How to clear the mail attribute using PowerShell

Posted on November 9, 2009 by Scott — 4 Comments ↓

I have been struggling to delete the value in the mail attribute after a mailbox has been deleted. Exchange populates the mail attribute when a mailbox is created (even though Exchange has no use for the attribute), but doesn’t clear the attribute when the mailbox is deleted. With ADUC integration removed in Exchange 2007, a quick way to know if an account has a mailbox is to look at the mail attribute. But if removing a mailbox no longer clears that attribute, it is difficult know (just by looking at a user account in ADUC) if the account still has a mailbox.

Since Exchange doesn’t use the mail attribute, you can’t use the Set-Mailbox attribute, especially if the mailbox is deleted anyway. I tried using Set-User with the -WindowsEmailAddress parameter, but because the data type is Microsoft.Exchange.Data.SmtpAddress, setting the value to "" or $null doesn’t work because those aren’t properly formatted SMTP addresses.

So, I figured I needed to get away from any Exchange cmdlet. I used PowerShell’s native support for ADSI to bind to the user object: New-Object DirectoryServices.DirectoryEntry "LDAP://UserDN". But you will get an error if you try to set the attribute to null ($user.mail = $null). You can set it to an empty value (""), but you will then get an error when you try to commit the change: $user.SetInfo().

How can you possibly clear this attribute, one that is so easy to do in ADUC just by deleting the value in it? It is necessary to fall back to the PutEx method. Using that will let you use the ADS_PROPERTY_CLEAR constant (indicated by the numeric one in the first argument). It has taken me days to finally get to this point, so hopefully this post will shorten that time for others trying to do the same thing.

$user = Get-User "username"
$ldapDN = "LDAP://" + $user.distinguishedName
$adUser = New-Object DirectoryServices.DirectoryEntry $ldapDN
$adUser.PutEx(1, "mail", $null)
$adUser.SetInfo()

$user = Get-User "username"

$ldapDN = "LDAP://" + $user.distinguishedName

$adUser = New-Object DirectoryServices.DirectoryEntry $ldapDN

$adUser.PutEx(1, "mail", $null)

$adUser.SetInfo()

PowerShell script to report last successful full backup of Exchange 2007

Posted on July 22, 2008 by Scott — 7 Comments ↓

Articles in the "Report Last Backup of Exchange 2007" series

PowerShell script to report last successful full backup of Exchange 2007 [This article]
Updated Exchange 2007 database backup script
Another minor update to the Exchange 2007 backup script
Exchange 2007 backup script updated to v1.2
Exchange 2007 backup script updated to v1.3
Minor update to last backup report (1.3.1)

This script is a port of my original backup report that was written in VBScript. That script reports on both 2003 and 2007 servers, but lacked some of the features that I wanted to put in. PowerShell natively supports date-awareness, which makes it much easier to add the number one feature I wanted to add: highlighting servers that haven’t had backups since a specified period of time.

Because I am using the native Exchange cmdlets instead of WMI or CDOEXM, this only reports on Exchange 2007 servers. I figure accommodating both is more work than it is worth, so I just modified my VBScript version to not include any server in the Exchange 12 admin group and I have both run every day until my migration to 2007 is complete.

The script reports the last successful full backup of any Exchange 2007 server with the mailbox role installed. It checks for the presence of storage groups and databases within them. It notes if a backup is currently in progress, as well as if a backup has never completed. If a backup has not completed in the last 72 hours (modifiable), it is highlighted in red so it is easy to spot. If a backup is less than the defined number of hours old, I use the Marlett font to display a green checkmark. This allows for a checkmark without having to reference an external image or embed one. Lastly, the report is emailed. The script is shown below, but you can also just download it.

