{$_.Terms | %{$_.Level}} | measure -Maximum).Maximum + 1
    # or comment out and use default 7

    # loop throught term stores       
    $SPTaxonomies | %{

        $SPTaxonomy = $_

        # Output Termstore definitions
        $Item = $SPTaxonomy.PSObject.Copy()  
        $Item.'Available for Tagging' = if($_.IsAvailableForTagging){"TRUE"}else{"FALSE"}        
        $i = 0;while($i -ne 7){
            $i ++
            $Item | Add-Member –MemberType NoteProperty –Name "Level $i Term" –Value ""
        }
        $Item |  Select-Object 'Term Set Name','Term Set Description', LCID, 'Available for Tagging', 'Term Description', 'Level*'

    
        # loop throught terms
        $_.Terms | where{$_} | %{
                
            $Term = $_

            # create a term export object
            $Item = $SPTaxonomy.PSObject.Copy()   
             
            $Item.'Available for Tagging' = if($_.IsAvailableForTagging){"TRUE"}else{"FALSE"}
            $Item.'Term Set Name' = ""
            $Item.'Term Set Description' = ""
            
            $_.Object.Labels | ForEach-Object{

                $Item.LCID = $_.Language

                $Index = 0;while($Index -ne 7){
                    $Index ++

                    if($Term.Level -eq $Index){                        

                        $Item | Add-Member –MemberType NoteProperty –Name "Level $Index Term" –Value $Term.Object.Name

                        $TempTerms[$Index].Term = $Term.Object.Name

                    }elseif($Index -gt $Term.Level){
                            
                        $Item | Add-Member –MemberType NoteProperty –Name "Level $Index Term" –Value $Value

                    }elseif($Term.Level -gt $Index){

                        $Item | Add-Member –MemberType NoteProperty –Name "Level $Index Term" –Value $TempTerms[$Index].Term
                        
                    }                                   
                }  
            }   
        
            # output this object
            $Item |  Select-Object 'Term Set Name','Term Set Description', LCID, 'Available for Tagging', 'Term Description', 'Level*'
        }                
    }
}

With this function you can export the a specific term set into a CSV file or show it in the grid view.

Get-SPManagedMetadataServiceTerms -Site "http://sharepoint.domain.com" -TermGroup "Wiki" | Export-Csv -Path TermSet.csv
Get-SPManagedMetadataServiceTerms -Site "http://sharepoint.domain.com" -TermGroup "Wiki" | Out-GridView

Here’s an example for an export to gridview.

Introducing new SharePoint Online Cmdlets

Mon, 24 Feb 2014 11:19:56 +0000

So far Micosoft doesn’t offer the same amount of cmdlets to manage a SharePoint Online instance as they do for an on-premise installation.

As many other SharePoint administrators I can’t wait to get new cmdlets. Luckily Jeffrey Paarhuis recently published a project on Microsoft Codeplex and showed how simple it is to manage a SharePoint installation just with client-side libraries and functions.

Seconds later I’ve migrated his functions into my project: https://codeberg.org/janikvonrotz/PowerShell-PowerUp

I’ll introduce you the new:

In order to use these commands you have to install the Managed .NET Client-Side Object Model (CSOM) of SharePoint 2013. Run the command Install-PPApp "SharePoint Server 2013 Client Components SDK" to install this app.

Install SharePoint 2013 Three-tier Farm - Run the SharePoint 2013 Service Account Creator

Mon, 27 Jan 2014 13:24:53 +0000

This post of is part of my Install SharePoint 2013 Three-tier Farm project.

As many other Windows services SharePoint and SQL Server requires different service accounts in order to run secure and reliable.

There are different concepts and strategies to create service accounts for a SharePoint installation. One of the most reliable solution I’ve found here.

In case the link is broken, these documents will do fine:

Each level of security contains a range of service accounts. Depending on you content and business requirements, you chose a suitable security level.

You can create those Service Accounts automatically with PowerShell using the SharePoint 2013 Service Account Creator project on CodePlex.

For this project I’ve chosen the highest security option including optional accounts.

https://technet.microsoft.com/en-us/library/cc263445.aspx

Update Obsolete User Principal Names in Office 365 Windows Azure Directory

Mon, 06 Jan 2014 13:02:55 +0000

It could happen that the directory sync service (DirSync) doesn’t sync the users UserPrincipalName correctly.

I had an issue where the UserPrincipalName from a user in the Office 365 windows azure directory has been made based on the user’s sAMAccountname. This wouldn’t be problem if as long the sAMAccountname is the as same as the UserPrincipalName, but as you can guess this is not everywhere the case.

First I checked the attribute flow of the synchronization job and as you can in see in picture below the DirSync service will update the attribute first by the users DN, then by it’s sAMAccountname and at least by the UserPrincipalName .

I’m not quite shure wether the sync problem is caused by this configuration or not, but I don’t recommend to edit these rules, in order the get the UserPrincipalName synced correctly.

To update the UPN I’ve written the following script, I’ll compare the user attributes from the ActiveDirectory and the AzureDirectory. If a UPN doesn’t match it’ll be overwritten with the ActiveDirectory UPN.


#--------------------------------------------------#
# settings
#--------------------------------------------------#

$OU = "OU=vblusers2,DC=vbl,DC=ch"

#--------------------------------------------------#
# modules
#--------------------------------------------------#

Import-Module MSOnline
Import-Module MSOnlineExtended
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

$ADUsers = Get-ADUser -Filter * -SearchBase $OU -Properties GivenName, Surname, DisplayName

$Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName
Connect-MsolService -Credential $Credential
$MsolUsers = Get-MsolUser -All

$MsolUsers | %{

    $MsolUser = $_
    $ADUsers | where{($_.GivenName -eq $MsolUser.FirstName) -and
        ($_.Surname -eq $MsolUser.LastName) -and
        ($_.DisplayName -eq $MsolUser.DisplayName) -and
        ($_.UserPrincipalName -ne $MsolUser.UserPrincipalName)
    } | %{

        Write-Host "Change UserPrincipalName for: $($MsolUser.UserPrincipalName) to: $($_.UserPrincipalName)"
        Set-MsolUserPrincipalName -UserPrincipalName $MsolUser.UserPrincipalName -NewUserPrincipalName $_.UserPrincipalName

    }
}

Latest version of this script: https://gist.github.com/8281095

manage SharePoint list alerts for multiple users on multiple lists

Thu, 02 Jan 2014 14:38:25 +0000

In certain cases SharePoint alerts are more useful than workflows, f.e. having the possibility to let users manager their alerts is not possible with workflows.

To manager alerts for a couple of users on specific lists I’ve written a script that handles the whole cycle of alerts. It let me delete, update and create alerts based on predefined configuration.

