Just can't get enough of IT

Description

This script reads the Exchange schema version from the Active Directory schema partition.

The Exchange organization name is fetched from Active Directory automatically.
  
The script fetches at forest level:

• objectVersion of MESO Container
• rangeUpper of ms-Exch-Schema-Version-Pt 
• msExchProductId of Exchange Organization container
• objectVersion of Exchange Organization container

The script fetches at domain level:

• objectVersion of MESO Container

Examples

Code Samples

# Fetch all version information in the Active Directory forest
.\Get-ExchangeServerVersionInfo.ps1

Sample Output:

PS D:\Scripts> .\Get-ExchangeServerVersionInfo.ps1

Exchange Server Schema and Object Information for forest [VARUNA.ROOT]
Exchange Organization Name        : VARUNA-GROUP
Active Directory Schema rangeUpper: 15332

Working on VARUNA.ROOT
MESO Container objectVersion           : 13236
Exchange Configuration msExchProductId : 15.01.1466.003
Exchange Configuration objectVersion   : 16213

Working on VARUNAGROUP.DE
MESO Container objectVersion           : 13236

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Get-ExchangeServerVersionInfo
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Get-Exchange-Schema-73d3e629

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

Enjoy Exchange Server!

Sometimes you might be interested in gathering a list of all computer from an Active Directory domain in preparation for migration.

You can gather a list of all computer objects using the following command.

# Fetch a sorted list of all computer objects
Get-ADComputer -Filter * -Property * | Sort-Object Name 

The wildcard used with the Property parameter fetches all available attributes for a computer object. Check the available attributes in the result set to identify the attributes you are interested in.

# Example output for the first computer object gathered from Active Directory
(Get-ADComputer -Filter * -Property * | Sort-Object Name)[0]

AccountExpirationDate                : 
accountExpires                       : 9223372036854775807
AccountLockoutTime                   : 
AccountNotDelegated                  : False
AllowReversiblePasswordEncryption    : False
BadLogonCount                        : 0
badPasswordTime                      : 0
badPwdCount                          : 0
CannotChangePassword                 : False
CanonicalName                        : DOMAIN.local/Computers/COMPUTER01
Certificates                         : {}
CN                                   : COMPUTER01
codePage                             : 0
CompoundIdentitySupported            : {False}
countryCode                          : 0
Created                              : 9/2/2013 3:01:13 PM
createTimeStamp                      : 9/2/2013 3:01:13 PM
Deleted                              : 
Description                          : 
DisplayName                          : 
DistinguishedName                    : CN=COMPUTER01,CN=Computers,DC=DOMAIN,DC=local
DNSHostName                          : COMPUTER01.DOMAIN.local
DoesNotRequirePreAuth                : False
dSCorePropagationData                : {12/31/1600 7:00:00 PM}
Enabled                              : True
HomedirRequired                      : False
HomePage                             : 
instanceType                         : 4
IPv4Address                          : 
IPv6Address                          : 
isCriticalSystemObject               : False
isDeleted                            : 
KerberosEncryptionType               : {RC4, AES128, AES256}
LastBadPasswordAttempt               : 
LastKnownParent                      : 
lastLogoff                           : 0
lastLogon                            : 130942520427754509
LastLogonDate                        : 12/10/2015 3:02:53 PM
lastLogonTimestamp                   : 130942513734007331
localPolicyFlags                     : 0
Location                             : 
LockedOut                            : False
logonCount                           : 194
ManagedBy                            : 
MemberOf                             : {}
MNSLogonAccount                      : False
Modified                             : 12/10/2015 3:02:53 PM
modifyTimeStamp                      : 12/10/2015 3:02:53 PM
msDS-SupportedEncryptionTypes        : 28
msDS-User-Account-Control-Computed   : 0
Name                                 : COMPUTER01
nTSecurityDescriptor                 : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory                       : CN=Computer,CN=Schema,CN=Configuration,DC=DOMAIN,DC=local
ObjectClass                          : computer
ObjectGUID                           : da59afcc-e00a-430b-9cbc-01adeed568f3
objectSid                            : S-1-5-21-3143343262-845931634-422089675-1179
OperatingSystem                      : Windows 7 Professional
OperatingSystemHotfix                : 
OperatingSystemServicePack           : Service Pack 1
OperatingSystemVersion               : 6.1 (7601)
PasswordExpired                      : False
PasswordLastSet                      : 12/2/2014 7:21:09 AM
PasswordNeverExpires                 : False
PasswordNotRequired                  : False
PrimaryGroup                         : CN=Domain Computers,CN=Users,DC=DOMAIN,DC=local
primaryGroupID                       : 515
PrincipalsAllowedToDelegateToAccount : {}
ProtectedFromAccidentalDeletion      : False
pwdLastSet                           : 130619964697110685
SamAccountName                       : COMPUTER01$
sAMAccountType                       : 805306369
sDRightsEffective                    : 15
ServiceAccount                       : {}
servicePrincipalName                 : {RestrictedKrbHost/COMPUTER01, HOST/COMPUTER01, 
                                       RestrictedKrbHost/COMPUTER01.DOMAIN.local, HOST/COMPUTER01.DOMAIN.local}
ServicePrincipalNames                : {RestrictedKrbHost/COMPUTER01, HOST/COMPUTER01, 
                                       RestrictedKrbHost/COMPUTER01.DOMAIN.local, HOST/COMPUTER01.DOMAIN.local}
SID                                  : S-1-5-21-3143343262-845931634-422089675-1179
SIDHistory                           : {}
TrustedForDelegation                 : False
TrustedToAuthForDelegation           : False
UseDESKeyOnly                        : False
userAccountControl                   : 4096
userCertificate                      : {}
UserPrincipalName                    : 
uSNChanged                           : 1721509
uSNCreated                           : 45981
whenChanged                          : 12/10/2015 3:02:53 PM
whenCreated                          : 9/2/2013 3:01:13 PM