#Last Backup Report for Exchange 2007 servers
#Version 1.0 - 7/9/08
#--------------------------------------------

#Begin customization-------------------------
$SmtpServer = "server.domain.com" #Enter FQDN of SMTP server
$SmtpFrom = "Exchange Backups &lt;exchangebackupreport@domain.com&gt;" #Enter sender email address
$SmtpTo = "user1@domain.com","user2@domain.com" #Enter one or more recipient addresses in an array
$SmtpSubject = "Exchange 2007 Last Backup Report" #Enter subject of message
$iNomHours = "72" #Enter number of hours since last backup that requires attention
#End customization---------------------------

$date = Get-Date
$sSpace = "&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;"
$sOutput = "&lt;table&gt;"

#Checkmark to indicate last backup within nominal time
$sCheckMark = "&lt;span style=""font-family: Marlett; color: green; font-size: 14pt; font-weight: bold""&gt;a&lt;/span&gt;"

#Retrieve Exchange servers with mailbox role
$ExServer = Get-ExchangeServer | where {$_.IsMailboxServer -eq $True} | Sort-Object Name
Foreach ($server in $ExServer)
	{
	$sOutput += "&lt;tr&gt;&lt;td&gt;&lt;font size=2&gt;&lt;u&gt;&lt;b&gt;$server&lt;/b&gt;&lt;/u&gt;&lt;/font&gt;&lt;/td&gt;&lt;td&gt;&lt;/td&gt;&lt;/tr&gt;"
	#Retrieve storage groups for a given server
	$StorageGroup = $server | Get-StorageGroup | Sort-Object Name
	#Check for absence of any storage groups
	If (($StorageGroup | Measure-Object Name).Count -eq $null)
		{
		$sOutput += "&lt;tr&gt;&lt;td&gt;&lt;font size=2&gt;" + $sSpace + "No storage groups present.&lt;/font&gt;&lt;/td&gt;&lt;/tr&gt;"
		}
	Else
		{
		Foreach ($sg in $StorageGroup)
			{
			$sOutput += "&lt;tr&gt;&lt;td&gt;&lt;font size=2&gt;" + $sSpace + $sg.Name + "&lt;/font&gt;&lt;/td&gt;&lt;/tr&gt;"
			#Retrieve mailbox databases for a given storage group
			$MailboxDatabase = $StorageGroup | Get-MailboxDatabase -Status | Sort-Object Name
			#Check for absence of any databases in storage group
			If (($MailboxDatabase | Measure-Object Name).Count -eq $null)
				{
				$sOutput += "&lt;tr&gt;&lt;td&gt;&lt;font size=2&gt;" + $sSpace + $sSpace + "No mailbox stores present.&lt;/font&gt;&lt;/td&gt;&lt;/tr&gt;"				}
			Else
				{
				Foreach ($db in $MailboxDatabase)
					{
					$sBackupRunning = ""
					#Note if backup is currently running
					If ($db.BackupInProgress -eq $true)
						{$sBackupRunning = "&lt;font size=2 color=blue&gt;(Backup In Progress)&lt;/font&gt;"}
					#Determine if backup has ever completed
					If ($db.LastFullBackup -ne $null)
						{
						$sBackupDay = $db.LastFullBackup.get_DayofWeek()
						$sBackupDateTime = $db.LastFullBackup.ToString("g")
						#Flag if last completed backup started longer than defined variable
						If (($date - $db.LastFullBackup).TotalHours -gt $iNomHours)
							{
							$sLastBackup = "&lt;font size=2&gt;Last Backup Started At: &lt;font color=red&gt;" + $sBackupDay + ", " + $sBackupDateTime + "&lt;/font&gt;&lt;/font&gt;"
							}
						Else
							{
							$sLastBackup = "&lt;font size=2&gt;Last Backup Started At: " + $sBackupDay + ", " + $sBackupDateTime + " &lt;/font&gt;" + $sCheckmark
							}
						}
					Else
						{
						$sLastBackup = "&lt;font size=2&gt;No full backup has completed yet.&lt;/font&gt;"
						}
					$sOutput += "&lt;tr&gt;&lt;td&gt;&lt;font size=2&gt;" + $sSpace + $sSpace + $db.Name + " &lt;/font&gt;&lt;/td&gt;&lt;td&gt;" + $sLastBackup + $sBackupRunning + "&lt;/td&gt;&lt;/tr&gt;"
					}
				}
			}
		}
	}
$sOutput += "&lt;/table&gt;"