<#
$Metadata = @{
	Title = "Update SharePoint User Alerts"
	Filename = "Update-SPUserAlerts.ps1"
	Description = ""
	Tags = "powershell, sharepoint, update, user, alerts"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2014-01-02"
	LastEditDate = "2014-01-02"
	Url = ""
	Version = "1.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/ch/ or 
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    if((Get-PSSnapin 'Microsoft.SharePoint.PowerShell' -ErrorAction SilentlyContinue) -eq $null){Add-PSSnapin 'Microsoft.SharePoint.PowerShell'}
    Import-Module ActiveDirectory
    
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#
    $Alerts = @(    
        @{    
            ID = 1
            ListUrl = "http://sharepoint.domain.ch/site/subsite/Lists/ListName/view.aspx"    
            SubscriberADUsersAndGroups = "ADGroup","ADUser"          
            Title = "`"Benachrichtigunggg `$Username`""
            AlertType = [Microsoft.SharePoint.SPAlertType]::List       
            DeliveryChannels = [Microsoft.SharePoint.SPAlertDeliveryChannels]::Email
            EventType = [Microsoft.SharePoint.SPEventType]::Add
            AlertFrequency = [Microsoft.SharePoint.SPAlertFrequency]::Immediate
            ListViewName = "View 2014"
            FilterIndex = 8
        }
    )
    
    #--------------------------------------------------#
    # function
    #--------------------------------------------------#
    function New-UnifiedAlertObject{
        
        param(
            $Title,
            $AlertType,
            $DeliveryChannels,
            $EventType,
            $AlertFrequency,
            $ListViewID,
            $FilterIndex
        )
        
        New-Object PSObject -Property @{
            Title = $Title
            AlertType = $AlertType
            DeliveryChannels = $DeliveryChannels
            EventType = $EventType
            AlertFrequency = $AlertFrequency
            ListViewID = $ListViewID
            AlertFilterIndex = $AlertFilterIndex
        }
    }

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#
    
    $Alerts | %{
    
        # set vars
        $Message = "Update alerts with ID: $($_.ID)`n"
        $Alert = $_
    
        # get sp site
        $SPWeb = Get-SPWeb (Get-SPUrl $_.ListUrl).WebUrl

        # get name of the list
        $ListName = (Get-SPUrl $_.ListUrl).Url -replace ".*/",""

        # get the sp list object
        $SPList = $SPWeb.Lists[$ListName]
        
        $SPUsers = Get-SPUser -Web $SPWeb.Site.Url
        
        # get the id of the list view by name
        $SPListViewID = ($SPList.Views | where{$_.title -eq $SPListViewName -and $_.title -ne ""} | select -First 1).ID
        
        # get existing alerts
        $ExistingAlerts = $SPWeb.Alerts | where{$_.Properties["alertid"] -eq $Alert.ID}
        
        # cycle throught all users and  update, create or delete their alerts
        $UserWithAlerts = $_.SubscriberADUsersAndGroups | %{
        
            Get-ADObject -Filter {Name -eq $_} | %{
        
                if($_.ObjectClass -eq "user"){
                    
                    Get-ADUser $_.DistinguishedName
                    
                }elseif($_.ObjectClass -eq "group"){
                
                    Get-ADGroupMember $_.DistinguishedName -Recursive | Get-ADUser 
                }
            } | %{
                
                $ADUser = $_
            
                $SPUsers | where{$_.SID -eq $ADUser.SID} | %{$SPWeb.EnsureUser($_.Name)}
            }
        } | %{
        
            # create alert title
            $Username = $_.DisplayName
            $AlertTitle = Invoke-Command -ScriptBlock ([ScriptBlock]::Create($Alert.Title))
            
            # check if already alert exists with this id
            $AlertIS = $_.Alerts | where{$_.Properties["alertid"] -eq $Alert.ID} | select -First 1           
            
            # if exists update this alert
            if($AlertIS){
                
                # create alert objects to compare
                $AlertObjectIS = New-UnifiedAlertObject -Title $AlertIS.title `
                    -AlertType $AlertIS.AlertType `
                    -DeliveryChannels $AlertIS.DeliveryChannels `
                    -EventType $AlertIS.EventType `
                    -AlertFrequency $AlertIS.AlertFrequency `
                    -ListViewID $AlertIS.Properties["filterindex"] `
                    -FilterIndex $AlertIS.Properties["filterindex"]
                    
                $AlertObjectTo = New-UnifiedAlertObject -Title $AlertTitle `
                    -AlertType $Alert.AlertType `
                    -DeliveryChannels $Alert.DeliveryChannels `
                    -EventType $Alert.EventType `
                    -AlertFrequency $Alert.AlertFrequency `
                    -ListViewID $SPListViewID `
                    -FilterIndex $Alert.FilterIndex
                
                # only update changed attributes
                if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property Title, AlertType, DeliveryChannels, EventType, AlertFrequency, ListViewID, FilterIndex){
                    
                    $Message += "Update alert with ID: $($Alert.ID) for user: $($_.DisplayName)`n"
                    
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property Title){$AlertIS.Title = $AlertObjectTo.Title}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property AlertType){$AlertIS.AlertType = $AlertObjectTo.AlertType}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property DeliveryChannels){$AlertIS.DeliveryChannels = $AlertObjectTo.DeliveryChannels}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property EventType){$AlertIS.EventType = $AlertObjectTo.EventType}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property AlertFrequency){$AlertIS.AlertFrequency = $AlertObjectTo.AlertFrequency}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property ListViewID){$AlertIS.Properties["viewid"] = $AlertObjectTo.ListViewID}
                    if(Compare-Object -ReferenceObject $AlertObjectTo -DifferenceObject $AlertObjectIS -Property FilterIndex){$AlertIS.Properties["filterindex"] = $AlertObjectTo.FilterIndex}
                    
                    # update changes
                    $AlertIS.Update()
                }
            }else{
            
                # create a new alert object  
                $Message += "Create alert with ID: $($Alert.ID) for user: $($_.DisplayName)`n"          
                $NewAlert = $_.Alerts.Add()
                
                # add attributes
                $NewAlert.Properties.Add("alertid",$Alert.ID)
                $NewAlert.Title = $AlertTitle                  
                if($SPListViewID){                
                    $NewAlert.Properties.Add("filterindex",$Alert.FilterIndex)
                    $NewAlert.Properties.Add("viewid",$SPListViewID)              
                }
                $NewAlert.AlertType = $Alert.AlertType
                $NewAlert.List = $SPList
                $NewAlert.DeliveryChannels = $Alert.DeliveryChannels
                $NewAlert.EventType = $Alert.EventType
                $NewAlert.AlertFrequency = $Alert.AlertFrequency

                # create the alert
                $NewAlert.Update()
            }
            
            # pipe the users to check alerts to delete
            $_
            
        } 
        
        # username array
        $UserWithAlerts = $UserWithAlerts | %{"$($_.UserLogin)"}
        
        # delete alerts
        $ExistingAlerts | where{$UserWithAlerts -notcontains $_.User} | %{
        
            $Message += "Delete alert with ID: $($Alert.ID) for user: $($_.User)`n"
            $SPWeb.Alerts.Delete($_.ID)        
        }
        
        Write-PPEventLog -Message $Message -Source "Update SharePoint User Alerts" -WriteMessage
    }
}catch{

    Write-PPErrorEventLog -Source "Update SharePoint User Alerts" -ClearErrorVariable    
}

The configuration attribute ListViewName and FilterIndex allows me to change to create an alert for an specific view.

To use this script I’ll recommend you to install my project: PowerShell Profile. There are some function as f.e. Get-SPUrl which are not defined in this script but are part of this project.

You’ll find the latest version of this script here: https://gist.github.com/janikvonrotz/8218907

Change Active Directory User Password Expiration Mode

Wed, 11 Dec 2013 17:35:45 +0000

To change an Active Directory users password expiration mode you can use this PowerShell snippet:

Import-Module ActiveDirectory

Get-ADGroupMember "Group1" -Recursive |
Get-ADUser -Properties PasswordNeverExpires |
where {$_.enabled -eq $true -and $_.PasswordNeverExpires -eq $false} |
select -First 50 | %{

    Write-Host $_.UserPrincipalName
    Set-ADUser $_ -PasswordNeverExpires $true
}

Latest version of this snippet: https://gist.github.com/7913696

Get Active Directory User Membership Groups Recursively

Wed, 11 Dec 2013 11:46:37 +0000

To get a users member shipments recursively I’ve written an extended function based on the already existing function Get-ADPrincipalGroupMembership it simply loops through the users member shipments and outputs the data in tree styled list.

