Servus

Using Windows 2008 R2 Server Backup Feature to Backup Exchange 2010

Dave — Fri, 27 Aug 2010 08:03:14 +0000

http://blogs.techrepublic.com.com/datacenter/?p=3006

Active Directory – Object Metadata

Olga — Tue, 13 Jul 2010 22:03:16 +0000

View the metadata for an AD object to find out more details about when its specific attributes were modified. This is very handy when trying to troubleshoot details about a specific object.. See when and where an attribute was updated which can also help track down who made the change if the entry was captured in the domain controller event logs..

Here’s the syntax and an example of what data you will get back..

Repadmin /showobjmeta DCNAME “full object DN”

C:\>repadmin /showobjmeta DC01 “cn=SVCAccount,ou=accounts,dc=domain,dc=corp”

58 entries.

Loc.USN Originating DC Org.USN Org.Time/Date Ver Attribute

======= =============== =============== === =========

16740030 DFW1\DC01 16740030 2009-10-28 11:18:43 1 objectClass

16740030 DFW1\DC01 16740030 2009-10-28 11:18:43 1 cn

29079766 DFW1\DC01 29079766 2010-03-23 16:23:35 3 sn

29079766 DFW1\DC01 29079766 2010-03-23 16:23:35 2 title

16740030 DFW1\DC01 16740030 2009-10-28 11:18:43 1 description

39541488 DFW1\DC01 39541488 2010-07-12 12:03:56 39 givenName

16740030 DFW1\DC01 16740030 2009-10-28 11:18:43 1 whenCreated

29079766 DFW1\DC01 29079766 2010-03-23 16:23:35 6 displayName

29079766 DFW1\DC01 29079766 2010-03-23 16:23:35 3 co

16741438 DFW1\DC01 16741438 2009-10-28 11:42:45 2 department

16740030 DFW1\DC01 16740030 2009-10-28 11:18:43 1 name

39259708 SAN1\DC02 32310052 2010-07-09 10:52:46 4 userAccountControl

38694997 SAN2\DC03 93941776 2010-07-03 17:56:41 1 homeDirectory

38694997 SAN2\DC03 93941776 2010-07-03 17:56:41 1 homeDrive

28995344 SAN1\DC02 23187706 2010-03-22 15:48:22 4 ntPwdHistory

28995344 SAN1\DC02 23187706 2010-03-22 15:48:22 4 pwdLastSet

16740031 DFW1\DC01 16740031 2009-10-28 11:18:43 1 primaryGroupID

…………

Most of these details are self explanatory.. Ver is the number of modifications to a particular attribute..

Now you have when and where a specific attribute was modified and can track down who did it by looking in the security log J

Missing Group Memberships in AD??

Olga — Tue, 29 Jun 2010 15:01:45 +0000

I ran into something really interesting today that took some time to figure out.. Thought I should post in case anyone else is puzzled by the same scenario (and so that I can remember later).

I was running queries for group memberships and found inconsistencies between what I was seeing in ADUC and what my queries were pulling back. In ADUC, I could see user accounts in a group that did not show up in the query results or when I looked in ADSIEDIT.

I checked permissions, looked at the different attributes of the accounts, compared ldp outputs. I finally noticed that the primary group memberships were changed to the groups that I was querying and not ‘domain users’ which is the default. With the primary group designation, the account is not listed in the member attribute for the group nor is the group listed in the memberof attribute for the account.

There really aren’t any compelling reasons to update an account primary group designation, unless you want the account to have more restrictive rights than a regular domain user, like guest users. Otherwise, it is a bit confusing and requires applications to look at more than just the memberof or member attributes on users and groups to determine access.

Exchange 2010

Dave — Fri, 04 Jun 2010 03:32:23 +0000

http://www.windowsitpro.com/article/outlook-web-access-owa/owa-vs-outlook-in-2010.aspx

http://www.windowsitpro.com/blogs/exchangeandoutlook/tabid/780/entryid/12813/Exchange-Server-2010-Adoption-Excitement.aspx

Automatic IIS log housekeeping

Dave — Thu, 03 Jun 2010 21:19:23 +0000

There is not much automation taking place in my current company. I’m working to automate as many processes as possible, and therefore increase our productivity. The article below was borrowed from the following link. http://www.808.dk/?code-iis-log-housekeeping

A collection of scripts that can keep the IIS server’s HTTP/SMTP/FTP logs from filling up drives.