#Email results
$SmtpClient = New-Object System.Net.Mail.SmtpClient
$MailMessage = New-Object System.Net.Mail.MailMessage
$SmtpClient.Host = $SmtpServer
$MailMessage.From = $SmtpFrom
Foreach ($address in $smtpTo)
	{$MailMessage.To.Add($address)}
$MailMessage.Subject = $SmtpSubject
$MailMessage.IsBodyHTML = $true
$MailMessage.Body = $sOutput
$SmtpClient.Send($MailMessage)

#Last Backup Report for Exchange 2007 servers

#Version 1.0 - 7/9/08

#--------------------------------------------

#Begin customization-------------------------

$SmtpServer = "server.domain.com" #Enter FQDN of SMTP server

$SmtpFrom = "Exchange Backups <exchangebackupreport@domain.com>" #Enter sender email address

$SmtpTo = "user1@domain.com","user2@domain.com" #Enter one or more recipient addresses in an array

$SmtpSubject = "Exchange 2007 Last Backup Report" #Enter subject of message

$iNomHours = "72" #Enter number of hours since last backup that requires attention

#End customization---------------------------

$date = Get-Date

$sSpace = "&nbsp;&nbsp;&nbsp;&nbsp;"

$sOutput = "<table>"

#Checkmark to indicate last backup within nominal time

$sCheckMark = "a"

#Retrieve Exchange servers with mailbox role

$ExServer = Get-ExchangeServer | where {$_.IsMailboxServer -eq $True} | Sort-Object Name

Foreach ($server in $ExServer)

{

$sOutput += "<tr><td>$server</td><td></td></tr>"

#Retrieve storage groups for a given server

$StorageGroup = $server | Get-StorageGroup | Sort-Object Name

#Check for absence of any storage groups

If (($StorageGroup | Measure-Object Name).Count -eq $null)

{

$sOutput += "<tr><td>" + $sSpace + "No storage groups present.</td></tr>"

}

Else

{

Foreach ($sg in $StorageGroup)

{

$sOutput += "<tr><td>" + $sSpace + $sg.Name + "</td></tr>"

#Retrieve mailbox databases for a given storage group

$MailboxDatabase = $StorageGroup | Get-MailboxDatabase -Status | Sort-Object Name

#Check for absence of any databases in storage group

If (($MailboxDatabase | Measure-Object Name).Count -eq $null)

{

$sOutput += "<tr><td>" + $sSpace + $sSpace + "No mailbox stores present.</td></tr>" }

Else

{

Foreach ($db in $MailboxDatabase)

{

$sBackupRunning = ""

#Note if backup is currently running

If ($db.BackupInProgress -eq $true)

{$sBackupRunning = "(Backup In Progress)"}

#Determine if backup has ever completed

If ($db.LastFullBackup -ne $null)

{

$sBackupDay = $db.LastFullBackup.get_DayofWeek()

$sBackupDateTime = $db.LastFullBackup.ToString("g")

#Flag if last completed backup started longer than defined variable

If (($date - $db.LastFullBackup).TotalHours -gt $iNomHours)

{

$sLastBackup = "Last Backup Started At: " + $sBackupDay + ", " + $sBackupDateTime + ""

}

Else

{

$sLastBackup = "Last Backup Started At: " + $sBackupDay + ", " + $sBackupDateTime + " " + $sCheckmark

}

Else

{

$sLastBackup = "No full backup has completed yet."