This function is part of my PowerShell Profile project. Install this framework to get the latest version of this function.

<#
$Metadata = @{
	Title = "Get Active Directory Principal Group Membership Recurse"
	Filename = "Get-ADPrincipalGroupMembershipRecurse.ps1"
	Description = ""
	Tags = "powershell, activedirectory, get, prinicipal, group, membership, recurse"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2013-12-11"
	LastEditDate = "2013-12-11"
	Url = ""
	Version = "1.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

function Get-ADPrincipalGroupMembershipRecurse{

<#
.SYNOPSIS
    Get Active Directory principal group membership recursively.

.DESCRIPTION
	Get Active Directory principal group membership recursively.

.PARAMETER  ADUser
	Active Directory user to report.

.PARAMETER  ADGroup
	Looping parameter not required!

.PARAMETER  ADGroup
    Looping parameter not required!

.EXAMPLE
	PS C:> Get-ADPrincipalGroupMembershipRecurse -ADUser (Get-ADUser user1) | Out-GridView
#>

	[CmdletBinding()]
	param(

		[Parameter(Mandatory=$false)]
		[ValidateNotNullOrEmpty()]
		$ADUser,

		[Parameter(Mandatory=$false)]
		[ValidateNotNullOrEmpty()]
		$ADGroup,

        [Parameter(Mandatory=$false)]
        $Level = 0
    )

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#
    Import-Module ActiveDirectory

    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # loop select for user parameter
    if($ADUser){

        # get membership groups of user and run this function
        $ADGroups = Get-ADPrincipalGroupMembership $ADUser | %{
            Get-ADPrincipalGroupMembershipRecurse -ADGroup $_ -Level ($Level+1)
        }

        # get max number of levels
        $Levels = ($ADGroups | %{$_.Level} | measure -Maximum).Maximum + 1

        # display the results in columns
        $ADGroups | %{

            # create a column item
            $Item = New-Object –TypeName PSObject

            # create a column for each level
            $Index = 1;while($Index -ne $Levels){

                # place the value in the right level
                if($_.Level -eq $Index){
                    $Item | Add-Member –MemberType NoteProperty –Name "Level $Index" –Value $_.Name
                }else{
                    $Item | Add-Member –MemberType NoteProperty –Name "Level $Index" –Value ""
                }

                $Index += 1
            }

            #output
            $Item
        }

    # loop select for group parameter
    }elseif($ADGroup){

        # show a progress
        Write-Progress -Activity "Collecting Data" -Status "$($_.Name)" -PercentComplete (Get-Random -Minimum 1 -Maximum 100)

        # return the item and its level
        $_ | select Name,@{L="Level";E={$Level}}

        # check for further membershipments of this group and loop this function
        Get-ADPrincipalGroupMembership $_ | %{
            Get-ADPrincipalGroupMembershipRecurse -ADGroup $_ -Level ($Level+1)
        }
    }
}

E-Mail report of unchecked SharePoint files

Thu, 14 Nov 2013 16:05:42 +0000

Having unchecked files in the SharePoint is not a big deal as long as you aware of the those files.

Being unaware of which files are unchecked can really harm the information integrity of the SharePoint.

In one of my last posts I’ve reported the SharePoint storage space used by files and found about 1 GB of unchecked files by several people.

As they are in most cases unaware of those files or even don’t understand what the file check-in/check-out is about, it’s almost impossible to handle this files.

To handle this issue I’ve written this simple script that reports all unchecked files of a SharePoint installation, writes and sends a nice report by mail to the owner of those files.

Here’s a report example:

and here’s the script:


<#
$Metadata = @{
	Title = "Send Mail Report Of Unchecked SharePoint Files"
	Filename = "Send-MailReportOfUncheckedSharePointFiles.ps1"
	Description = ""
	Tags = ""
	Project = "powershell, script, sharepoint, report, unchecked, file"
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "2013-11-14"
	LastEditDate = "2013-11-14"
	Url = ""
	Version = "1.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Add-Type -AssemblyName System.Web
if ((Get-PSSnapin 'Microsoft.SharePoint.PowerShell' -ErrorAction SilentlyContinue) -eq $null){Add-PSSnapin 'Microsoft.SharePoint.PowerShell'}

#--------------------------------------------------#
# load config
#--------------------------------------------------#
$Mail = Get-PPConfiguration $PSconfigs.Mail.Filter | %{$_.Content.Mail | where{$_.Name -eq "Report Checked Out SharePoint Files"}} | select -first 1

#--------------------------------------------------#
# main
#--------------------------------------------------#
Get-SPWebApplication | Get-SPSite | Get-SPWeb -Limit All | %{
    $SPWeb = $_
    $_.lists | %{
        $_.CheckedOutFiles | %{
            $_ | select *, @{L="FileUrl";E={$SPWeb.Site.Url + "/" + $_.Url}}, @{L="SiteUrl";E={($SPWeb.Site.Url + "/" + $_.Url) -replace "[^/]+$",""}}
        }
    }
} | Group-Object CheckedOutByEmail | %{

    $Subject = "$($_.Count) nicht eingecheckte Dateien auf dem SharePoint"

    $Body = @"
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"  "https://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="https://www.w3.org/1999/xhtml"> <head> <style>
    body{
        font-size: 11pt;
        font-family: Calibri
    }
    table {
        margin: 1em;
        border-collapse: collapse;
    }
    td, th {
        margin: 0.3em;
        border: 1px #ccc solid;
    }
</style></head><body>

    <p>Guten Tag $($_.Group[0].CheckedOutByName)</p>

    <p>Sie erhalten diese E-Mail, weil Sie im Besitz von nicht eingecheckten Dateien sind,</br>
    welche als letztes vor einer Woche oder fürher bearbeitet worden sind.</p>

    <p>Wir bitten Sie diese Dateien einzuchecken oder zu löschen.</p>

    <p>Untersützung zu diesem Thema erhalten Sie <a href="https://office.microsoft.com/de-ch/sharepoint-workspace-help/auschecken-und-einchecken-von-dokumenten-in-ein-dateitool-HA010356922.aspx">hier</a>.</p>

    <h2>Übersicht ihrer nicht eingecheckten Dateien</h2>

    $($_.group | select @{L="Name";E={$_.LeafName}}, @{L="FileUrl";E={"<a href='$($_.FileUrl)'>$($_.FileUrl)</a>"}}, @{L="SiteUrl";E={"<a href='$($_.SiteUrl)'>$($_.SiteUrl)</a>"}}, TimeLastModified, @{L="Size";E={Format-FileSize $_.Length}} | where{$_.TimeLastModified -lt $(Get-Date).AddDays(-7)} | ConvertTo-Html -Fragment)

    <p>ACHTUNG! Dieses E-Mail wurde von einem unbeaufsichtigtem Konto verschickt, Antworten an den Sender dieser E-Mail werden nicht bearbeitet.</p>

</body></html>
"@

    Write-PPEventLog -Message "Send Mail to: $($_.Name) with subject: $Subject" -Source "Send Mail Report Of Unchecked SharePoint Files" -WriteMessage
    Send-MailMessage -To $_.Name -From $Mail.FromAddress -Subject $Subject -Body ([System.Web.HttpUtility]::HtmlDecode($Body)) -SmtpServer $Mail.OutSmtpServer -BodyAsHtml -Priority High -Encoding ([System.Text.Encoding]::UTF8)
    Write-PPErrorEventLog -ScriptPath $MyInvocation.InvocationName -ClearErrorVariable
}

Latest version of this script: https://gist.github.com/7467398

Requirements to run this script:

Making Exchange Distribution Lists Externally Available

Tue, 12 Nov 2013 08:36:52 +0000

This might not be best practise but based on the situation you as administrator have to enable this feature.