Depending on the script chosen, you can have different archiving (compression) and file retention times, or just simple delete-older-than log rotation. The log locations can be automatically retrieved from the IIS metabase (additional configuration needed for IIS 7.x), or specified manually.

Save the code as a .vbs file and run it daily as a scheduled job on the server.

Note that the scripts using compression need the command line version of the free 7-Zip compressor available on http://www.7-zip.org/download.html

Housekeeping script, manual log locations, logs are archived and deleted:

Option Explicit
WScript.Timeout = 82800

‘ This Script archives (compresses to a zip file, then deletes the
‘ original) IIS log files older than a specified number of days.
‘ The script can also delete the compressed archive files older
‘ than another specified number of days.
‘
‘ Run it as a daily scheduled task on high traffic web servers to
‘ avoid running out of disc space. IIS logs can typically be
‘ compressed to well below 1/20 of the original file size.
‘
‘ The script needs the command line version of the free 7-Zip
‘ compressor available on http://www.7-zip.org/
‘
‘ The ArchiveLogFiles function takes three parameters:
‘ “Path to log dir”
‘ “Compress log files older than n days and delete the original files”
‘ “Delete compressed log files older than n days”
‘
‘ Multiple function calls can be added to archive files in different
‘ log folders with different log retentions.
‘
‘ Note that the function runs through subfolders recursively, so if
‘ the same log retention should be used on a whole log folder tree
‘ structure, only one call with the root log folder is needed.
‘ Additional calls with specific subfolders can then be made to have
‘ shorter retentions on those.
‘
‘ Edit the example lines below to match the log folder paths,
‘ archive and retention values needed on the server.

ArchiveLogFiles “D:\Logfiles”, 30, 180
ArchiveLogFiles “D:\Logfiles\W3SVC1″, 14, 30
ArchiveLogFiles “D:\Logfiles\W3SVC243″, 5, 30
ArchiveLogFiles “D:\Logfiles\SMTPSVC1″, 7, 60

Function ArchiveLogFiles(strLogPath, intZipAge, intDelAge)
  Dim objFs
  Dim objFsCheck
  Dim objFolder
  Dim objSubFolder
  Dim objFile
  Dim objWShell
  Set objWShell = CreateObject(“WScript.Shell”)
  Set objFs = CreateObject(“Scripting.FileSystemObject”)
  Set objFsCheck = CreateObject(“Scripting.FileSystemObject”)
  If Right(strLogPath, 1) <> “\” Then
    strLogPath = strLogPath & “\”
  End If
  If objFs.FolderExists(strLogPath) Then
    Set objFolder = objFs.GetFolder(strLogPath)
      For Each objSubFolder in objFolder.subFolders
        ArchiveLogFiles strLogPath & objSubFolder.Name, intZipAge, intDelAge
      Next
      For Each objFile in objFolder.Files
        If (InStr(objFile.Name, “ex”) > 0) _
          And (Right(objFile.Name, 4) = “.log”) Then
          If DateDiff(“d”,objFile.DateLastModified,Date) > intZipAge Then
            objWShell.Run “7za.exe a -tzip “”" & strLogPath & _
              Left(objFile.Name,Len(objFile.Name)-3) & “zip”" “”" & _
              strLogPath & objFile.Name & “”"”, 7, true
            If objFsCheck.FileExists(strLogPath & _
              Left(objFile.Name,Len(objFile.Name)-3) & “zip”) And _
              (objFsCheck.FileExists(strLogPath & objFile.Name)) Then
                objFsCheck.DeleteFile(strLogPath & objFile.Name)
            End If
          End If
        ElseIf (InStr(objFile.Name, “ex”) > 0) _
          And (Right(objFile.Name, 4) = “.zip”) Then
          If DateDiff(“d”,objFile.DateLastModified,Date) > intDelAge Then
            objFsCheck.DeleteFile(strLogPath & objFile.Name)
          End If
        End If
      Next
    Set objFs = Nothing
    Set objFsCheck = Nothing
    Set objFolder = Nothing
    Set objWShell = nothing
  End If
End Function