}

$sOutput += "<tr><td>" + $sSpace + $sSpace + $db.Name + " </td><td>" + $sLastBackup + $sBackupRunning + "</td></tr>"

}

$sOutput += "</table>"

#Email results

$SmtpClient = New-Object System.Net.Mail.SmtpClient

$MailMessage = New-Object System.Net.Mail.MailMessage

$SmtpClient.Host = $SmtpServer

$MailMessage.From = $SmtpFrom

Foreach ($address in $smtpTo)

{$MailMessage.To.Add($address)}

$MailMessage.Subject = $SmtpSubject

$MailMessage.IsBodyHTML = $true

$MailMessage.Body = $sOutput

$SmtpClient.Send($MailMessage)

| Next in series

Convert a mailbox GUID to the user and display name

Posted on February 26, 2008 by Scott — 2 Comments ↓

If certain MAPI limits are reached when working with sessions, items, attachments, etc., Exchange will deny further access to that user to that object type. When this happens event ID 9646 is logged in the Application log. The description of the event contains a mailbox GUID that is causing the issue, but the GUID alone does nothing to indicate what user/mailbox is affected.

Microsoft KB 899663 instructs how to manually transpose GUID into a format that can be used in an LDAP filter so that you can search for a match. Why do all this by hand when a script can do it for you? I took an existing script I had that already does the transposition and added an AD search to return the matching dn. The dn is passed to a name translation function that converts the dn to the NT4 format (domain\username) and displays the match with username and display name.

In addition to the VBScript file, I have also included a compiled version that uses SAPIEN Script Host as the engine. This is a self-contained, runs-in-memory-only, no-DOS-box-comes-up engine from PrimalScript. Running the compiled version is nice since you don’t have to ensure that CScript is the default host and no DOS box appears while the script is running.

The zip file with both versions is available here .

Updated: Copy DLs from one user to another

Posted on July 22, 2007 by Scott — No Comments ↓

The first version of the script really was quick and dirty, requiring you to manually put the source and target users’ DNs in the script. Since a coworker has been using the script, I thought it appropriate to update it to prompt for the usernames. In addition, I added a new feature I recently read about, which is to output the results in real-time to a GUI. This is done by creating an object for IE and writing the output similar to wscript.echo, but with the Write method of the object.

Like the original script, since we use automated DLs, too, I look for an indication that a given DL is a SmartDL and skip it. And I now use PrimalScript to work with my scripts, so I use its packager to make an exectuable. This makes it easier and nicer for non-IT end-users who will be running scripts like these.

Download it here, or copy/paste below.

'Version 2.0 - July 23, 2007
'Copy distribution group membership from one user to another,
'excluding automated DLs (SmartDL).
'Get source user
While Not bolExit = True
	strOldSamUser = InputBox(&quot;Enter the sAMAccountName of the person to copy DLs FROM.&quot; _
		, &quot;Enter username&quot;)
	If strOldSamUser = &quot;&quot; Then
		WScript.Quit
	End If
 
	'Find the Global Catalog server
	Set objCont = GetObject(&quot;GC:&quot;)
	For Each objGC In objCont
		strADsPath = objGC.ADsPath
	Next
 
	Set objConnection = CreateObject(&quot;ADODB.Connection&quot;)
	Set objRecordset = CreateObject(&quot;ADODB.Recordset&quot;)
	objConnection.Provider = &quot;ADsDSOObject&quot;

	objConnection.Open &quot;ADs Provider&quot;
	strQuery = &quot;&lt;&quot; &amp; strADsPath &amp; &quot;&gt;;(&amp;(objectcategory=user)(sAMAccountName=&quot; &amp; strOldSamUser &amp; _
		&quot;));displayName,distinguishedName;subtree&quot;
	Set objRecordset = objConnection.Execute(strQuery)