Making distribution lists externally available is great for spammers, so if you enable this feature, do this as less as possible.

To enable a exchange distribution list for external use I recommand to use this simple PowerShell command:

Set-DistributionGroup <groupname> -RequireSenderAuthenticationEnabled $false

PowerShell Function Template

Mon, 11 Nov 2013 16:04:39 +0000

A good way to start writing a custom function in PowerShell is an advanced template like this. This is my custom PowerShell function template, whenever I’m writing a new script I’ll start with one of my templates. Having consistency in structure and naming of code is an important part in collaboration.

You can use this template for whatever like and do you can do everything you’ll like (except selling) with it.

<#
$Metadata = @{
	Title = ""
	Filename = ""
	Description = ""
	Tags = ""
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "https://janikvonrotz.ch"
	CreateDate = "yyyyy-mm-dd hh:mm"
	LastEditDate = "yyyyy-mm-dd hh:mm"
	Url = ""
	Version = "0.0.0"
	License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

function Test-AdvancedFunction{

<#
.SYNOPSIS
    A brief description of the function.

.DESCRIPTION
	A detailed description of the function.

.PARAMETER  ParameterA
	The description of the ParameterA parameter.

.PARAMETER  ParameterB
	The description of the ParameterB parameter.

.EXAMPLE
	PS C:> Get-Something -ParameterA 'One value' -ParameterB 32

.EXAMPLE
	PS C:> Get-Something 'One value' 32

.INPUTS
	System.String,System.Int32

.OUTPUTS
	System.String

.NOTES
	Additional information about the function go here.

.LINK
	about_functions_advanced

.LINK
	about_comment_based_help

#>

	[CmdletBinding()]
	param(

        # parameter options
        # validation
        # cast
        # name and default value

		[Parameter(Position=0, Mandatory=$true)]
		[ValidateNotNullOrEmpty()]
		[System.String]
		$Name,

		[Parameter(Position=1)]
		[ValidateNotNull()]
		[System.Int32]
		$Index

	)# param end

  #--------------------------------------------------#
  # settings
  #--------------------------------------------------#

  #--------------------------------------------------#
  # functions
  #--------------------------------------------------#

  #--------------------------------------------------#
  # modules
  #--------------------------------------------------#

  #--------------------------------------------------#
  # main
  #--------------------------------------------------#

    # This block is used to provide optional one-time pre-processing for the function.
    begin{

        Do-Something
    }# begin end

    # This block is used to provide record-by-record processing for the function.
    process{

    	try{

    	}# try end

    	catch{

    		throw

        }# catch end

        finally{

        }# finally end
    }# process end

    # This block is used to provide optional one-time post-processing for the function.
    end{

    }# end end
}# function end

Hope I’m going save you time in programming great things.

Check out the latest version of this template here: https://gist.github.com/5749458

Manage Security Groups in a organizational Strcture

Mon, 28 Oct 2013 16:22:20 +0000

As in on of my last post I’ve showed you my approach to manage distribution groups in the hierarchical structure of an ActiveDirectory installation. In the mean time I’ve adapted a similiar approach for the security groups.

Here is an example of the structure:

Existing OU structure and groups:

And here after executing the management script:

New Security groups :

The rules

As always you can manage special settings with Exclude-Filters and simple Tasks.

And here’s the script:

<#
$Metadata = @{
    Title = "Update ActiveDirectory Security Groups"
    Filename = "Update-ADSecurityGroups.ps1"
    Description = ""
    Tags = "powershell, activedirectory, security, groups, update"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-10-07"
    LastEditDate = "2013-10-24"
    Url = ""
    Version = "1.1.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

$ExcludeADUsers = ""
$ExcludeADGroups = ""

$OUConfigs = @(
    @{
        OU = "OU=vblusers2,DC=vbl,DC=ch"

        GroupSuffix = " Abteilung"
        GroupMemberPrefix = "F_"

        ParentGroupSuffix = " Abteilungen"
        ParentGroupMemberSuffix = " Abteilung"

        ExcludeOUs = "Extern","ServiceAccounts","Services"

        ExcludeADUsers = "" + $ExcludeADUsers
        ExcludeADGroups = "F_Verwaltungsrat" + $ExcludeADGroups
    }
)

$Tasks = @(
    @{
        Name = "SP_Home#Read";
        Options = @("CleanGroup","UpdateFromGroups","ProcessUsers");
        AddGroups = @("Technik Abteilungen","Betrieb Abteilungen","Personal Abteilungen","Finanzen Abteilungen","Direktion Abteilungen","F_TermUser")
    },
    @{
        Name = "SP_Home#Edit";
        Options = @("CleanGroup","UpdateFromGroups","RemoveGroups","ProcessUsers");
        AddGroups = @("SP_Home#Read");
        RemoveGroups = @("SPO_365E1License","F_TermUser","F_Service Benutzer")
    }

)

$OUConfigs | %{
    $OUConfig = $_
    Get-ADOrganizationalUnit -Filter "*" -SearchBase $_.OU |
    where{$ThisOU = $_; -not ($OUConfig.ExcludeOUs | where{$ThisOU.DistinguishedName -match $_})} | %{

        $OUconfig.OU = $_

        $ParentGroupName = ($_.Name + $OUconfig.ParentGroupSuffix)
        $ParentGroupMembers = Get-ADOrganizationalUnit -Filter * -SearchBase $_.DistinguishedName | %{Get-ADGroup -SearchScope OneLevel -Filter * -SearchBase $_.DistinguishedName | where{$_.Name.EndsWith($OUconfig.ParentGroupMemberSuffix)}} | select -Unique
        $ParentGroup = Get-ADGroup -SearchScope OneLevel -Filter {SamAccountName -eq $ParentGroupName -and GroupCategory -eq "Security"}  -SearchBase $_.DistinguishedName

        $GroupName = ($_.Name + $OUconfig.GroupSuffix)
        $GroupMembers = Get-ADGroup -SearchScope OneLevel -Filter * -SearchBase $_.DistinguishedName | where{$_.Name.StartsWith($OUconfig.GroupMemberPrefix) -and ($OUconfig.ExcludeADGroups -notcontains $_.Name)}
        $Group = Get-ADGroup -SearchScope OneLevel -Filter{SamAccountName -eq $GroupName -and GroupCategory -eq "Security"} -SearchBase $_.DistinguishedName

        if($ParentGroupMembers -and $ParentGroup){

            "Update members in parent group: $($ParentGroup.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            Get-ADGroupMember -Identity $ParentGroup | %{Remove-ADGroupMember -Identity $ParentGroup -Members $_ -Confirm:$false}
            $ParentGroupMembers | %{Add-ADGroupMember -Identity $ParentGroup -Members $_}

        }elseif($ParentGroupMembers -and $ParentGroupMembers.count -gt 1){

            "Add parent group: $ParentGroupName." | %{$Message += "`n" + $_; Write-Host $_}
            New-ADGroup -Name $ParentGroupName -SamAccountName $ParentGroupName -GroupCategory Security -GroupScope Global -DisplayName $ParentGroupName -Path $($OU.DistinguishedName) -Description "Department group for $($OU.Name)"
            $ParentGroupMembers | %{Add-ADGroupMember -Identity $ParentGroupName -Members $_}
        }

        if($Group -and $GroupMembers){

            #"Update members in group: $($Group.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            $GroupMembersIS = Get-ADGroupMember -Identity $Group | %{"$($_.DistinguishedName)"}
            $GroupMemberTO = $GroupMembers | %{"$($_.DistinguishedName)"}