As a next step, you gather the selected information and 

# Fetch data for an operating system overview, sorted by property Name only
Get-ADComputer -Filter * -Property * | Sort-Object Name | Select Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion 

# Fetch data for an operating system overview, sorted by property OperatingSystem first, then Name 
Get-ADComputer -Filter * -Property * | Sort-Object OperatingSystem,Name | Select Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion 

You can export the gathered information to a comma separated file easily using the Export-Csv cmdlet.

# Export the gathered and sorted information to a CSV file using a semicolon as the delimiter
# Adjust the file path for the CSV file to fit your environment
Get-ADComputer -Filter * -Property * | Sort-Object OperatingSystem,Name | Select Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion | Export-Csv -Path C:\SCRIPTS\ComputerOverview.csv -NoClobber -NoTypeInformation -Delimiter ';' 

Link

• Inventorying Computers with AD PowerShell

Enjoy!

Exchange Server extends the Active Directory schema during the PrepareSchema step during setup. The steps PrepareAD, PrepareDomain, or PrepareAlLDomains create Active Directory containers and objects that are crucially important for a stable operation of Exchange Server.

There are different Active Directory objects that are used to determine, if Active Directory has a proper Exchange Server configuration up and running.

Forest level

At Active Directory forest level the following attributes are used to determine the Exchange Server release:

• rangeUpper attribute of the ms-Exch-Schema-Version-Pt schema object 
• msExchProductId attribute of the Exchange organization object in the configuration partition
• objectVersion attribute of the Exchange organization object in the configuration partition
• objectVersion of the Microsoft Exchange System Objects (MESO) container 

Domain level

At Active Directory domain level the following attribute is used to determine the Exchange Server release:

• objectVersion of the Microsoft Exchange System Objects (MESO) container 

Schema versions

Links

• Script to gather Exchange schema information across all domains in an Active Directory forest

Enjoy Exchange Server!

Description

This script removes orphaned ActiveSync device partnerships from Exchange Server 2010 user mailboxes. Run the script as a scheduled job to maintain your Exchange Server environment properly.

Modifiy the script path variables to fit your requirements. The variables are configured in the ### BEGIN Variables section.

Steps being executed by the script:

1. Fetch all user mailboxes
2. Iterate through each user mailbox and determine the number of ActiveSync devices and the number of devices which have not synchronized since 150 days
3. Delete ActiveSync device registration, if a user has more than 4 devices in total and a minimum of 1 device that has not synced within 150 days

Examples

Remove-ActiveSyncDevicePartnership

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Remove-ActiveSyncDevicePartnership
• Download and like at TechNet Gallery: https://gallery.technet.microsoft.com/Cleanup-ActiveDync-device-5ee32087

Additional Credits

Additional credits go to Sebastian Rubertus

Follow

• Twitter @stensitzki
• LinkedIn
• Xing

Problem

It might happen that a mobile device running an Android operating system is not being redirected properly by the on-premises AutoDiscover service, when the mailbox has been migrated to Office 365.

If your device is not redirected, the device prefix is not recognized by Exchange Server and therefore not being redirected properly. The new device redirect feature for Android devices was introduced in Exchange Server 2010 SP3 RU9, Exchange Server 2013 CU8, and Exchange Server 2016.

The following device prefixes are known to Exchange by default:

• Acer, ADR9, Ally, Amazon, Android, ASUS, EasClient, FUJITSU, HTC, HUAWEI, LG, LS, Moto, Mozilla, NEC, Nokia, Palm, PANASONIC, PANTECH, Remoba, Samsung, SEMC, SHARP, SONY-, TOSHIBA, Vortex, VS, ZTE

Solution

If the device prefix of your device is not part of the default list, you can add the prefix to the AutoDiscover web.config file. 

Add the device prefix to the MobileSyncRedirectBypassClientPrefixes key in the appSettings node.

