Microsoft – Blogs Created by Daag van der Meer

Inventory and push software

Home

Disable-Enable automapping Echange 2016

Because automapping is not always working correct, just created this script to re-enable automapping with the correct settings. This script you need to run on the Exchange server.

# Created by Daag van der Meer
# blog.van-daag.nl
# This script gives the user full access to the mailbox. This will update also the folders below the inbox with the rights.

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn;


# Enter the mailbox name here
$mailbox= "<mailboxname>"

# Add here the usernames like "<USERNAME>", "<ÜSERNAME>"
$users= "<USERNAME>", "<ÜSERNAME>"


####### Start of the Script. Do not edit below

foreach ($user in $users){ 
# First disable AutoMapping
Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $false


# Now enable Automapping
Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $true
}

# Created by Daag van der Meer

# blog.van-daag.nl

# This script gives the user full access to the mailbox. This will update also the folders below the inbox with the rights.

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn;

# Enter the mailbox name here

$mailbox= "<mailboxname>"

# Add here the usernames like "<USERNAME>", "<ÜSERNAME>"

$users= "<USERNAME>", "<ÜSERNAME>"

####### Start of the Script. Do not edit below

foreach ($user in $users){

# First disable AutoMapping

Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $false

# Now enable Automapping

Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $true

}

AD Send mail on password reset

This is based on Security Event ID 4724. When this is logged on the domain controller, Task Scheduler kicks this script. And send a mail to Admin and user. And also creates a local log file who reset the password.

# Created by Daag van der Meer on 12-10-2018
# Blog.van-daag.nl
# Powershell Send mail When account password reset is done To user and admin.
# Save this also in a Log file
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\reset.html" 

##################
## Log location
##################
$log= "C:\Logs\Accountreset.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 

##################
## Retrieve eventlog with all value
##################

$event = Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 |
 Select TimeGenerated, ReplacementStrings |
  % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[0] 
      "Account Domain" = $_.ReplacementStrings[1] 
      "Reset by" = $_.ReplacementStrings[4] 
      Date = $_.TimeGenerated 
    } 
   } 

##################
## Retrieve eventlog For filter username
##################

$userevent= Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 | Select-Object @{n='UserName';e={$_.ReplacementStrings[0]}}
$user= $userevent -replace ".*=" -replace "}"

##################
## send mail to admin
##################


$event | ConvertTo-Html -Property "Account name","Account Domain","Reset By",Date -head $HTML -body  "<H2> User account password is reset</H2>"| 
     Out-File $Report -Append 

##################
## Mail config admin
##################

$MailBody= Get-Content $Report 
$MailSubject= "User password reset" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAILADRESS>" 
$MailMessage.To.add("<MAILADRESS>") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 

del c:\Temp\reset.html
$event | Export-Csv $log -NoTypeInformation -Append


#############################
### Send mail to user #######
#############################

$useremail = Get-ADUser $user -Properties mail | Select-Object -ExpandProperty mail
$userfirstname1 = Get-ADUser $user -Properties GivenName | Select-Object GivenName
$userfirstname = $userfirstname1 -replace ".*=" -replace "}"
$userlastsname1 = Get-ADUser $user -Properties Surname | Select-Object Surname
$userlastsname = $userlastsname1 -replace ".*=" -replace "}"

$Pic = '<ADD LOCATION FOR PICTURE IN MAIL>'

$att1 = new-object Net.Mail.Attachment($Pic)
$att1.ContentType.MediaType = “image/png”
$att1.ContentId = “Attachment”

##################
## HTML mail setup to user
##################

$userBody = @"
<html>
    <body>
    <span lang=NL style='font-size:10.0pt;line-height:106%;color:black'>
Dear $userfirstname $userlastsname,<br>
<br>
The password for your <b>DOMAIN\$user</b> account has been reset.<br>
If you did not request this, please inform:<br>
<br>
This is an automated email.<br>
<br>
</span>
<img src="cid:Attachment">
"@

##################
## Mail config user
##################

$userSubject = "Your password is changed"
$userMessage = New-Object system.net.mail.mailmessage 
$userMessage.from = "<FROM MAILADRESS>"
$userMessage.To.add("$useremail")  
$userMessage.Subject = $userSubject  
$userMessage.IsBodyHtml = 1
$userMessage.Body = $userBody 


$userMessage.Attachments.Add($att1)