            Get-ADGroupMember -Identity $Group | where{(-not $_.Name.StartsWith($OUconfig.GroupMemberPrefix)) -or ($GroupMemberTO -notcontains $_.DistinguishedName)} | %{
                "Remove member: $($_.Name) from group: $($Group.Name)." | %{$Message += "`n" + $_; Write-Host $_}
                Remove-ADGroupMember -Identity $Group -Members $_ -Confirm:$false
            }

            $GroupMembers | where{($GroupMembersIS -notcontains $_.DistinguishedName)} | %{
                "Add member: $($_.Name) to group: $($Group.Name)." | %{$Message += "`n" + $_; Write-Host $_}
                Add-ADGroupMember -Identity $Group -Members $_
            }

        }elseif($GroupMembers){

            "Add group: $GroupName." | %{$Message += "`n" + $_; Write-Host $_}
            New-ADGroup -Name $GroupName -SamAccountName $GroupName -GroupCategory Security -GroupScope Global -DisplayName $GroupName -Path $($OU.DistinguishedName) -Description "Department group for $($OU.Name)"
            $GroupMembers | %{Add-ADGroupMember -Identity $GroupName -Members $_}
        }
    }
}

$Tasks | %{

    $ADGroup = Get-ADGroup -Identity $_.Name

    if($_.Options -match "CleanGroup"){

        "Remove members from: $($_.Name)." | %{$Message += "`n" + $_; Write-Host $_}
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
    }

    if($_.Options -match "UpdateFromGroups"){

        if($_.Options -match "ProcessUsers"){

            "Add users from: $($_.AddGroups) to: $($_.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            $_.AddGroups | %{Get-ADGroupMember $_ -Recursive | Get-ADUser | where {($_.Enabled -eq $true) -and ($ExcludeADUsers -notcontains $_.UserPrincipalName)}} | select -Unique | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

        }else{

            "Add groups: $($_.AddGroups) to: $($_.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            $_.AddGroups | %{Add-ADGroupMember -Identity $ADGroup -Members $_}
        }
    }

    if($_.Options -match "RemoveGroups"){

        if($_.Options -match "ProcessUsers"){

            "Remove users from: $($_.RemoveGroups) to: $($_.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            $ADGroupMembers = Get-ADGroupMember -Identity $ADGroup
            $_.RemoveGroups | %{Get-ADGroupMember $_ -Recursive | Get-ADUser | where {($ADGroupMembers -match $_) -and ($_.Enabled -eq $true) -and ($ExcludeADUsers -notcontains $_.UserPrincipalName)}} | select -Unique |  %{Remove-ADGroupMember -Identity $ADGroup -Members $_  -Confirm:$false}

        }else{

            "Remove groups: $($_.RemoveGroups) to: $($_.Name)." | %{$Message += "`n" + $_; Write-Host $_}
            $_.RemoveGroups | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        }
    }
}

Write-PPEventLog $($MyInvocation.InvocationName + "`n`n" + $Message )
Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
Write-PPErrorEventLog -ScriptPath $MyInvocation.InvocationName -ClearErrorVariable

Archive ActiveDirectory Users and their Mailbox

Mon, 14 Oct 2013 17:04:19 +0000

One of my company’s requirements is the retention time of 10 years for user accounts and their mailbox data, I have to admit, this might not be common or even recommended. However I have to deal with it.

One problem to face is the availabilty of user account names, by the number of about 500 employees there’s a hight change that two or even more people are having the same name.

To clean up the available names in the system I’ve written a script that renames a users identity and the mailboxes address. So let’s see what this script does:

#--------------------------------------------------#
# settings
#--------------------------------------------------#
$ExchangeServer = "vblw2k8mail05"
$FilterRecipientTypeDetails = @("UserMailbox","RemoteUserMailbox")

#--------------------------------------------------#
# functions
#--------------------------------------------------#

function Rename-ADUserAndMailbox{

    param(
        [Parameter(Mandatory=$true)]
        $ADUser,

        [Parameter(Mandatory=$true)]
        $MailBox
    )

    $ArchivedIdentity = ($($ADUser.SID).tostring() -replace "-","").substring(20)

    if(-not (Get-ADUser -Filter{SamAccountName -eq $ArchivedIdentity} -ErrorAction SilentlyContinue)){

        $NewName = "$($ADUser.Name) $($ADUser.SID)"
        $NewUserPrincipalName =  "$($ADUser.UserPrincipalName.split('@')[0]) $($ADUser.SID)@$($ADUser.UserPrincipalName.split('@')[1])"
        $NewSamAccountName = ($($ADUser.SID).tostring() -replace "-","").substring(20)

        Write-Host "Rename Name $($ADUser.Name) to $NewName"
        Rename-ADObject $ADUser -NewName $NewName

        Write-Host "Rename UserPrincipalName $($ADUser.UserPrincipalName) to $NewUserPrincipalName"
        Get-ADUser $ADUser.SamAccountName | Set-ADUser -UserPrincipalName $NewUserPrincipalName -Description "archived"

        Write-Host "Rename SamAccountName $($ADUser.SamAccountName) to $NewSamAccountName"
        Get-ADUser $ADUser.SamAccountName | Set-ADUser -SamAccountName $NewSamAccountName

        $NewPrimarySmtpAddress = "$($ADUser.UserPrincipalName.split('@')[0])$($ADUser.SID)@$($ADUser.UserPrincipalName.split('@')[1])" -replace "-",""
        $OldPrimarySmtpAddress = $Mailbox.PrimarySmtpAddress

        if($Mailbox.psObject.TypeNames -contains "Deserialized.Microsoft.Exchange.Data.Directory.Management.RemoteMailbox"){

            $NewRemoteRoutingAddress = "$($Mailbox.RemoteRoutingAddress.split("@")[0])$($ADUser.SID)@$($Mailbox.RemoteRoutingAddress.split("@")[1])" -replace "-",""
            $OldRemoteRoutingAddress = $Mailbox.RemoteRoutingAddress

            Get-RemoteMailbox $ADuser.Name | %{

                Write-Host "Rename PrimarySmtpAddress for $($_.PrimarySmtpAddress) to $NewPrimarySmtpAddress"
                Set-RemoteMailbox $_.Alias -PrimarySmtpAddress $NewPrimarySmtpAddress;

                Write-Host "Rename RemoteRoutingAddress for $($_.RemoteRoutingAddress) to $NewRemoteRoutingAddress"
                Set-RemoteMailbox $_.Alias -RemoteRoutingAddress $NewRemoteRoutingAddress

                Write-Host "Remove default mail addresses $OldRemoteRoutingAddress, $PrimarySmtpAddress on $($_.Alias)"
                Set-RemoteMailbox $_.Alias -EmailAddresses @{remove = $OldRemoteRoutingAddress, $OldPrimarySmtpAddress}
            }

        }elseif($Mailbox.psObject.TypeNames -contains "Deserialized.Microsoft.Exchange.Data.Directory.Management.Mailbox"){

            Get-Mailbox $ADuser.Name | %{

                Write-Host "Rename PrimarySmtpAddress for $($_.PrimarySmtpAddress) to $NewPrimarySmtpAddress"
                Set-Mailbox $_.Alias -PrimarySmtpAddress $NewPrimarySmtpAddress

                Write-Host "Remove default mail addresses $PrimarySmtpAddress on $($Mailbox.Alias)"
                Set-Mailbox $_.Alias -EmailAddresses @{remove = $OldPrimarySmtpAddress}
            }
        }
    }
}

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

# open remote connection
$PSSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://$ExchangeServer/PowerShell/" -Authentication Kerberos