Housekeeping script, manual log locations, logs are just deleted:

Option Explicit
WScript.Timeout = 82800

‘ This Script deletes IIS log files older than a specified number
‘ of days.
‘
‘ Run it as a daily scheduled task on high traffic web servers to
‘ avoid running out of disc space.
‘
‘ The DeleteLogFiles function takes two parameters:
‘ “Path to log dir”
‘ “Delete log files older than n days”
‘
‘ Multiple function calls can be added to delete files in different
‘ log folders with different log retentions.
‘
‘ Note that the function runs through subfolders recursively, so if
‘ the same log retention should be used on a whole log folder tree
‘ structure, only one call with the root log folder is needed.
‘ Additional calls with specific subfolders can then be made to have
‘ shorter retentions on those.
‘
‘ Edit the example lines below to match the log folder paths and
‘ retention values needed on the server.

DeleteLogFiles “D:\Logfiles”, 30
DeleteLogFiles “D:\Logfiles\W3SVC1″, 14
DeleteLogFiles “D:\Logfiles\W3SVC243″, 5
DeleteLogFiles “D:\Logfiles\SMTPSVC1″, 7

Function DeleteLogFiles(strLogPath, intDelAge)
  Dim objFs
  Dim objFolder
  Dim objSubFolder
  Dim objFile
  Dim objWShell
  Set objWShell = CreateObject(“WScript.Shell”)
  Set objFs = CreateObject(“Scripting.FileSystemObject”)
  If Right(strLogPath, 1) <> “\” Then
    strLogPath = strLogPath & “\”
  End If
  If objFs.FolderExists(strLogPath) Then
    Set objFolder = objFs.GetFolder(strLogPath)
      For Each objSubFolder in objFolder.subFolders
        DeleteLogFiles strLogPath & objSubFolder.Name, intDelAge
      Next
      For Each objFile in objFolder.Files
        If (InStr(objFile.Name, “ex”) > 0) _
          And (Right(objFile.Name, 4) = “.log”) Then
          If DateDiff(“d”,objFile.DateLastModified,Date) > intDelAge Then
            objFs.DeleteFile(strLogPath & objFile.Name)
          End If
        End If
      Next
    Set objFs = Nothing
    Set objFolder = Nothing
    Set objWShell = nothing
  End If
End Function

Housekeeping script, automatic log locations, logs are archived and deleted:

Option Explicit
WScript.Timeout = 82800

‘ This Script archives (compresses to a zip file, then deletes the
‘ original) IIS log files older than a specified number of days.
‘ The script can also delete the compressed archive files older
‘ than another specified number of days.
‘
‘ Run it as a daily scheduled task on high traffic web servers to
‘ avoid running out of disc space. IIS logs can typically be
‘ compressed to well below 1/20 of the original file size.
‘
‘ The script needs the command line version of the free 7-Zip
‘ compressor available on http://www.7-zip.org/
‘
‘ Edit the values for intZipAge and intDelAge to set the archive and
‘ retention times needed on the server.
‘
‘ The locations of the IIS log files are found automatically (for this
‘ to also work on IIS 7.x on Windows Vista, Windows Server 2008 or
‘ Windows 7, please enable “IIS 6 Metabase Compatibility” aka
‘ “IIS Metabase and IIS 6 configuration compatibility”).

Dim intZipAge
Dim intDelAge
intZipAge = 30
intDelAge = 180
Dim objIIS
Dim objWeb
Dim objIISOuter
Dim objWebOuter