$SmtpClient.Send($userMessage)

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

# Created by Daag van der Meer on 12-10-2018

# Blog.van-daag.nl

# Powershell Send mail When account password reset is done To user and admin.

# Save this also in a Log file

##################

## Temp location for creating HTML email

##################

$Report= "c:\Temp\reset.html"

##################

## Log location

##################

$log= "C:\Logs\Accountreset.csv"

$HTML=@"

<title>Account locked out Report</title>

##################

## Retrieve eventlog with all value

##################

$event = Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 |

Select TimeGenerated, ReplacementStrings |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[0]

"Account Domain" = $_.ReplacementStrings[1]

"Reset by" = $_.ReplacementStrings[4]

Date = $_.TimeGenerated

}

##################

## Retrieve eventlog For filter username

##################

$userevent= Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 | Select-Object @{n='UserName';e={$_.ReplacementStrings[0]}}

$user= $userevent -replace ".*=" -replace "}"

##################

## send mail to admin

##################

$event | ConvertTo-Html -Property "Account name","Account Domain","Reset By",Date -head $HTML -body "<H2> User account password is reset</H2>"|

Out-File $Report -Append

##################

## Mail config admin

##################

$MailBody= Get-Content $Report

$MailSubject= "User password reset"

$SmtpClient = New-Object system.net.mail.smtpClient

$SmtpClient.host = "<MAIL SERVER>"

$MailMessage = New-Object system.net.mail.mailmessage

$MailMessage.from = "<FROM MAILADRESS>"

$MailMessage.To.add("<MAILADRESS>")

$MailMessage.Subject = $MailSubject

$MailMessage.IsBodyHtml = 1

$MailMessage.Body = $MailBody

$SmtpClient.Send($MailMessage)

del c:\Temp\reset.html

$event | Export-Csv $log -NoTypeInformation -Append

#############################

### Send mail to user #######

#############################

$useremail = Get-ADUser $user -Properties mail | Select-Object -ExpandProperty mail

$userfirstname1 = Get-ADUser $user -Properties GivenName | Select-Object GivenName

$userfirstname = $userfirstname1 -replace ".*=" -replace "}"

$userlastsname1 = Get-ADUser $user -Properties Surname | Select-Object Surname

$userlastsname = $userlastsname1 -replace ".*=" -replace "}"

$Pic = '<ADD LOCATION FOR PICTURE IN MAIL>'

$att1 = new-object Net.Mail.Attachment($Pic)

$att1.ContentType.MediaType = “image/png”

$att1.ContentId = “Attachment”

##################

## HTML mail setup to user

##################

$userBody = @"

<html>

<body>

Dear $userfirstname $userlastsname,<br>

<br>

The password for your <b>DOMAIN\$user</b> account has been reset.<br>

If you did not request this, please inform:<br>

<br>

This is an automated email.<br>

<br>

</span>

##################

## Mail config user

##################

$userSubject = "Your password is changed"

$userMessage = New-Object system.net.mail.mailmessage

$userMessage.from = "<FROM MAILADRESS>"

$userMessage.To.add("$useremail")

$userMessage.Subject = $userSubject

$userMessage.IsBodyHtml = 1

$userMessage.Body = $userBody

$userMessage.Attachments.Add($att1)

$SmtpClient.Send($userMessage)

AD Send mail on Account Lock

At a company where I worked, there was no logging with account lock and the had plans to change the GPO that accounts will not be auto unlocked.
So I also added mailing to the admin of that specific OU (Country)

I found a script from Maxzor1908 on Technet
That was the basic. I Added a lot of extra.

# Powershell User Account locked out Maxzor1908 *16/4/2013* 
# Checked and edit by Daag van der Meer - 03-10-2018
# blog.van-daag.nl
#              Email adress needs to be filled in at the admin account.
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\Lockedhtml.html" 

##################
## Log location
##################
$log= "C:\Logs\AccountLocked.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 
 
$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}} 
$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}} 
$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}} 
 
##################
## Retrieve eventlog with all value
##################

             
$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      "Account Domain" = $_.ReplacementStrings[5] 
      "Caller Computer Name" = $_.ReplacementStrings[1] 
      Date = $_.TimeGenerated 
    } 
   } 
    
  $event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body  "<H2> User is locked in the Active Directory</H2>"| 
     Out-File $Report -Append 
 