  <appSettings>
    <add key="LiveIdBasicAuthModule.AllowLiveIDOnlyAuth" value="true" />
    <add key="LiveIdBasicAuthModule.ApplicationName" value="Microsoft.Exchange.Autodiscover" />
    <add key="LiveIdBasicAuthModule.RecoverableErrorStatus" value="456" />
    <add key="LiveIdBasicAuthModule.PasswordExpiredErrorStatus" value="457" />
    <add key="ActiveManagerCacheExpirationIntervalSecs" value="5" />
    <add key="ProxyRequestTimeOutInMilliSeconds" value="30000" />
    <add key="LiveIdNegotiateAuxiliaryModule.AllowLiveIDOnlyAuth" value="true" />
    <add key="TrustedClientsForInstanceBasedPerfCounters" value="bes" />
    <add key="InstanceBasedPerfCounterTimeWindowInterval" value="900000" />
    <add key="MobileSyncRedirectBypassEnabled" value="true" />
    <add key="MobileSyncRedirectBypassClientPrefixes" value="Acer,ADR9,Ally,Amazon,Android,ASUS,EasClient,FUJITSU,HTC,HUAWEI,LG,LS,Moto,Mozilla,NEC,Nokia,Palm,PANASONIC,PANTECH,Remoba,Samsung,SEMC,SHARP,SONY-,TOSHIBA,Vortex,VS,ZTE" />
  </appSettings>

File location

%ExchangeInstallPath%\ClientAccess\Autodiscover\web.config

Notes

• Modify the web.config on each Exchange 2010/2013 Client Access Server and each Exchange 2016 server.
• After installing an Exchange 2013/2016 CU, the web.config must be modified again.

As always: Be careful when modifying application settings. Test such changes in a test environment first, if possible.

Links

• Some Android devices do not redirect to Exchange Online
• Exchange ActiveSync on-boarding to Office 365
• Exchange HTTP ActiveSync Protocol: HTTP Error 451

You need assistance with your Exchange Server setup? You have questions about your Exchange Server infrastructure and going hybrid? You are interested in what Exchange Server 2016 has to offer for your environment?

Contact me at thomas@mcsmemail.de
Follow at https://twitter.com/stensitzki

Problem

The Skype for Business client merges contact data from different sources when displaying the contact card. The merged data is used to perform name resolution when performing a user search. In a more complex deployment scenario where an email domain name is in shared use in two in Active Directory forests you might run into a situation where the Skype for Business client tries to use the wrong target address.

Such a scenario would look like as follows.

Forest A is used as a dedicated infrastructure for developers. When logged on to the development network the users should be able to skype with colleagues currently connected to the default office client network.

Forest B is the default office client network.

Clients logged on to forest A connect to the Skype for Business infrastructure in forest B as external clients. Forest A is used for user account authentication while forest B is used for Skype for Business connection and authentication. 

Forest A

Forest A runs an Exchange Server 2013 organization.

• Active Directory domain: SednaDevelopers.com
• SMTP domains: dev.Sedna-Ltd.com, Sedna-Ltd.com

Forest B

Forest B runs an Exchange Server 2013 organization and a full Skype for Business 2015 server deployment.

• Active Directory domains:
  • root.internal - Forest root, resource domain with Skype for Business 2015, Exchange 2013
  • Sedna-ltd.com - user domain, primary email domain
• SMTP domain: Sedna-Ltd.com

Both Active Directory forests to not have trust of any sort established.

Such a configuration would result in forest A users trying to contact a Skype for Business user using the wrong address. Instead of using John.Doe@Sedna-Ltd.com the Skype for Business client of Jane Doe@Sedna-Ltd.com (logged on to forest A) would try to contact John.Doe@dev.Sedna-Ltd.com. As there is no endpoint defined for dev.Sedna-Ltd.com a connection could not be established. Therefore, no availability information is available and no call or chat connection could be established.

Reason

The Skype for Business client uses merged data pulled from the Skype for Business address and from the local (Forest A) Active Directory (GAL). This results in a connection attempt to John.Doe@dev.Sedna-Ltd.com.

Forest A object attributes

• proxyAddresses: SMTP:John.Doe@dev.Sedna-Ltd.com
• proxyAddresses: smtp:John.Doe@Sedna-Ltd.com
• msExchShadowProxyAddresses: sip:John.Doe@Sedna-Ltd.com
• msExchShadowProxyAddresses: SMTP:John.Doe@dev.Sedna-Ltd.com
• msExchShadowProxyAddresses: smtp:John.Doe@Sedna-Ltd.com
• msRTCSIP-UserEnabled: TRUE
• msRTCSIP-PrimaryUserAddress: John.Doe@Sedna-Ltd.com

Forest B object attributes

• proxyAddresses: sip:John.Doe@Sedna-Ltd.com
• proxyAddresses: SMTP:John.Doe@Sedna-Ltd.com
• msRTCSP-InternetAccessEnabled: TRUE
• msRTCSIP-UserEnabled: TRUE
• msRTCSIP-PrimaryUserAddress: John.Doe@Sedna-Ltd.com

Solution

• Create a new text file named ocapi_test.config.xml using notepad
• Add the following Xml text

<?xml version="1.0"?> 
<settings> 
  <UseMsoSearch>false</UseMsoSearch> 
</settings>

• Save the file in same directory as Lync.exe
• Terminate the Skype for Business client
• Delete all files from the users SIP folder
  • e.g. C:\Users\JDOE\AppData\Local\Microsoft\Office\16.0\Lync\sip_Jane.Doe@Sedna-Ltd.com
• Restart the Skype for Business client

Enjoy Skype for Business