Just can't get enough of IT

Problem

You can block an user from logging on to Office 365 by setting the BlockCredential attribute to $true.

Set-MsolUser -UserPrincipalName myuser@mcsmemail.de -BlockCredential $true

But the MSOL user attribute is reverted to $false, when ADD Connect synchonization cycle runs.

This happens, because the local Active Directory attribute accountEnabled is used to controll the BlockCredential attribute in Azure AD.

Solution

If your IT operation requires the ability to have enabled users in your local Active Directory infrastructure and you need to prevent logon to cloud services you need to prevent the accountEnabled attribute from being synchronized to Azure AD. This might not necessarily be a general requirement during normal operations, but might be useful while doing a Proof-of-Concept.

Just exclude the attribute from the Azure Active Directory connector in the Synchronization Service Manager.

The following script disables all users excluding

• Users following a specific naming pattern
• Users listed in a string array

# Userfilter
$UserExceptions = ("Sync_SYNC01_add98768492f@mcsmemail.onmicrosoft.com","SPO-SRV-ACCOUNT@mcsmemail.de","SynchedAdmin@mcsmemail.de")

# Fetch synchronized users 
$DomainAccounts = Get-MsolUser -EnabledFilter EnabledOnly -MaxResults 5000 | Where-Object -Property LastDirSyncTime -ne $null

# Select synchronized users not following the pattern ADM*@mcsmemail.de (admin accounts in this case)
$DomainAccountsWithoutAdmins =  $DomainAccounts | Where-Object -Property UserPrincipalName -notlike "ADM*@mcsmemail.de"

# Exclude accounts listed in $UserExceptions
$DomainAccountsWithoutAdminsFiltered = $DomainAccountsWithoutAdmins | Where-Object -Property UserPrincipalName -NotIn $UserExceptions
 

# Now block cloud logon for all filtered users
ForEach ($User2Block in $DomainAccountsWithoutAdminsFiltered) {
  Write-Host ('Disabling User: {0}.UserPrincipalName)' -f $User2Block)
  Set-MsolUser -UserPrincipalName $User2Block.UserPrincipalName -BlockCredential $true
}

Enjoy Office 365.

The PowerShell module GlobalFunctions got updated to Version 2.0. This module is used by some of my PowerShell scripts which utilize centralized logging. 

The new release contains the first functions required for some upcoming scripts for managing on-boarding process for joiners and the off-boarding process for leavers for companies utilizing Office 365.

Changes

• File encoding switch from UTF8 to Unicode
• New functions
  • Format-SpecialCharactersUpperCase
  • New-RandomPassword

Notes

The New-RandomPassword functions is based on Simon Wahlin's script published here: https://gallery.technet.microsoft.com/scriptcenter/Generate-a-random-and-5c879ed5

Links

• Original blog post: https://www.granikos.eu/en/justcantgetenough/PostId/210/globalfunctions-shared-powershell-library
• Easiest install via PowerShell Gallery: https://www.powershellgallery.com/packages/GlobalFunctions
• Report issues at Github: https://github.com/Apoc70/GlobalFunctions

As an Exchange administrator you normally perform tasks by executing PowerShell scripts. Some of these scripts are executed automatically, some are run manually as these scripts require more attention.

Think about a completely different approach. Have you ever thought about administrating Exchange Server or your Exchange Online instance using your voice?

Thanks to Alexa skills we can do something like

"Alexa, ask Exchange Assistant to create a new mailbox for John Doe"

"Alexa, is the CEO's mailbox in good shape?"

Or run something more complicated

"Alexa, start Exchange to setup 5 new Exchange servers, please"

Sounds like magic, right?

Solution

As a solution we use the following technologies:

• Alexa custom skills extension for Exchange
• Azure subscription supporting
  • Azure Web API
  • Azure Automation
• Azure Hybrid Runbook Worker

The Azure Hybrid Runbook Worker enables you to execute PowerShell runbooks in your local infrastructure to manage local ressources.

