Glen's Exchange and Office 365 Dev Blog

While this is now something you can do in one line in Exchange 2007 and 2010 if your migrating or managing 2000/3 you may want to get the Size and Item Count details of one particular mailbox folder for all users on a server eg how big the Inbox,SentItems or Calendar folder is. In Exchange 2003 you could get the Mailbox Size via WMI but to get an individual folder size you need to access the Mailbox itself (eg you can use pfdavadmin etc). To do this via Power shell for all users on the server you first need an ADSI query to get all the mailboxes on a particular server then you can use with WebDAV via the virtual admin root or MAPI via RDO\Redemption  http://www.dimastr.com/redemption/ which works well in Powershell. I have two scripts that use show how do to this using each of these API's which I've posted a downloadable copy here To run these scripts you need to use the Netbios name of the server as a commandline parameter the RDO version of the script looks like $snServer...

Although there are a few better methods of doing this these days this is still handy to have especially if your running older versions of Exchange or you want to audit the raw ACE's that are being added by RBAC in Exchange 2010. Extended rights get used for a number of things EWS Impersonation is one, SendAs is another anyway here's an old C# sample I tripped over today. using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Collections; using System.Security.AccessControl; using System.DirectoryServices; namespace showImpRights { class Program { static void Main(string[] args) { DirectoryEntry rootdse = new DirectoryEntry("LDAP://RootDSE"); DirectoryEntry cfg = new DirectoryEntry("LDAP://" + rootdse.Properties["configurationnamingcontext"].Value); DirectoryEntry exRights = new DirectoryEntry("LDAP://cn=Extended-rig...

Group membership has long been used in directory services to provide a way of giving access to different objects, distribution lists and a variety of other useful things to solve everyday problems in both active directory and Exchange Infrastructures. There are a number of things that you can’t do with Groups in Exchange which can be slightly limiting if you’re trying to solve certain problems in an easy and flexible manner. Exchange provides a whole bunch of extended properties in Active directory that can be used for various things one of the more useful of this is being able to apply a specific proxyaddress based on a specific value set in a extended property via a recipient policy. It can also be useful in Transport Agents and Transport Rules and a number of different application uses. For example in most mail systems you will have logical grouping of users into distribution lists maybe loosely based on department function etc. If for example your sales department want to use a spe...

Its often useful with scripts and applications to be able to use Group membership to control what users are affected by a particular application or script. Enumerating nested group members in powershell seems to be a bit of art and there are few different approaches none of which i particular liked so i came up with my own. The following approach uses two hash tables to ensure that if a user is in multiple groups they only get enumerated once and also any circular group nesting are taken care of as well seems to work well for me so i thought I'd share it. In the case of this script he $groupName is the DistiguishedName of the Group you want to enumerate the members of. $repeathashGroup = @{ } $repeathashUser = @{ } function Get-member($GroupName){ $Grouppath = "LDAP://" + $GroupName $groupObj = [ADSI]$Grouppath foreach($member in $groupObj.Member){ $userPath = "LDAP://" + $member $UserObj = [ADSI]$userPath if($UserObj.groupType...

ProxyAddresses are something in Exchange environments that can be a challenge to maintain over a long period of time and also during migrations or consolidations something that you need to deal with. If your lucky then just modifying your recipient policies may work the magic that you need if not and you have a large number of users that you need to modify you need to look at creating a script or doing a lot of mouse work. The first challenge if your going to write a script to do this is because your going to be deleting information just doing a one-liner or simple script may mean you will end up removing more information than you want. So one way to tackle this is using a simple GUI script that will allow mutiple selects to at least control what and which accounts you are going to affect. The good thing about createing a simple Gui is that it can also be used to do some analysis first. So the script i've created allows you to search based on the proxy address domain you want t...