# import
Import-PSSession $PSSession -AllowClobber

$Mailboxes = Get-Mailbox
$RemoteMailboxes = Get-RemoteMailbox

# disable mailbox and remote mailbox
Get-ADUser -Filter{Enabled -eq $false} -Properties mail | where{$_.mail -ne $null} |
    %{$ADUser = $_; $Mailboxes | where{$_.Name -eq $ADuser.Name -and $_.HiddenFromAddressListsEnabled -eq $false -and $FilterRecipientTypeDetails -contains $_.RecipientTypeDetails}} |%{
        Write-host "Hide mailbox $($_.Name) from address lists.";
        Set-Mailbox $_.Name -HiddenFromAddressListsEnabled:$true;
        Rename-ADUserAndMailbox -ADUser $ADUser -MailBox $_
    }

# disable remote mailbox
Get-ADUser -Filter{Enabled -eq $false} -Properties mail | where{$_.mail -ne $null} |
    %{$ADUser = $_; $RemoteMailboxes | where{$_.Name -eq $ADuser.Name -and $_.HiddenFromAddressListsEnabled -eq $false -and $FilterRecipientTypeDetails -contains $_.RecipientTypeDetails}} | %{
        Write-host "Hide remotemailbox $($_.Name) from address lists.";
        Set-RemoteMailbox $_.Name -HiddenFromAddressListsEnabled:$true;
        Rename-ADUserAndMailbox -ADUser $ADUser -MailBox $_
}

# destroy pssession
Remove-PSSession $PSSession

if($error){
    Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
}

Latest version of this script: https://gist.github.com/6780143

As always I recommand you to install my project PowerShell Profile to run this script properly.

SharePoint File Reporting Done Right

Thu, 10 Oct 2013 16:33:01 +0000

To know what type of information a SharePoint Installation is holding could get more difficult as the platform grows.

To set quota templates on the site collection is a good way to keep an eye on the SharePoint storage, but it doesn’t’ show the real used storage.

In case versioning for files is enabled and/or the users don’t check in their files properly these files using space without let you know.

To get a nice report of unchecked, versioned and “normal” files I’ve coded a PowerShell script.

Most of the functions are part of my Project: PowerShell Profile, so this will be a requirement to run this script.

$SPWebs = Get-SPWebs
$SPWebs | %{

    $SPWeb = $_

    $SPSite = $_.site.url

    Get-SPLists -Url $_.Url -OnlyDocumentLibraries | %{

        $SPList = $_

        $SPListUrl = (Get-SPUrl $SPList).url

        Write-Progress -Activity &quot;Crawl list on website&quot; -status &quot;$($SPWeb.Title): $($SPList.Title)&quot; -percentComplete ([Int32](([Array]::IndexOf($SPWebs, $SPWeb)/($SPWebs.count))*100))

        Get-SPListItems $_.ParentWeb.Url -FilterListName $_.title | %{

            $ItemUrl = (Get-SPUrl $_).Url

            # files
            New-Object PSObject -Property @{
                ParentWebsite = $SPWeb.ParentWeb.title
                ParentWebsiteUrl = $SPWeb.ParentWeb.Url
                Website = $SPWeb.title
                WebsiteUrl = $SPWeb.Url
                List = $SPList.title
                ListUrl = $SPListUrl
                FileExtension = [System.IO.Path]::GetExtension($_.Url)
                IsCheckedOut = $false
                IsASubversion = $false
                Item = $_.Name
                ItemUrl = $ItemUrl
                Folder = $ItemUrl -replace &quot;[^/]+$&quot;,&quot;&quot;
                FileSize = $_.file.Length / 1000000
            }

            $SPItem = $_

            # file subversions
            $_.file.versions | %{

                $ItemUrl = (Get-SPUrl $SPItem).Url

                New-Object PSObject -Property @{
                    ParentWebsite = $SPWeb.ParentWeb.title
                    ParentWebsiteUrl = $SPWeb.ParentWeb.Url
                    Website = $SPWeb.title
                    WebsiteUrl = $SPWeb.Url
                    List = $SPList.title
                    ListUrl = $SPListUrl
                    FileExtension = [System.IO.Path]::GetExtension($_.Url)
                    IsCheckedOut = $false
                    IsASubversion = $true
                    Item = $SPItem.Name
                    ItemUrl = $ItemUrl
                    Folder = $ItemUrl -replace &quot;[^/]+$&quot;,&quot;&quot;
                    FileSize = $_.Size / 1000000
                }
            }
        }

        # checked out files
        Get-SPListItems $_.ParentWeb.Url -FilterListName $_.title -OnlyCheckedOutFiles | %{

            $ItemUrl = $SPSite + &quot;/&quot; + $_.Url

            New-Object PSObject -Property @{
                ParentWebsite = $SPWeb.ParentWeb.title
                ParentWebsiteUrl = $SPWeb.ParentWeb.Url
                Website = $SPWeb.title
                WebsiteUrl = $SPWeb.Url
                List = $SPList.title
                ListUrl = $SPListUrl
                FileExtension = [System.IO.Path]::GetExtension($_.Url)
                IsCheckedOut = $true
                IsASubversion = $false
                Item = $_.LeafName
                ItemUrl = $ItemUrl
                Folder = $ItemUrl -replace &quot;[^/]+$&quot;,&quot;&quot;
                FileSize = $_.Length / 1000000
            }

        }
    }
} | Export-Csv &quot;Report SharePoint Files.csv&quot; -Delimiter &quot;;&quot; -Encoding &quot;UTF8&quot; -NoTypeInformation

Most recent version of this snippet is avialable here: https://gist.github.com/janikvonrotz/6885934

Update: This script is now part of my PowerShell Profile project as a function: https://codeberg.org/janikvonrotz/Powershell-Profile/blob/master/functions/SharePoint/List/Get-SPListFiles.ps1

Backup Public GitHub Gists

Thu, 19 Sep 2013 12:52:32 +0000

To manage my code snippets I’m using GitHubGist connected with Gistbox.

Sadly none of this services providing a backup nor a download function for the gist files. That’s why I came upwith the idea to download them with PowerShell script.

For first my script only can download public gists, because I don’t know how to implement an authentication, luckily each of my gists is public. I recommend you to do the same, it’s the idea of OpenSource.

So here’s the script:

[System.Reflection.Assembly]::LoadWithPartialName("System.Web.Extensions")

function Get-GitHubGists{

    param(
        [string]$UserUrl
    )

    # set up request
    $WebRequest = [System.Net.WebRequest]::Create($UserUrl)
    $WebRequest.Method ="GET"
    $WebRequest.ContentLength = 0

    # get response
    $WebRequest = $WebRequest.GetResponse()
    $WebRequest = new-object System.IO.StreamReader($WebRequest.GetResponseStream())
    $WebResponse = $WebRequest.ReadToEnd()

    # convert json
    $JavaScriptSerializer = New-Object System.Web.Script.Serialization.JavaScriptSerializer
    $GitHubGists = $JavaScriptSerializer.DeserializeObject($WebResponse)

    # download github gists
    $GitHubGists | %{

        if(Test-Path $_.id){

            cd ($_.id)
            Write-Host "Update GitHubGist: $($_.description)"
            git pull
            cd ..

        }else{

            Write-Host "Cloning GitHubGist: $($_.description)"
            git clone ($_.git_pull_url)
        }
    }
}

Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=1
Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=2
Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=3

Latest version: https://gist.github.com/6622205

ExchangeOnline OWA Policies - Disable OWA light

Mon, 09 Sep 2013 09:11:32 +0000

To alter the Exchange owa policies you can access them Using the Office365 administration site and navigate to the Exchange section. In the default policy editor are only limited options available.

In case you would like f.e. disable the outlook wep app light (which is not available in the web editor), you have to use the almighty PowerShell console.