Set objIISOuter = GetObject(“IIS://LOCALHOST”)
For Each objWebOuter in objIISOuter
  If LCase(objWebOuter.Class) = “iiswebservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/W3SVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iiswebserver” Then
        Call ArchiveLogFiles( _
          objWeb.LogFileDirectory & “\W3SVC” & objWeb.Name, _
          intZipAge, _
          intDelAge)
      End If
    Next
  ElseIf LCase(objWebOuter.Class) = “iissmtpservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/SMTPSVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iissmtpserver” Then
        Call ArchiveLogFiles( _
          objWeb.LogFileDirectory & “\SMTPSVC” & objWeb.Name, _
          intZipAge, _
          intDelAge)
      End If
    Next
  ElseIf LCase(objWebOuter.Class) = “iisftpservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/MSFTPSVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iisftpserver” Then
        Call ArchiveLogFiles( _
          objWeb.LogFileDirectory & “\MSFTPSVC” & objWeb.Name, _
          intZipAge, _
          intDelAge)
      End If
    Next
  End If
Next

Set objIIS = nothing
Set objIISOuter = nothing

Housekeeping script, automatic log locations, logs are just deleted:

Option Explicit
WScript.Timeout = 82800

‘ This Script deletes IIS log files older than a specified number
‘ of days.
‘
‘ Run it as a daily scheduled task on high traffic web servers to
‘ avoid running out of disc space.
‘
‘ Edit the value for intDelAge to set retention times needed on
‘ the server.
‘
‘ The locations of the IIS log files are found automatically (for this
‘ to also work on IIS 7.x on Windows Vista, Windows Server 2008 or
‘ Windows 7, please enable “IIS 6 Metabase Compatibility” aka
‘ “IIS Metabase and IIS 6 configuration compatibility”).

Dim intDelAge
intDelAge = 30
Dim objIIS
Dim objWeb
Dim objIISOuter
Dim objWebOuter
Set objIISOuter = GetObject(“IIS://LOCALHOST”)
For Each objWebOuter in objIISOuter
  If LCase(objWebOuter.Class) = “iiswebservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/W3SVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iiswebserver” Then
        Call DeleteLogFiles( _
          objWeb.LogFileDirectory & “\W3SVC” & objWeb.Name, _
          intDelAge)
      End If
    Next
  ElseIf LCase(objWebOuter.Class) = “iissmtpservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/SMTPSVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iissmtpserver” Then
        Call DeleteLogFiles( _
          objWeb.LogFileDirectory & “\SMTPSVC” & objWeb.Name, _
          intDelAge)
      End If
    Next
  ElseIf LCase(objWebOuter.Class) = “iisftpservice” Then
    Set objIIS = GetObject(“IIS://LOCALHOST/MSFTPSVC”)
    For Each objWeb in objIIS
      If LCase(objWeb.Class) = “iisftpserver” Then
        Call DeleteLogFiles( _
          objWeb.LogFileDirectory & “\MSFTPSVC” & objWeb.Name, _
          intDelAge)
      End If
    Next
  End If
Next

Set objIIS = nothing
Set objIISOuter = nothing

A good PowerShell resource.

Dave — Wed, 05 May 2010 19:39:33 +0000

http://powershellcommunity.org/Forums.aspx

Exchangepedia – Exchange Shell Quick Reference

Dave — Fri, 16 Apr 2010 22:32:02 +0000

https://exchangepedia.com/blog/stuff/ExQuick.htm

Remote Shutdown Syntax

Dave — Thu, 11 Mar 2010 18:09:15 +0000

I don’t use this command often enough to remember the syntax, so here it is:

shutdown /r /m \\servername /t 000

Find out when your Password Expires

Dave — Thu, 11 Mar 2010 16:31:52 +0000

Few weeks ago I came across this question “How to find out an account’s password expiration date” in one of our internal mailing-list. This looks like a simple question, but when we tried to find the answer we realized it is not a trivial task. One of my colleagues pointed to this 22-printed page detailed MSDN article that describes how to find a user account’s password expiration date. The steps described in this article are a bit outdated. It does not take Fine-Grained Password policy (a new feature added in Windows 2008) into account while calculating the maximum password age. With the addition of fine grained password policy, this becomes an even more daunting task to do. Using AD Powershell this task can be achieved with ~40 lines of script-code. Here is function that calculates the password expiration date of a user object given its samAccountName, security identifier or DistinguishedName.

