de-DEen-GB
rss

Granikos Technology Blog

Das Exchange Blog Cumulative Update für März 2017 (CU0317) fasst interessante Themen rund um Exchange Server und Office 365 (Exchange Online), Azure und Skype for Business (aka Lync) des Monats März 2017 zusammen.

Exchange Server

Office 365 & Exchange Online

Skype for Business, Lync Server & Communication

Microsoft Azure

Cloud Themen & Cloud Sicherheit

Knowledge Base & TechNet

Replay

Podcast Empfehlungen

Tools

 


Gerne unterstützen wir Sie bei der Planung und Durchführung Ihrer Exchange Server Implementierung oder Migration.

Sie denken über einen vollständigen Wechsel zu Office 365 oder eine Hybrid-Konfiguration mit Office 365 nach? Wir beraten Sie umfassend und ausführlich über die Möglichkeiten der Office 365 Plattform.

Sie möchten mehr über Exchange Server 2016 erfahren? Gerne erläutern wir Ihnen die technischen Änderungen und Chancen für Ihr Unternehmen in einem persönlichen Workshop.

Weitere Informationen zu unseren Dienstleistungen finden Sie auf unserer Website (https://www.granikos.eu) oder Sie kontaktieren direkt unser Vertriebsteam: info@granikos.eu

Weiterlesen »

Problem

While trying to synchronize a new device with an Exchange mailbox, you receive an error with your new mobile phone partnership.

The Exchange Server 2010 Default Throttling Policy is configured to accept 10 ActiveSync devices per mailbox only.

You can validate this setting by using EMS

Get-ThrottlingPolicy def* | Select Name,EASMaxDevices

Solution

Use a scheduled PowerShell script to delete old ActiveSync Device partnerships that have not been used for a defined period of time.

Script

Find the most recent version on TechNet Gallery and Github, following the links provided in the Links section.

Modifiy the script path variables to fit your requirements. The variables are configured in the ### BEGIN Variables section.

Steps being executed:

  1. Fetch all user mailboxes
  2. Iterate through each user mailbox and determines the number of ActiveSync devices and the number of devices which have not synchronized since 150 days
  3. Delete ActiveSync device registration, if a user has more than 4 devices in total and a minimum of 1 device that have not synced within 150 days
<#
    .SYNOPSIS
    Remove Exchange Server 2010 ActiveSync Device Partnerships 
   
   	Sebastian Rubertus / Thomas Stensitzki
	
	THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE 
	RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.

    Send comments and remars to: support@granikos.eu
	
	Version 1.0, 2015-04-09
 
    .LINK  
    More information can be found at http://www.rubertus.net/Blog/tabid/85/EntryId/41/Scripted-removing-of-ActiveSync-Device-Partnerships.aspx 
	
    .DESCRIPTION

    THis script removes ActiveSync device association from user mailboxes
    that have been inactive for more than 150 days.

    .NOTES 
    Requirements 
    - Exchange Server 2010
    - Windows Server 2008 R2 SP1, Windows Server 2012 or Windows Server 2012 R2  

    Revision History 
    -------------------------------------------------------------------------------- 
    1.0     Initial community release 
    
    .EXAMPLE
    Remove-ActiveSyncDevicePartnership
    	
    #>

### BEGIN SnapIns -------------------------------------------------------------

# Add Exchange SnapIn if not already loaded
if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction SilentlyContinue) -eq $null )
{
    Add-PsSnapin Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction SilentlyContinue
   
    if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010 -ErrorAction SilentlyContinue) -eq $null )
    {
        Write-Host "Microsoft.Exchange.Management.PowerShell.Admin could NOT be loaded!" -ForegroundColor Red
        Write-Host "Verify that the Exchange 2010 Management is installed on this computer!" -ForegroundColor Red
    }
}

### END SnapIns ---------------------------------------------------------------

### BEGIN Variables | EDIT ACCORDING TO YOUR NEEDS ----------------------------

# ScriptPath
$scriptPath = "C:\Scripts\Remove-ActiveSync-Devices\"

# Logfile
$logfile = "C:\Scripts\Remove-ActiveSync-Devices\Logs\$(get-date -format yyyy-MM-dd___HH-mm-ss)___Logname.log"

### END Variables -------------------------------------------------------------


### BEGIN Functions -----------------------------------------------------------

Function Log
{
   Param ([string]$logstring)
   Add-content $logfile -value "$(get-date -format yyyy-MM-dd___HH-mm-ss) $logstring "
}