Get-OwaMailboxPolicy -Identity "OwaMailboxPolicy-Default" | Set-OwaMailboxPolicy -OWALightEnabled $false

Manage ActiveDirectory Distribution Groups

Tue, 27 Aug 2013 12:39:11 +0000

With Office365 connected with an ADFS you have to redesgin your Exchange distribution groups. ADFS only syncs distribution groups that have these definitions:

My idea was simple, I’m developing a script that creates for every OU and child OU I’m chosing in the ActiveDirectory structure a distribution list containing the users of the chosen OU recursively.

While developing this I’ve added some cool features, in addition you can:

By default the script will only add enabled users with an email address.

This script makes use of the PowerShell Profile environment, f.e. the function Send-PPErrorReport sends an error report per email when the script fails or produces problems.

<#
$Metadata = @{
    Title = "New ActiveDirectory Distribution Groups"
    Filename = "New-ADDistributionGroups.ps1"
    Description = "Create or update ActiveDirectory distribution groups"
    Tags = "powershell, activedirectory, distribution, groups, create, update"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-27"
    LastEditDate = "2013-09-30"
    Url = "https://gist.github.com/6352037"
    Version = "1.1.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module ActiveDirectory

# set OUs where the distributions groups should be enabled
$OUs = @(
    @{Name = "OU=Betrieb,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Direktion,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Finanzen,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Personal,OU=vblusers2,DC=vbl,DC=ch"},
    @{Name = "OU=Technik,OU=vblusers2,DC=vbl,DC=ch"}
)

# list of users to exclude in distribution groups
$ExcludeUsers = "abascan","ba test","ba-service"

# list of distribution groups to exclude
$ExcludeOUs = "Verwaltungsrat"

# special configuration to handle special
$Configs = @(
    @{
        Name = "GL";
        Options = @("UpdateFromGroups");
        AddGroups = @("Geschäftsleitung Gruppe")
    },
    @{
        Name = "GL erw";
        Options = @("UpdateFromGroups");
        AddGroups = @("Erweiterte Geschäftsleitung Gruppe")
    },
    @{
        Name = "Alle";
        Options = @("UpdateFromGroups");
        AddGroups = @("Technik","Betrieb","Personal","Finanzen","GL","Kommunikation","Sekretariat")
    },
    @{
        Name = "Alle mit Arbeitsplatz";
        Options = @("UpdateFromGroups","RemoveGroups");
        AddGroups = @("Alle");
        RemoveGroups = @("SPO_365E1License")
    },
    @{
        Name = "Alle ohne Arbeitsplatz";
        Options = @("UpdateFromGroups");
        AddGroups = @("SPO_365E1License");
    },
    @{
        Name = "Fahrdienst A - Hermann M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Hermann M Gruppe");
    },
    @{
        Name = "Fahrdienst A - Segui M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst A - Segui M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Nietlispach M";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Nietlispach M Gruppe");
    },
    @{
        Name = "Fahrdienst B - Zaugg D";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst B - Zaugg D Gruppe");
    },
    @{
        Name = "Fahrdienst C - Habegger R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Habegger R Gruppe");
    },
    @{
        Name = "Fahrdienst C - Malbasic N";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst C - Malbasic N Gruppe");
    },
    @{
        Name = "Fahrdienst D - Küchler P";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Küchler P Gruppe");
    },
    @{
        Name = "Fahrdienst D - Zimmermann L";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst D - Zimmermann L Gruppe");
    },
    @{
        Name = "Fahrdienst E - Bechter K";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Bechter K Gruppe");
    },
    @{
        Name = "Fahrdienst E - Brunner R";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst E - Brunner R Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri René";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri René Gruppe");
    },
    @{
        Name = "Fahrdienst F - Bieri Urs";
        Options = @("UpdateFromGroups");
        AddGroups = @("Fahrdienst F - Bieri Urs Gruppe");
    },
    @{
        Name = "Verkehrsdisponnenten";
        Options = @("UpdateFromGroups");
        AddGroups = @("F_Verkehrsdisponnenten");
    },
    @{
        Name = "Personalkommission";
        Options = @("UpdateFromGroups");
        AddGroups = @("Personalkommission Abteilung");
    }
)

# get all OUs recursive
$OUs = $OUs | %{Get-ADOrganizationalUnit -Filter "*" -SearchBase $_.Name} | where {-not ($ExcludeOUs -contains $_.Name)}

# check in every OU if a distribution group with the same name as the OU exist
$OUs | %{$OU = $_.DistinguishedName;
    if(Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"} | Where-Object{$_.DistinguishedName -like "*$OU"}){

        Write-Host "Update users in distribution group $($_.Name)."
        $ADGroup = Get-ADGroup -Filter {SamAccountName -eq $_.Name -and GroupCategory -eq "Distribution"}
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $OU | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }else{

        Write-Host "Create distribution group $($_.Name)."
        New-ADGroup -Name $_.Name -SamAccountName $_.Name -GroupCategory Distribution -GroupScope Universal -DisplayName $_.Name -Path $($_.DistinguishedName) -Description "Distribution group for $($_.Name)."
        $ADGroup = Get-ADGroup $_.Name
        Get-ADUser -Filter {EmailAddress -like "*"} -SearchBase $_.DistinguishedName | where {$_.enabled -eq $true -and -not ($ExcludeUsers -contains $_.Name)} | where{$_ -ne $null} | %{Add-ADGroupMember -Identity $ADGroup -Members $_}
    }
}

# custom configuration
$Configs | %{

    $ADGroup = Get-ADGroup -Identity $_.Name
    $Config = $_

    if($_.Options -match "UpdateFromGroups"){

        Write-Host "Add users from $($Config.AddGroups) to $($ADGroup.Name)."
        Get-ADGroupMember -Identity $ADGroup | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}
        $Config.AddGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique | %{Add-ADGroupMember -Identity $ADGroup -Members $_}

    }

    if($_.Options -match "RemoveGroups"){

        Write-Host "Remove users from $($Config.RemoveGroups) in $($ADGroup.Name)."
        $ADGroupMembers = Get-ADGroupMember -Identity $ADGroup
        $Config.RemoveGroups | %{Get-ADGroupMember -Identity $_ -Recursive | Get-ADUser | where {($ADGroupMembers -match $_) -and ($_.enabled -eq $true) -and -not ($ExcludeUsers -contains $_.Name)}} | select -Unique  | %{Remove-ADGroupMember -Identity $ADGroup -Members $_ -Confirm:$false}

    }
}

if($error){
    Send-PPErrorReport -FileName "activedirectory.mail.config.xml" -ScriptName $MyInvocation.InvocationName
}

Latest version of this script: https://gist.github.com/6352037

Office365 and ADFS: Activate licenses for users depending on AD group membership

Tue, 13 Aug 2013 07:48:44 +0000

On Office365 the users have to be licensed in order to get access to the Office365 application. I’ve developed a PowerShell script which add a license depending on the group membership in the ActiveDirectory.