	If Trim(objRecordset.Fields(&quot;distinguishedName&quot;)) = &quot;&quot; Then
		strNoUser = MsgBox(&quot;Warning: User cannot be found.&nbsp; Verify sAMAccountName.&quot;, vbCritical, &quot;User not found!&quot;)
		bolExit = False
	Else
		intCorrectUser = MsgBox(&quot;Is this the correct user?&quot; &amp; VbCrLf &amp; VbCrLf &amp; &quot;Display Name: &quot; &amp; _
		objRecordset.Fields(&quot;displayName&quot;) &amp; VbCrLf &amp; &quot;DN: &quot; &amp; objRecordset.Fields(&quot;distinguishedName&quot;), _
			vbYesNo, &quot;Old user?&quot;)
		If intCorrectUser &lt;&gt; 6 Then
			bolExit = False
		Else
			strSrcDN = objRecordset.Fields(&quot;distinguishedName&quot;)
			bolExit = True
		End If
	End If
 Wend
'Open IE to display progress and results
Set objIE = CreateObject(&quot;InternetExplorer.Application&quot;)
objIE.AddressBar = False
objIE.Menubar = False
objIE.Toolbar = False
objIE.Resizable = True
objIE.Left = 10
objIE.Height = 450
objIE.Width = 800
objIE.Visible = True
objIE.Navigate(&quot;about:blank&quot;)
While objIE.Busy
	WScript.Sleep 100
Wend
Set objDoc = objIE.Document
objDoc.Open
objDoc.Write(&quot;&lt;TITLE&gt;Copy DL Membership&lt;/TITLE&gt;&quot;)
objDoc.Write(&quot;&lt;BODY BGCOLOR=#C0C0C0&gt;&quot;)
objDoc.Write(&quot;&lt;P&gt;&lt;b&gt;Source:&lt;/b&gt; &quot; &amp; objRecordset.Fields(&quot;distinguishedName&quot;) &amp; &quot;&lt;br&gt;&quot;)
'Get target user
bolExit = False
While Not bolExit = True
	strNewSamUser = InputBox(&quot;Enter the sAMAccountName of the person to copy DLs TO.&quot; _
		, &quot;Enter username&quot;)
	If strNewSamUser = &quot;&quot; Then
		objIE.Quit
		WScript.Quit
	End If
	strQuery = &quot;&lt;&quot; &amp; strADsPath &amp; &quot;&gt;;(&amp;(objectcategory=user)(sAMAccountName=&quot; &amp; strNewSamUser &amp; _
		&quot;));displayName,distinguishedName;subtree&quot;
	Set objRecordset = objConnection.Execute(strQuery)
	If Trim(objRecordset.Fields(&quot;distinguishedName&quot;)) = &quot;&quot; Then
		strNoUser = MsgBox(&quot;Warning: User cannot be found.&nbsp; Verify sAMAccountName.&quot;, vbCritical, &quot;User not found!&quot;)
		bolExit = False
	Else
		intCorrectUser = MsgBox(&quot;Is this the correct user?&quot; &amp; VbCrLf &amp; VbCrLf &amp; &quot;Display Name: &quot; &amp; _
			objRecordset.Fields(&quot;displayName&quot;) &amp; VbCrLf &amp; &quot;DN: &quot; &amp; objRecordset.Fields(&quot;distinguishedName&quot;), _
			vbYesNo, &quot;Old user?&quot;)
		If intCorrectUser &lt;&gt; 6 Then
			bolExit = False
		Else
			Set objTargetUser = GetObject(&quot;LDAP://&quot; &amp; objRecordset.Fields(&quot;distinguishedName&quot;))
			bolExit = True
		End If
	End If
 Wend
 'Write target user to IE window
 objDoc.Write(&quot;&lt;b&gt;Target:&lt;/b&gt; &quot; &amp; objRecordset.Fields(&quot;distinguishedName&quot;) &amp; &quot;&lt;/P&gt;&quot;)
 'Copy DLs
 strDomFQDN = Mid(strSrcDN, InStr(LCase(strSrcDN), &quot;,dc=&quot;) + 4)
 strGCFQDN = Replace(LCase(strDomFQDN), &quot;,dc=&quot;, &quot;.&quot;)
 Set objOldUser = GetObject(&quot;GC://&quot; &amp; strGCFQDN &amp; &quot;/&quot; &amp; strSrcDN)
 For Each strGroup in objOldUser.MemberOf
	On Error Resume Next
	Set objGroup = GetObject(&quot;LDAP://&quot; &amp; strGroup)
	If Not Trim(objGroup.mailNickname) = &quot;&quot; Then
		If Not Instr(objGroup.info, &quot;SmartDL&quot;) &gt; 0 Then
			objGroup.Add(objTargetUser.ADsPath)
			If Err.Number = 0 Then
				objDoc.Write(objGroup.DisplayName &amp; &quot;: Update successful.&lt;br&gt;&quot;)
			Else
				objDoc.Write(objGroup.DisplayName &amp; &quot;: Update UNSUCCESSFUL.&lt;br&gt;&quot;)
			End If
		Else
			objDoc.Write(objGroup.DisplayName &amp; &quot;: Skipped (SmartDL).&lt;br&gt;&quot;)
		End If
	End If
	On Error Goto 0
 Next
 