Haven't posted any 2003 scripts for a while so here's one that might be useful especially if your looking at doing a bit of documentation before a migration. There are a few tricks when your using ADSI scripts to get information eg if you want to get the OU check the parent object of the userObject. Or if you want to get the Storage Group use the Parent of the MailStore object. If you want to work out quotas check both the mailstore and the user object. To put this all together into a script that takes the username as a parameter it looks like this I've put a download of this code here . param([String] $samaccountname) $root = [ADSI]'LDAP://RootDSE' $dfDefaultRootPath = "LDAP://" + $root.DefaultNamingContext.tostring() $dfRoot = [ADSI]$dfDefaultRootPath $gfGALQueryFilter = "(&(&(&(& (mailnickname=*)(objectCategory=person)(objectClass=user)(samaccountname=" + $samaccountname + ")))))" $dfsearcher = new-object System.Dire...

If you have been administrating mail systems for a while (and then some) then you have probably had to do a bulk update or two of one or more AD properties like phone numbers and address information. Depending on the time you have and your skill at building scripts you may have had some good and not so good experiences at this. The frustrating thing can be a script you build for one problem maybe be completely useless for the next and you may find yourself again spending time you don’t have building another script. Well because I’ve had to do this one too many times I came up with the following little script that allows dynamic matching of columns in a CSV file to import data into Active Directory. The other thing this script does is actually checks the current value within AD as not to update an already existing property and it’s a latched script so doesn’t allow you to update anything without clicking yes. The later could get frustrating but it’s a lot less frustrating then trying to...

Each night most Exchange servers will run a scheduled maintenance operation which among other things does an online de-fragmentation of the Exchange Store, and removes deleted items and mailboxes that are past the stores configured retention periods. The result of these operations are logged to the event log with some interesting information about how much whitespace the online defrag operation recovered, the size of the retained items and retained deleted mailboxes remaining in the store. I've used these before in VBS here to do this in powershell is pretty easy. Lets jump into some code samples this is how you can get the whitepace in a Exchange store by querying the event logs via WMI for 1221 Event Log ids and then parsing the Size out of the event log message. $WmidtQueryDT = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime([DateTime]::UtcNow.AddDays(-3)) Get-WmiObject -computer servername -query ("Select * from Win32_NTLogEvent Where Logfile='Applica...

In Exchange 2007 one of the new features is resource mailboxes out of the box you have two types of these mailboxes Room mailbox and Equipment mailbox. I’m rewriting some Intranet Meeting availability pages at the moment to work with Exchange Web Services and one thing you can’t do in EWS is run a query to find all these type of objects in your Exchange Organization. There are also a bunch of new features such as being able to set the resource capacity (eg how many people a room can hold) and custom resource properties (eg what type of things are in the room such as a whiteboard, projector etc). As this information is all stored in Active Directory you need to use LDAP to query this information. Because this is the type of thing I might want to use in multiple applications I thought I’d put together a little WebService that I could consume that would query this information on behalf of the requesting application and return information about the resource mailboxes firstly their email ad...

First up this script is not designed to audit who is making changes to permissions in Exchange. Tracking who is making changes to Active Directory objects in a distributed Network with multiple DC’s is not an easy thing to do my advice is if you need to do this hit the Google trail or look at third party products. What this script does is give visibility of permission changes to users mailboxes/accounts made via ADUC via Exchange Mailbox Rights and Send-As/Receive as rights on the user object. It basically works by creating an XML file that is a snapshot of the current explicitly added rights on an Exchange Mailbox and any ACE’s that grant the extended rights for send and receive as. The next time the script runs it takes another snapshot of the rights and then using a couple of Scripting Dictionary object s does a comparison and finds Add ,Deletes or Permission changes and then produces a HTML report of these changes. To extend the usefulness of this script I’ve created a version that...

I came across this while actually looking for something else but it does go some way to answering another question that gets asked occasionally. If you want to use the information in the GAL (eg Active Directory) for phone numbers and address’s ect how up to date is this information eg can I find out the last time it was updated. While maybe not 100% accurate one method that you maybe able to use is to use the Metadata from Active Directory which stores information about when the last time each property was updated and replicated in Active directory. To access the metadata from a script you need to use the iadstools.dll which comes as part of the Windows 2000/3 Support Tools package which can be found on the server CD in Support\Tools folder. Robbie Allen has put together a number of samples on using the objects in this DLL in his Active Directory cookbook which is worth checking out here . For this script I’ve expanded greatly on one of his samples by including a query of ever m...