<#
$Metadata = @{
    Title = "Set Office365 Licenses by ActiveDirectory Group Membership"
    Filename = "Set-O365UserLicensesByADGroup.ps1"
    Description = @"
Adding license to a Office365 user as long the user is in the correct ActiveDirectory group
or in the white list, the users is active, the user has a mailbox.
The script will remove inactive licenses or if necessary replace them.
"@
    Tags = "powershell, activedirectory, office365, user, license, activation"
    Project = ""
    Author = "Janik von Rotz"
    AuthorContact = "https://janikvonrotz.ch"
    CreateDate = "2013-08-13"
    LastEditDate = "2013-09-30"
    Url = "https://gist.github.com/janikvonrotz/6218401"
    Version = "3.0.0"
    License = @'
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Switzerland License.
To view a copy of this license, visit https://creativecommons.org/licenses/by-sa/3.0/ch/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

#--------------------------------------------------#
# settings
#--------------------------------------------------#

$UsageLocation = "CH"

$WhiteList = @{
    UserPrincipalName = "admin@vbluzern.onmicrosoft.com"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.testoff368@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.test07@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.test@vbl.ch"
    License = "vbluzern:STANDARDPACK"
},
@{
    UserPrincipalName = "bison.testoff367@vbl.ch"
    License = "vbluzern:STANDARDPACK"
}


$LicenseConfig = @{
    Name = "SharePoint Online Plan 1"
    License = "vbluzern:SHAREPOINTSTANDARD"
    ADGroupSID = "S-1-5-21-1744926098-708661255-2033415169-37562" # SPO_SharePointOnlinePlan1License
    Rule = ""
},
@{
    Name = "Enterprise Plan 1"
    License = "vbluzern:STANDARDPACK"
    ADGroupSID = "S-1-5-21-1744926098-708661255-2033415169-36657" # SPO_365E1License
    Rule = "MailBoxExistOnline"
}

#--------------------------------------------------#
# modules
#--------------------------------------------------#
Import-Module MSOnline
Import-Module MSOnlineExtended
Import-Module ActiveDirectory

#--------------------------------------------------#
# main
#--------------------------------------------------#

# import credentials
$Credential = Import-PSCredential $(Get-ChildItem -Path $PSconfigs.Path -Filter "Office365.credentials.config.xml" -Recurse).FullName

Write-Host "Get Office365 users"
# connect to office365
Connect-MsolService -Credential $Credential
$MsolUsers = Get-MsolUser -All

Write-Host "Get ExchangeOnline mailboxes"
# import session
$s = New-PSSession -ConfigurationName Microsoft.Exchange `
    -ConnectionUri https://ps.outlook.com/powershell `
    -Credential $(Get-Credential -Credential $Credential) `
    -Authentication Basic `
    -AllowRedirection
$EOMailboxes = Invoke-Command -Session $s -ScriptBlock{Get-MailBox} | select UserPrincipalName | %{"$($_.UserPrincipalName)"}
# remove session"
Remove-PSSession $s

# combine users and their license
$LicenseAndUser = ($LicenseConfig |
    %{$License = $_ ; Get-ADGroupMember $_.ADGroupSID -Recursive | Get-ADUser | where{$_.Enabled -eq $true} |
    %{$_ | select UserPrincipalName, @{Name = "License"; Expression = {$License.License}}, @{Name = "Rule"; Expression = {$License.Rule}}}
    }) + ($WhiteList | select  @{Name = "UserPrincipalName"; Expression = {$_.UserPrincipalName}},
    @{Name = "License"; Expression = {$_.License}},
    @{Name = "Rule"; Expression = {""}})


foreach($User in $MsolUsers){

    # first check whitelist
    $Config = $LicenseAndUser | where{$_.UserPrincipalName -eq $User.UserPrincipalName}

    if(($Config) -and ((($Config.Rule -eq "MailBoxExistOnline") -and ($EOMailboxes -contains $User.UserPrincipalName)) -or ($Config.Rule -eq ""))){

        if($User.IsLicensed -and ($User.Licenses.AccountSkuId -ne $Config.License)){

            Write-Host "Replace Office365 license: $($User.Licenses.AccountSkuId) with: $($Config.License) for user: $($User.UserPrincipalName)"
            $User.Licenses | %{Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -RemoveLicenses $_.AccountSkuId}
            Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $Config.License

        }elseif($User.IsLicensed){

            Write-Host "User: $($User.UserPrincipalName) is already licensed with: $($Config.License)"

        }else{

            Write-Host "Set Office365 license: $($Config.License) for user: $($User.UserPrincipalName)"
            Set-MsolUser -UserPrincipalName $User.UserPrincipalName -UsageLocation $UsageLocation
            Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -AddLicenses $Config.License

        }

    }else{

        if($User.IsLicensed){

            Write-Host "Remove Office365 license: $($User.Licenses.AccountSkuId) from user: $($User.UserPrincipalName)"
            $User.Licenses | %{Set-MsolUserLicense -UserPrincipalName $User.UserPrincipalName -RemoveLicenses $_.AccountSkuId}

        }else{

            Write-Host "User: $($User.UserPrincipalName) is not allowed"

        }
    }
}

if($error){

    Send-PPErrorReport -FileName "DirSync.mail.config.xml" -ScriptName $MyInvocation.InvocationName

}

You’ll get your Office365AccountName with this Office365 command Get-MsolAccountSku

Link to the newest version of this script: https://gist.github.com/janikvonrotz/6218401

Manage Users in ActiveDirectory with PowerShell

Fri, 09 Aug 2013 10:18:06 +0000

The PowerShell ActiveDirectory modules from Microsoft are definitely a pain. That’s why Quest (Dell) has developed a bunch of CMDlets to make the user management through PowerShell a lot easier.

I would like to show you how I create and update my AD users.

As base there’s always a CSV file like this one: TemplateADUsers

To a new user I’ll use this script:


Import-Module Quest.ActiveRoles.ArsPowerShellSnapIn

$ADUsers = Import-CSV "ADUsers.csv" -Delimiter ";"
$ADUsers | foreach{
    if(!(Get-QADUser $_.Name)){

        Write-Host "Creating User" $_.Name

        # create a new user
        New-QADUser -Name $_.Name `
            -DisplayName $_.DisplayName `
            -FirstName $_.givenName `
            -LastName $_.LastName `
            -Company $_.company `
            -PostalCode $_.postalCode `
            -PostOfficeBox $_.postOfficeBox `
            -StreetAddress $_.streetAddress `
            -WebPage $_.wWWHomePage `
            -City $_.l `
            -Department $_.department `
            -Manager $_.manager `
            -Title $_.title `
            -Email $_.mail `
            -UserPrincipalName $_.mail `
            -ParentContainer $_.OU `
            -samAccountName $_.samAccountName `
            -UserPassword $_.Password `
            -ObjectAttributes @{
                extensionAttribute1= $_.extensionAttribute1;
                extensionAttribute2 = $_.extensionAttribute2;
                extensionAttribute3 = $_.extensionAttribute3;
                co = $_.co
                c = $_.c

            }` |
        Set-QADUser -PasswordNeverExpires $true |
        Out-Null

        # update group memberships
        $ADMemberOfs = $_.MemberOf -split ","
        foreach( $ADMemberOf in  $ADMemberOfs){
            Write-Host "Add User $($_.Name) to the group $ADMemberOf"
            Add-QADMemberOf $_.Name -Group $ADMemberOf | Out-Null
        }

    }else{

        Write-Host $_.Name "Already exist"

    }
}

To update the users attributes I made this handy script:


Import-Module Quest.ActiveRoles.ArsPowerShellSnapIn

$ADUsers = Import-CSV "ADUsers.csv" -Delimiter ";"
$ADUsers | foreach{
    if((Get-QADUser $_.Name)){

        <# change Attributes

        Write-Host "Updating User" $_.Name
        Set-QADUser -Identity $_.Name `
            -Company $_.company `
            | Out-Null

        #>

        # update group memberships
        $ADMemberOfs = $_.MemberOf -split ","
        foreach( $ADMemberOf in  $ADMemberOfs){
            Write-Host "Add User $($_.Name) to the group $ADMemberOf"
            Add-QADMemberOf $_.Name -Group $ADMemberOf | Out-Null
        }

    }else{

        Write-Host $_.Name "doesnt' exist"

    }
}