How does it work

The solution consists of a Visual Studio Solution acting as an Alexa skill endpoint. The configured intents connect to your Azure Automation webhooks and trigger the execution of preconfigured PowerShell automation runbooks.

These runbooks can either run againt Azure resources or against your local infrastructure. Automation of your local infrastructure requires the setup of the Azure Hybrid Runbook Worker components.

The following diagram illustrates the functionality.

Requirements

• You need to have an Amazon Alexa device
• You need to have an Amazon Alexa Developer account
• You need to have an active Microsoft Azure subscription
• You need to deploy the Hybrid Runbook Worker component in your local infrastructure, if you want to automate your local infrastrucute

Preparation

The solution utilizes the Azure4Alexa and AlexaSkillsSet.NET projects available on Github. Currently the approach requires some manual steps and Visual Studio knowledge, as you want to deploy your own Alexa custom application. This is primarily driven due to security demands. The Hybrid Runbook Worker can access your local infrastructure. So you went to be in charge of the credentials used to access your infrastructure.

1. Clone the Visual Studio solution from Github (https://github.com/Apoc70/ExchangeSpeechAssistant)
2. Follow the description provided here to setup your personal Alexa developer account and to get your Azure trial subscription to host the application
3. Publish the Visual Studio solution as an intital endpoint to setup your Alexa custom skill
   This results in a simple web page demonstrating the new Azure Web App
   
4. Modify the AlexaConstants.cs to use your Application Id
5. Re-Publish the Visual Studio solution with your custom Application Id
6. Prepare your local infrastructure for the use with Hybrid Runbook Worker
   1. Installing Hybrid Runbook Worker
   2. Create a Runbook Automation Account
      
   3. Create a runbook for whatever action you want to execute
      

Start enjoying how your administrator's can orchestrate your Exchange Server environment.

Links

• Alexa Developer Account
• AlexaSkillsSet.NET (implemented by Alexa4Azure)
• Additonal Notes

Enjoy your wonderful life with Exchange :-)

Description

This script has been developed for a custom project with the following requirements:

• User photos are provided in rectangular format by the HR department and stored in a dedicated folder
• User photos should be resized automatically to a square format to be suitable for
  • Active Directory thumbnailPhoto attribute (96x96 pixel)
  • Exchange user photo (648x648 pixel)
  • Intrant address book (150x150 pixel)
• Processed photos should be moved to a processed folder
• User logon names are used as user photo file names

The script utilizes a self developed C# command line tool, which has been published as open source at Github. The ResizeImage Wiki explains the usage of the command line tool. The application's configuration controls the target size and an optional pixel based offset.

Maybe the script will be useful in your project as well.

Requirements

• ResizeImage.exe command line tool
• GlobalFunctions PowerShell module as desribed here
• Exchange Server 2013+ Management Shell (EMS) for storing user photos in on-premises mailboxes
• Exchange Online Management Shell for storing user photos in cloud mailboxes
• Write access to thumbnailPhoto attribute in Active Directory

Examples

The code samples utilize the following folder structure:

• D:\UserPhotos
  • SOURCE
    Contains all .JPG user photos with file names matching the user logon names
  • AD
    Target folder for tumbnailPicture photos (96 x 96 px)
    • ResizeImage.exe
    • ResizeImage.exe.config (local configuration for Active Directory photos)
  • EXCHANGE
    Target folder for Exchange mailbox user photos (646 x 648 px)
    • ResizeImage.exe
    • ResizeImage.exe.config (local configuration for Exchange mailbox photos)
  • INTRANET
    Target folder for Intranet address book user photos (150 x 150 px)
    • ResizeImage.exe
    • ResizeImage.exe.config (local configuration for Intranet photos)

Code Samples

# EXAMPLE
# Resize photos stored in the default PictureSource folder for Exchange On-Premises (648x648) and write images to user mailboxes
.\Set-UserPictures.ps1 -ExchangeOnPrem   