### END Functions -------------------------------------------------------------

### BEGIN Main ----------------------------------------------------------------

# Create a new log file
Write-Host
Write-Host "Script started, creating Log File."
Log "Script started."
Write-Host

# Query User Mailboxes and Device Statistics
Write-Host "Querying User Mailboxes, please wait a few seconds..." -ForeGroundColor green
Log "Querying User Mailboxes."
Write-Host
$Mailboxes = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited -WarningAction SilentlyContinue
$NumberOfMailboxes = $Mailboxes.count
Write-Host "Number of Mailboxes: $NumberOfMailboxes "
Log "Number of Mailboxes: $NumberOfMailboxes "
Write-Host

# Iterate each User Mailbox
ForEach ($Mailbox in $Mailboxes)
{
    $MailboxAlias = $Mailbox.Alias
    Write-Host
    Write-Host "================================================================================="
    Write-Host
    Write-Host "Getting ActiveSync Devices from user $MailboxAlias..."
    Log "Getting ActiveSync Devices from user $MailboxAlias. "
    $AllDevicesFromSpecificUser = Get-ActiveSyncDevice -Mailbox $MailboxAlias -Result Unlimited  -WarningAction SilentlyContinue | Get-ActiveSyncDeviceStatistics -WarningAction SilentlyContinue
    $AllDevicesFromSpecificUserNotSynchronizedSince150Days = Get-ActiveSyncDevice -Mailbox $MailboxAlias -Result Unlimited  -WarningAction SilentlyContinue | Get-ActiveSyncDeviceStatistics  -WarningAction SilentlyContinue | Where {$_.LastSuccessSync -le (Get-Date).AddDays("-150")}
    Write-Host
    $CountAllDevicesFromSpecificUser = $AllDevicesFromSpecificUser.Count
    $CountAllDevicesFromSpecificUserNotSynchronizedSince150Days = $AllDevicesFromSpecificUserNotSynchronizedSince150Days.Count
   
    If ($CountAllDevicesFromSpecificUser -lt 5)
    {
        Write-Host "User $MailboxAlias has only $CountAllDevicesFromSpecificUser ActiveSync Devices. Nothing to delete!" -ForegroundColor Green
        Log "User $MailboxAlias has only $CountAllDevicesFromSpecificUser ActiveSync Devices. Nothing to delete!"
    }
   
    If (($CountAllDevicesFromSpecificUser -gt 4) -and ($CountAllDevicesFromSpecificUserNotSynchronizedSince150Days -gt 1))
    {
        Write-Host "User $MailboxAlias has $CountAllDevicesFromSpecificUser devices. $CountAllDevicesFromSpecificUserNotSynchronizedSince150Days have not synced for more than 150 days." -ForegroundColor Red
        Log "User $MailboxAlias has $CountAllDevicesFromSpecificUser devices. $CountAllDevicesFromSpecificUserNotSynchronizedSince150Days have not synced for more than 150 days."
       
        ForEach ($Device in $AllDevicesFromSpecificUserNotSynchronizedSince150Days)
        {
            $DeviceType = $Device.DeviceType
            $DeviceFriendly = $Device.FriendlyName
            $DeviceID = $Device.DeviceID
            $DeviceFirstSyncTime = $Device.FirstSyncTime
            $DeviceLastSuccessSync = $Device.LastSuccessSync
            Write-Host
            Write-Host "ActiveSync Device 2 delete Properties: "
            Write-Host "-------------------------------------- "
            Write-Host "Type         : $DeviceType "           
            Write-Host "Friendly Name: $DeviceFriendly "
            Write-Host "ID           : $DeviceID "
            Write-Host "Last Sync    : $DeviceLastSuccessSync " -ForegroundColor Red
            Log "Removing Device $DeviceType with ID $DeviceID ..."
            Write-Host
            Write-Host "Removing Device $DeviceID ..." -ForegroundColor Red
            $Device | Remove-ActiveSyncDevice -WarningAction SilentlyContinue
        }
    }
}

# Script finished
Write-Host
Write-Host "Script finished!"
Write-Host
Log "Script finished!"

### END Main ------------------------------------------------------------------

Links

 


You need assistance with your Exchange Server setup? You have questions about your Exchange Server infrastructure and going hybrid with Office 365? Contact us at office365@granikos.eu or visit our website http://www.granikos.eu.

 

Weiterlesen »

You can use PowerShell to manage your local certificate store.

The default PowerShell Get-ChildItem cmdlet allows for accessing the local certificate store. But you should start your PowerShell shell windows as administrator, as access might be restricted by GPO settings.