##################
## Retrieve eventlog For filter username
##################


 $user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select ReplacementStrings | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      } 
   } 

$userrename = $user -replace ".*=" -replace "}"
$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName

##############################
## Here is the ad Groups configured who can unlock accounts
#############################
 

if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

else {$mail = "<AD GROUP>" }

$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}
$mailadmin =  $adminmail -join "," -replace ",,"

##################
## Mail config admin
##################


$MailBody= Get-Content $Report 
$MailSubject= "User Account locked out" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAIL ADRESS>" 
$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 


##################
## Remove the temp document
##################
del c:\Temp\Lockedhtml.html

##################
## Write to log about the account lock
##################

$event | Export-Csv $log -NoTypeInformation -Append

100

101

102

# Powershell User Account locked out Maxzor1908 *16/4/2013*

# Checked and edit by Daag van der Meer - 03-10-2018

# blog.van-daag.nl

# Email adress needs to be filled in at the admin account.

##################

## Temp location for creating HTML email

##################

$Report= "c:\Temp\Lockedhtml.html"

##################

## Log location

##################

$log= "C:\Logs\AccountLocked.csv"

$HTML=@"

<title>Account locked out Report</title>

$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}}

$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}}

$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}}

##################

## Retrieve eventlog with all value

##################

$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |

Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[-7]

"Account Domain" = $_.ReplacementStrings[5]

"Caller Computer Name" = $_.ReplacementStrings[1]

Date = $_.TimeGenerated

}

$event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body "<H2> User is locked in the Active Directory</H2>"|

Out-File $Report -Append

##################

## Retrieve eventlog For filter username

##################

$user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |

Select ReplacementStrings |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[-7]

}

$userrename = $user -replace ".*=" -replace "}"

$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName

##############################

## Here is the ad Groups configured who can unlock accounts

#############################

if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

else {$mail = "<AD GROUP>" }

$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}

$mailadmin = $adminmail -join "," -replace ",,"

##################

## Mail config admin

##################

$MailBody= Get-Content $Report

$MailSubject= "User Account locked out"

$SmtpClient = New-Object system.net.mail.smtpClient

$SmtpClient.host = "<MAIL SERVER>"

$MailMessage = New-Object system.net.mail.mailmessage

$MailMessage.from = "<FROM MAIL ADRESS>"

$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin")

$MailMessage.Subject = $MailSubject

$MailMessage.IsBodyHtml = 1

$MailMessage.Body = $MailBody

$SmtpClient.Send($MailMessage)

##################

## Remove the temp document

##################

del c:\Temp\Lockedhtml.html

##################

## Write to log about the account lock

##################

$event | Export-Csv $log -NoTypeInformation -Append

AD Change Display name

At the company were I worked we had a name change. They also use the display name in outlook to send mail. Example: Daag van der Meer [Company] So everyone see direct what the company is.

The script below built the display name with firstname lastname [Company]

# Script created by Daag van der Meer
# Blog.van-daag.nl

Import-Module ActiveDirectory

#creates a list of all users (change all between <>
$allUsers = Get-ADUser -Filter * -SearchBase 'ou=Users,ou=<OU>,DC=<DC>,DC=<DC' -Properties cn,displayName

 
# Add your company name or something else after username 
$hi = "<company>"

 

foreach ( $u in $allUsers | Where-Object { ($_.givenName) -and ($_.surName) } ) {

    $fn = $u.givenName.Trim()

    $ln = $u.surName.Trim()

   

    Write-Host $fn $ln

    Set-ADUser -Identity $u -DisplayName "$fn $ln $hi" -GivenName "$fn" -SurName "$ln"-PassThru |

        Rename-ADObject -NewName "$fn $ln $hi"

}

# Script created by Daag van der Meer

# Blog.van-daag.nl

Import-Module ActiveDirectory

#creates a list of all users (change all between <>

$allUsers = Get-ADUser -Filter * -SearchBase 'ou=Users,ou=<OU>,DC=<DC>,DC=<DC' -Properties cn,displayName

# Add your company name or something else after username

$hi = "<company>"

foreach ( $u in $allUsers | Where-Object { ($_.givenName) -and ($_.surName) } ) {

$fn = $u.givenName.Trim()

$ln = $u.surName.Trim()

Write-Host $fn $ln

Set-ADUser -Identity $u -DisplayName "$fn $ln $hi" -GivenName "$fn" -SurName "$ln"-PassThru |

Rename-ADObject -NewName "$fn $ln $hi"

}

Exchange delete message in mailbox

https://docs.microsoft.com/en-us/Exchange/policy-and-compliance/ediscovery/delete-messages?view=exchserver-2019

Enable AD user with external email address Exchange 2016

On the Exchange server Open the Exchange powershell.