 Set objOldUser = Nothing
 Set objTargetUser = Nothing
 Set objIE = Nothing
 Set objRecordset = Nothing
 Set objConnection = Nothing

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

'Version 2.0 - July 23, 2007

'Copy distribution group membership from one user to another,

'excluding automated DLs (SmartDL).

'Get source user

While Not bolExit = True

strOldSamUser = InputBox("Enter the sAMAccountName of the person to copy DLs FROM." _

, "Enter username")

If strOldSamUser = "" Then

WScript.Quit

End If

'Find the Global Catalog server

Set objCont = GetObject("GC:")

For Each objGC In objCont

strADsPath = objGC.ADsPath

Set objConnection = CreateObject("ADODB.Connection")

Set objRecordset = CreateObject("ADODB.Recordset")

objConnection.Provider = "ADsDSOObject"

objConnection.Open "ADs Provider"

strQuery = "<" & strADsPath & ">;(&(objectcategory=user)(sAMAccountName=" & strOldSamUser & _

"));displayName,distinguishedName;subtree"

Set objRecordset = objConnection.Execute(strQuery)

If Trim(objRecordset.Fields("distinguishedName")) = "" Then

strNoUser = MsgBox("Warning: User cannot be found.  Verify sAMAccountName.", vbCritical, "User not found!")

bolExit = False

Else

intCorrectUser = MsgBox("Is this the correct user?" & VbCrLf & VbCrLf & "Display Name: " & _

objRecordset.Fields("displayName") & VbCrLf & "DN: " & objRecordset.Fields("distinguishedName"), _

vbYesNo, "Old user?")

If intCorrectUser <> 6 Then

bolExit = False

Else

strSrcDN = objRecordset.Fields("distinguishedName")

bolExit = True

End If

Wend

'Open IE to display progress and results

Set objIE = CreateObject("InternetExplorer.Application")

objIE.AddressBar = False

objIE.Menubar = False

objIE.Toolbar = False

objIE.Resizable = True

objIE.Left = 10

objIE.Height = 450

objIE.Width = 800

objIE.Visible = True

objIE.Navigate("about:blank")

While objIE.Busy

WScript.Sleep 100

Wend

Set objDoc = objIE.Document

objDoc.Open

objDoc.Write("<TITLE>Copy DL Membership</TITLE>")

objDoc.Write("<BODY BGCOLOR=#C0C0C0>")

objDoc.Write("Source: " & objRecordset.Fields("distinguishedName") & " ")

'Get target user

bolExit = False

While Not bolExit = True

strNewSamUser = InputBox("Enter the sAMAccountName of the person to copy DLs TO." _

, "Enter username")

If strNewSamUser = "" Then

objIE.Quit

WScript.Quit

End If

strQuery = "<" & strADsPath & ">;(&(objectcategory=user)(sAMAccountName=" & strNewSamUser & _

"));displayName,distinguishedName;subtree"

Set objRecordset = objConnection.Execute(strQuery)

If Trim(objRecordset.Fields("distinguishedName")) = "" Then

strNoUser = MsgBox("Warning: User cannot be found.  Verify sAMAccountName.", vbCritical, "User not found!")

bolExit = False

Else

intCorrectUser = MsgBox("Is this the correct user?" & VbCrLf & VbCrLf & "Display Name: " & _

objRecordset.Fields("displayName") & VbCrLf & "DN: " & objRecordset.Fields("distinguishedName"), _

vbYesNo, "Old user?")