1: function Get-XADUserPasswordExpirationDate() {
2:    Param ([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true, HelpMessage="Identity of the Account")]
3:    [Object] $accountIdentity)
4:    PROCESS {
5:       $accountObj = Get-ADUser $accountIdentity -properties PasswordExpired, PasswordNeverExpires, PasswordLastSet
6:       if ($accountObj.PasswordExpired) {
7:          echo (“Password of account: ” + $accountObj.Name + ” already expired!”)
8:       } else {
9:          if ($accountObj.PasswordNeverExpires) {
10:            echo (“Password of account: ” + $accountObj.Name + ” is set to never expires!”)
11:         } else {
12:            $passwordSetDate = $accountObj.PasswordLastSet
13:            if ($passwordSetDate -eq $null) {
14:               echo (“Password of account: ” + $accountObj.Name + ” has never been set!”)
15:            } else {
16:               $maxPasswordAgeTimeSpan = $null
17:               $dfl = (get-addomain).DomainMode
18:             if ($dfl -ge 3) {
19:                ## Greater than Windows2008 domain functional level
20:                $accountFGPP = Get-ADUserResultantPasswordPolicy $accountObj
21:                if ($accountFGPP -ne $null) {
22:                   $maxPasswordAgeTimeSpan = $accountFGPP.MaxPasswordAge
23:                } else {
24:                   $maxPasswordAgeTimeSpan = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
25:                }
26:             } else {
27:                $maxPasswordAgeTimeSpan = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
28:             }
29:             if ($maxPasswordAgeTimeSpan -eq $null -or $maxPasswordAgeTimeSpan.TotalMilliseconds -eq 0) {
30:                echo (“MaxPasswordAge is not set for the domain or is set to zero!”)
31:             } else {
32:                echo (“Password of account: ” + $accountObj.Name + ” expires on: ” + ($passwordSetDate + $maxPasswordAgeTimeSpan))
33:             }
34:          }
35:       }
36:    }
37:   }
38: }

Here are some sample usages of this function:

PS AD:\> Get-XADUserPasswordExpirationDate testuser1

Password of account: testuser1 already expired!

PS AD:\> Get-XADUserPasswordExpirationDate JohnDoe

Password of account: John Doe expires on: 02/25/2010 13:03:20

Since the MSDN article explains the algorithm using a flow diagram, I too have tried creating a flow diagram that explains the logic used to compute the password expiration date of an account:

Hope you find this useful. Please leave a comment if you have any feedback on this topic or would like to see any other topic discussed in our blog.

Enjoy,

Swami

Reporting on ActiveSync

Dave — Fri, 26 Feb 2010 15:52:18 +0000

Exchange logs quite a bit of info about ActiveSync device partnerships and you can use this to create reports about the utilization of mobility features in your organization. Getting this data requires a couple of intermediate steps before you can export it to a CSV for processing in something like Excel (or another script). The PowerShell script below will export all of the ActiveSync device relationships in your organization. Keep in mind that this will include old relationships which are no longer active. Depending on how large your organization is and the number of device relationships out there, it may take a little while for the script to run.

Note: If you have a mixed version organization (e.g. Exchange 2007 and Exchange 2010), you’ll need to run the script twice. Once in the Exchange 2007 Management Shell and once in the Exchange 2010 Management Shell. The cmdlets used here are not backwards (or forward compatible). I’ve provided two versions of the script – one for Exchange 2007 and one for Exchange 2010.

Exchange 2007 Version

$devices = @()

$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike “8*”}

foreach ($m in $mailboxes)

{

$devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity

}

$devices | Export-Csv DeviceStats.csv

Exchange 2010 Version

$devices = @()

$mailboxes = Get-CASMailbox -ResultSize:Unlimited | Where-Object {$_.HasActiveSyncDevicePartnership -eq $true -and $_.ExchangeVersion.ExchangeBuild -ilike “14*”}

foreach ($m in $mailboxes)

{

$devices += Get-ActiveSyncDeviceStatistics -Mailbox $m.Identity

}

$devices | Export-Csv DeviceStats.csv

You can open the exported CSV in Excel from here and generate reports based on that. There is quite a bit of information in the report including some personally identifiable information (PII) for the devices so keep that in mind before redistributing the raw data file.

This was written by Brian Desmond.