# EXAMPLE
# Resize photos stored on a SRV01 share for Exchange Online and save resized photos on a SRV02 share
.\Set-UserPictures.ps1 -ExchangeOnline -PictureSource '\\SRV01\HRShare\Photos' -TargetPathExchange '\\SRV02\ExScripts\Photos'

 # EXAMPLE
 # Resize photos stored in the default PictureSource folder for Active Directory (96x96) and write images to user thumbnailPhoto attribute
 .\Set-UserPictures.ps1 -ActiveDirectory

# EXAMPLE
# Resize photos stored in the default PictureSource folder for Intranet (150x150)
.\Set-UserPictures.ps1 -Intranet

Version History

• 1.0, Initial community release
• 1.1, Exchange Online support added
• 1.2, Log strings updated when updating Exchange photos

Links

• Download and follow at Github: https://github.com/Apoc70/Set-UserPictures
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Bulk-resize-and-adding-of-1e74d85e
• ResizeImage tool source code and binary available at Github
  • Visual Studio solution: https://github.com/Granikos/ResizeImage
  • Current release: https://github.com/Granikos/ResizeImage/releases

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

Problem

When you integrate Skype for Business Server instant messaging with Exchange Server 2013 or Exchange Server 2016 you might encounter the following error in the OWA InstantMessaging log files.

ERROR:UCWEB Failure: Code=TlsFailure, SubCode=TlsRemoteDisconnected, Reason=\r\n
Microsoft.Rtc.Internal.UCWeb.Utilities.UCWException: Unknown error (0x80131500) 
---> Microsoft.Rtc.Signaling.TlsFailureException: Unknown error (0x80131500) 
---> Microsoft.Rtc.Internal.Sip.RemoteDisconnectedException: Peer disconnected while outbound capabilities negotiation was in progress 
---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\r\n   
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)\r\n   
at Microsoft.Rtc.Internal.Sip.TcpTransport.OnReceived(Object arg)\r\n   
--- End of inner exception stack trace ---\r\n   
--- End of inner exception stack trace ---\r\n   
at Microsoft.Rtc.Signaling.SipAsyncResult`1.ThrowIfFailed()\r\n   
at Microsoft.Rtc.Signaling.Helper.EndAsyncOperation[T](Object owner, IAsyncResult result)\r\n   
at Microsoft.Rtc.Internal.UCWeb.UCWAuthenticatedEndpoint.OotyUserEndpointEstablish_callback(IAsyncResult asyncResult)\r\n   
--- End of inner exception stack trace ---\r\n   
at Microsoft.Rtc.Internal.UCWeb.Utilities.AsyncHelper.EndAsyncCall[T](IAsyncResult asyncResult, String methodName, T ucwScopeInstance)\r\n   
at Microsoft.Rtc.Internal.UCWeb.UCWAuthenticatedEndpoint.EndSignIn(IAsyncResult asyncResult)\r\n   
at Microsoft.Exchange.Clients.Owa2.Server.Core.InstantMessageOCSProvider.<>c__DisplayClass33.<SignInCallback>b__32(RequestDetailsLogger logger)

The log files are located at

\Program Files\Microsoft\Exchange Server\V15\Logging\OWA\InstantMessaging

Solution

The Exchange Server OWA host name must be the common name (CN) of the SSL certificate used securing OWA communication.

Example for a non working IM configuration

• OWA host name: owa.varunagroup.de
• SSL certificate CN: mobile.varunagroup.de

Example for a working IM configuration

• OWA host name: owa.varunagroup.de
• SSL certificate CN: owa.varunagroup.de

Links

• Integrate Skype for Business Server 2015 and Microsoft Outlook Web App
  https://technet.microsoft.com/en-us/library/jj688055.aspx
• Configure instant messaging integration with Outlook on the web in Exchange 2016
  https://technet.microsoft.com/en-us/library/mt607043(v=exchg.160).aspx