If intCorrectUser <> 6 Then

bolExit = False

Else

Set objTargetUser = GetObject("LDAP://" & objRecordset.Fields("distinguishedName"))

bolExit = True

End If

Wend

'Write target user to IE window

objDoc.Write("Target: " & objRecordset.Fields("distinguishedName") & "")

'Copy DLs

strDomFQDN = Mid(strSrcDN, InStr(LCase(strSrcDN), ",dc=") + 4)

strGCFQDN = Replace(LCase(strDomFQDN), ",dc=", ".")

Set objOldUser = GetObject("GC://" & strGCFQDN & "/" & strSrcDN)

For Each strGroup in objOldUser.MemberOf

On Error Resume Next

Set objGroup = GetObject("LDAP://" & strGroup)

If Not Trim(objGroup.mailNickname) = "" Then

If Not Instr(objGroup.info, "SmartDL") > 0 Then

objGroup.Add(objTargetUser.ADsPath)

If Err.Number = 0 Then

objDoc.Write(objGroup.DisplayName & ": Update successful. ")

Else

objDoc.Write(objGroup.DisplayName & ": Update UNSUCCESSFUL. ")

End If

Else

objDoc.Write(objGroup.DisplayName & ": Skipped (SmartDL). ")

End If

On Error Goto 0

Set objOldUser = Nothing

Set objTargetUser = Nothing

Set objIE = Nothing

Set objRecordset = Nothing

Set objConnection = Nothing

Quick and dirty script to copy DLs from one user to another

Posted on February 4, 2007 by Scott — No Comments ↓

Edit: The inline code in this post is not the latest version of the script. Get the latest version from the downloads page.

It is not uncommon at my company to have to move a user from one domain to another for technical, logistical, or political reasons. For another set of reasons, moving the user account to the other domain is not done, instead manually creating a new one and associating the mailbox with the new account.

DL membership does not automatically get updated when this is done, so I have been doing it manually. It has been on my to-do list for awhile to write a script to copy the DL membership from the old account to the new one. So I threw this together this morning. It lacks some of the nice extras my other scripts have (finding the user by logon name, email results, true logging) but it does work.

You have to edit the script to give it the variables for the old and new users’ dn. It will skip security groups (any group without an alias) and also groups whose Notes (info) attribute contains the word SmartDL. We use Imanami’s SmartDL for automated DL membership when applicable. Those will be automatically updated the next time each of their jobs run.

Download it here, or copy/paste below.

Option Explicit
Dim strOldUser, strNewUser, objOldUser, objNewUser, strGroup, objGroup
strOldUser = &quot;&quot; 'dn of user to copy from'
strNewUser = &quot;&quot; 'dn of user to copy to'
Set objOldUser = GetObject(&quot;LDAP://&quot; &amp; strOldUser)
Set objNewUser = GetObject(&quot;LDAP://&quot; &amp; strNewUser)
wscript.echo &quot;Source user: &quot; &amp; objOldUser.DisplayName
wscript.echo &quot;Target user: &quot; &amp; objNewUser.DisplayName
For Each strGroup in objOldUser.MemberOf
	On Error Resume Next
	Set objGroup = GetObject(&quot;LDAP://&quot; &amp; strGroup)
    If Not Trim(objGroup.mailNickname) = &quot;&quot; Then
        If Not Instr(objGroup.info, &quot;SmartDL&quot;) &gt; 0 Then
			objGroup.Add(objNewUser.ADsPath)
			If Err.Num = 0 Then
				wscript.echo objGroup.DisplayName &amp; &quot;: Update successful.&quot;
			Else
				wscript.echo objGroup.DisplayName &amp; &quot;: Update UNSUCCESSFUL.&quot;
			End If
        Else
			wscript.echo objGroup.DisplayName &amp; &quot;: Skipped (SmartDL).&quot;
        End If
	End If
	On Error Goto 0
Next
Set objOldUser = Nothing
Set objNewUser = Nothing