 

List all certificate folder on the local machine

Get-ChildItem -Path Cert:\LocalMachine

Name : TrustedPublisher
Name : ClientAuthIssuer
Name : Remote Desktop
Name : Root
Name : TrustedDevices
Name : SPC
Name : CA
Name : REQUEST
Name : AuthRoot
Name : WebHosting
Name : TrustedPeople
Name : My
Name : SmartCardRoot
Name : Trust
Name : Disallowed

 

List all available certificates for the computer

Get-ChildItem -Path Cert:\LocalMachine\My

    Directory: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

Thumbprint                                Subject
----------                                -------
EC225A0183DC64D864C8BEA1477822858FCEC767  CN=WMSvc-EXSRV02
E2BC29B1445FD267E5A2823591A5221D67D0D94F  CN=Microsoft Exchange Server Auth Certificate
D8EE794A39A8E04BE32A1E8BED93A3C46D15E0EF  CN=EXSRV02
60246A87C12BEB365E7B4044C926587590A3D7B6  CN=mobile.mcmemail.de, O=mcmemail, C=DE
5F103D6C61BF57D86DB4AAA05597B0D1E8155884  CN=EXSRV02.mcmemail.de, CN=EXSRV02, CN=127.0.0.1, CN=localhost, O=Trend Micro.

 

Retrieve certificate details

The example shows a self-signed certificate of a Trend Micro ScanMail for Exchange setup.

$cert = Get-ChildItem -Path Cert:\LocalMachine\My\5F103D6C61BF57D86DB4AAA05597B0D1E8155884
$cert | fl

Subject      : CN=EXSRV02.mcmemail.de, CN=EXSRV02, CN=127.0.0.1, CN=localhost, O=Trend Micro ScanMail for Microsoft
               Exchange
Issuer       : CN=EXSRV02.mcmemail.de, CN=EXSRV02, CN=127.0.0.1, CN=localhost, O=Trend Micro ScanMail for Microsoft
               Exchange
Thumbprint   : 5F103D6C61BF57D86DB4AAA05597B0D1E8155884
FriendlyName :
NotBefore    : 17.11.2014 00:00:00
NotAfter     : 16.11.2017 00:00:00
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid}

 

A certificate issued by an Enterprise CA looks like this

$cert = Get-ChildItem -Path Cert:\LocalMachine\My\60246A87C12BEB365E7B4044C926587590A3D7B6
$cert | fl

Subject      : CN=mobile.mcmemail.de, O=mcmemail, C=DE
Issuer       : CN=mcmemail-DC01-CA, DC=mcmemail, DC=de
Thumbprint   : 60246A87C12BEB365E7B4044C926587590A3D7B6
FriendlyName : mcmemail Exchange Server 2013 Certificate
NotBefore    : 28.08.2014 15:14:04
NotAfter     : 28.08.2015 15:24:04
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
               System.Security.Cryptography.Oid...}

 

Export a single certificate

$cert | Export-Certificate -FilePath C:\tmp\cert1.p7b -Type p7b

    Directory: C:\tmp

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---        23.12.2014     11:56       1380 cert1.p7b

 

Export multiple certificates as serialized certificates

$certarray = @()
$certarray += $cert
$cert = Get-ChildItem -Path Cert:\LocalMachine\My\D8EE794A39A8E04BE32A1E8BED93A3C46D15E0EF
$certarray += $cert
$certarray

Directory: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

Thumbprint                                Subject
----------                                -------
60246A87C12BEB365E7B4044C926587590A3D7B6  CN=mobile.mcmemail.de, O=mcmemail, C=DE
D8EE794A39A8E04BE32A1E8BED93A3C46D15E0EF  CN=EXSRV02

$certarray | Export-Certificate -FilePath c:\tmp\certs.sst -Type SST

    Directory: C:\tmp

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---        23.12.2014     11:58       3056 certs.sst 

 

Enjoy working with certificates.

 


You plan to upgrade to Exchange Server 2013? You wonder what the benefits of Office 365 are? Contact us at info@granikos.eu

Weiterlesen »

The Community Script blog post has been updated, as a new script has been added to the Technet Gallery.

Updated blog post: http://www.granikos.eu/de/Blog/PostId/36/powershell-scripts-for-the-community

Enjoy

Weiterlesen »

Uninstalling Exchange Server 2013 will fail, if the PowerShell MachinePolicy or UserPolicy is set by GPO.

You will receive an error message referencing Microsoft KB article 981474, which refers primarily to Exchange Server 2010.


Screenshot Exchange Server 2013 Uninstall

The following PowerShell command removes the GPO setting.

 

 Set-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell -Name ExecutionPolicy -Value "" 

 

After setting the ExecutionPolicy attribute to an empty string, Exchange Server 2013 can be uninstalled successfully.

 

Links

Weiterlesen »