Run the following command (Change what is needed)

Enable-MailUser -Identity John -ExternalEmailAddress john@contoso.com

1	Enable-MailUser -Identity John -ExternalEmailAddress john@contoso.com

AD Attribute editor field = proxyAdress

Source: Microsoft.com

Enable Windows Photo Viewer in Windows 10

In windows 10 Windows Photo Viewer is gone.
Here is how to activate it.
Download the following regkeys.
Activate-Windows-Photo-Viewer-on-Windows-10

When runned. Right click on a picture. Goto open with, Choose another app.

Now you get a list, Select Windows Photo Viewer and check Always use this app to open .* files.

Source: howtogeek.com

Windows 10 God Mode

Create a new folder and give it the name: GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Now you have a complete list from the configuration panel.

AD Change Roaming profile Path Terminal server

I created this script because of moving the profiles to a server in the data center were also the terminal server is located.

Powershell needs to be runned as Administrator

########
## created by Daag van der Meer
## blog.van-daag.nl
## 26-04-2018
########
#
# Script is used to set Homedrive, RDP Homedrive, Profilepath, RDP profile path.
#
# Script needs to be runned as Admin!!!


Import-Module ActiveDirectory
     # On the Domain Controller There is on C:\Temp\Users.txt with the usernames to change the path

foreach ($user in (get-content c:\temp\Users.txt)) {
    ## Homedrive and profile location
    $homeDirectory = '\\<NewServer>\home$\<Country>\' + $user; 
    $ProfilePath = '\\<NewServer>\Profile$\<Country>\' + $user; 

    ## Set homedrive (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)
    # Finally set their home directory and home drive letter in Active Directory
    Set-ADUser -Identity $user -HomeDirectory $homeDirectory -HomeDrive H
	
	## Set Profile (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)
		Set-ADUser -Identity $user -ProfilePath $ProfilePath
        
        ## Set RDP Profile and Homedrive
        Get-ADUser -Filter "SAMAccountName -like '$user*'"| ForEach-Object {
        $ADSI = [ADSI]('LDAP://{0}' -f $_.DistinguishedName)
        try {
            $ADSI.InvokeSet('TerminalServicesProfilePath',$ProfilePath)
            $ADSI.InvokeSet("TerminalServicesHomeDrive","H:")
            $ADSI.InvokeSet("TerminalServicesHomeDirectory",$homeDirectory)
            $ADSI.SetInfo()
        }
        catch {
            Write-Error $Error[0]
        }
}
	
}

########

## created by Daag van der Meer

## blog.van-daag.nl

## 26-04-2018

########

# Script is used to set Homedrive, RDP Homedrive, Profilepath, RDP profile path.

# Script needs to be runned as Admin!!!

Import-Module ActiveDirectory

# On the Domain Controller There is on C:\Temp\Users.txt with the usernames to change the path

foreach ($user in (get-content c:\temp\Users.txt)) {

## Homedrive and profile location

$homeDirectory = '\\<NewServer>\home$\<Country>\' + $user;

$ProfilePath = '\\<NewServer>\Profile$\<Country>\' + $user;

## Set homedrive (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)

# Finally set their home directory and home drive letter in Active Directory

Set-ADUser -Identity $user -HomeDirectory $homeDirectory -HomeDrive H

## Set Profile (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)

Set-ADUser -Identity $user -ProfilePath $ProfilePath

## Set RDP Profile and Homedrive

Get-ADUser -Filter "SAMAccountName -like '$user*'"| ForEach-Object {

$ADSI = [ADSI]('LDAP://{0}' -f $_.DistinguishedName)

try {

$ADSI.InvokeSet('TerminalServicesProfilePath',$ProfilePath)

$ADSI.InvokeSet("TerminalServicesHomeDrive","H:")

$ADSI.InvokeSet("TerminalServicesHomeDirectory",$homeDirectory)

$ADSI.SetInfo()

}

catch {

Write-Error $Error[0]

}