Option Explicit

Dim strOldUser, strNewUser, objOldUser, objNewUser, strGroup, objGroup

strOldUser = "" 'dn of user to copy from'

strNewUser = "" 'dn of user to copy to'

Set objOldUser = GetObject("LDAP://" & strOldUser)

Set objNewUser = GetObject("LDAP://" & strNewUser)

wscript.echo "Source user: " & objOldUser.DisplayName

wscript.echo "Target user: " & objNewUser.DisplayName

For Each strGroup in objOldUser.MemberOf

On Error Resume Next

Set objGroup = GetObject("LDAP://" & strGroup)

If Not Trim(objGroup.mailNickname) = "" Then

If Not Instr(objGroup.info, "SmartDL") > 0 Then

objGroup.Add(objNewUser.ADsPath)

If Err.Num = 0 Then

wscript.echo objGroup.DisplayName & ": Update successful."

Else

wscript.echo objGroup.DisplayName & ": Update UNSUCCESSFUL."

End If

Else

wscript.echo objGroup.DisplayName & ": Skipped (SmartDL)."

End If

On Error Goto 0

Set objOldUser = Nothing

Set objNewUser = Nothing

Beware of the impact of the January 11, 2007, IMF update on BES Enterprise Activation messages

Posted on January 31, 2007 by Scott — No Comments ↓

A couple weeks ago, I started having a problem where BES users who were using Enterprise Activation were getting "Operation timed out" messages when activating. Existing users still worked fine, as did users who activated via Desktop Manager. Restarting BES services didn’t change anything; neither did rebooting. Event logs didn’t show much, and the application logs didn’t show anything except one line item for when the timeout actually occurred.

A RIM article for troubleshooting EA failures listed several things to check, one of which was that the activation message was actually arriving in the mailbox. So I checked the Inbox’s deleted items cache for one of the mailboxes…nope. I use a third-party utility called IMF Tune to augment the functionality of the IMF, so I have detailed logs of messages processed by the IMF. (To read a case study regarding my company’s use of IMF Tune, go here.)

The logs showed that the activation messages were being deleted/archived at the gateway because their SCL ratings were above the threshold. Some even were being redirected to the Junk E-mail folder (JMF). I was wondering why this was the case since I have never had a problem with the activation messages being flagged by the IMF.

Then I remembered that I had updated the IMF definition files on January 18 with the 01/11/07 update, which is right around when the issue started. For whatever reason, the IMF is now being more discriminatory against the activation messages. To resolve the issue, I white listed the subdomain the activation messages come from: *.etp.na.blackberry.net. And when it happened again today, I discovered that that user is in Europe and EA messages from those users come from a different subdomain: *.etp.eu.blackberry.net.

So if you BES and the IMF, be careful that your gateway and store thresholds don’t keep the activation messages from reaching the inbox. And if they do, white list the sender domain. I didn’t want to just white list all of blackberry.net, so I am using the subdomain that activation messages originate from. If there is yet another contintental subdomain out there (for Asia Pacific, perhaps), I might just chain the white list filter to be blackberry.net AND the subject begins with RIM_.

sidefumbling

The consequence of not having six hydrocoptic marzelvanes fitted to the ambifacient lunar waneshaft.

Category Archives: Exchange 2003

How to clear the mail attribute using PowerShell

PowerShell script to report last successful full backup of Exchange 2007

Articles in the "Report Last Backup of Exchange 2007" series

Convert a mailbox GUID to the user and display name

Updated: Copy DLs from one user to another

Quick and dirty script to copy DLs from one user to another

Beware of the impact of the January 11, 2007, IMF update on BES Enterprise Activation messages