Microsoft.ActiveDirectory.Management.ADPropertyValueCollection | multivalued attributes

:|

$why=get-aduser * -prop servicePrincipalName

$why| where servicePrincipalName|select name,servicePrincipalName |ConvertTo-Csv

gives you
"myadmin","Microsoft.ActiveDirectory.Management.ADPropertyValueCollection"

 $why| where servicePrincipalName|select name, @{L='servicePrincipalName'; E={$_.servicePrincipalName}} |ConvertTo-Csv

Regex and CN to extract name and first OU

need to extract parts of a CN using regex, had to do a quick output, but not happy with the hard coding like "CN="

CN:
CN=LAW\\, JUDE,OU=VIDEO,OU=External,OU=Security - Administrator Accounts,DC=cool,DC=kats

REGEX:
CN=(?<lastname>\w+)\\\\, (?<firstname>\w+),OU=(?<ou>\w+)

RESULT:

Full match	1-24	`CN=LAW\\, JUDE,OU=VIDEO`
Group `lastname`	4-7	`LAW`
Group `firstname`	11-15	`JUDE`
Group `ou`	19-24	`VIDEO`

Extract Primary SMTP from Extract proxyAddresses

we have a situation where mail, primary SMTP (proxyAddresses) & sip address might be different.

$user=$get-aduser -filter * -properties mail,proxyAddresses,msRTCSIP-PrimaryUserAddress

$userlist|select name,SamAccountName,UserPrincipalName,DistinguishedName,Enabled,mail,msRTCSIP-PrimaryUserAddress,@{N='PrimarySMTP'; E={(($_.proxyAddresses |  where {$_ -cmatch "SMTP"}) -split(':'))[1]}}

Powershell Calculated Values - RecipientTypeDetails | msExchRecipientTypeDetails

Hi,

sorry will pretty this up when I get a change. :)

want to replace the exchange email value for msExchRecipientTypeDetails with readable text for an Active Directory Users Report


$userlist=Get-adUser -filter * -Properties name,SamAccountName,Enabled,mail,extensionAttribute5,msExchRecipientTypeDetails,extensionAttribute6,company,Department,Manager,office,title,description,CanonicalName,lastlogondate,proxyAddresses,passwordneverexpires,passwordlastset,otherpager,PasswordExpired,whenCreated,AccountExpirationDate,telephoneNumber,otherTelephone,mobile,msRTCSIP-PrimaryUserAddress

$atext=@'
RecipientTypeDetails,ObjectType
1,User Mailbox
2,Linked Mailbox
4,Shared Mailbox
8,Legacy Mailbox
16,Room Mailbox
32,Equipment Mailbox
64,Mail Contact
128,Mail-enabled User
256,Mail-enabled Universal Distribution Group
512,Mail-enabled non-Universal Distribution Group
1024,Mail-enabled Universal Security Group
2048,Dynamic Distribution Group
4096,Mail-enabled Public Folder
8192,System Attendant Mailbox
16384,Mailbox Database Mailbox
32768,Across-Forest Mail Contact
65536,User
131072,Contact
262144,Universal Distribution Group
524288,Universal Security Group
1048576,Non-Universal Group
2097152,Disabled User
4194304,Microsoft Exchange
2147483648,Remote User Mailbox
8589934592,Remote Room Mailbox
17173869184,Remote Equipment Mailbox
34359738368,Remote Shared Mailbox
'@

$RTD=ConvertFrom-Csv $atext

$userlist|select name,SamAccountName,UserPrincipalName,Enabled,mail,msRTCSIP-PrimaryUserAddress,@{N='msExchRecipientTypeDetails'; E={ $user=$_ ;($rtd | where {$_.RecipientTypeDetails -eq $user.msExchRecipientTypeDetails}| select "ObjectType").ObjectType} },extensionAttribute5,extensionAttribute6,company,Department,Manager,office,title,description,CanonicalName,lastlogondate,passwordneverexpires,passwordlastset,otherpager,PasswordExpired,AccountExpirationDate,whenCreated,proxyAddresses|Convert-ADValues  | Export-Csv E:\inetpub\reports\activedirectory\UsersList.csv -NoTypeInformation

Splunk | Never Expire | Table Filter

Splunk search

"'Don't Expire Password' - Enabled"  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

indexes the Account Name field then maps out for easy viewing.

<search here>  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

GPO Registry Values with recursive array

Sorry using a global array, in function, just needed to get it done. no time today.
Read a GPO, locate the keys need then
Then clone the settings to another GPO

http://pastebin.com/ipDjYMds

Powershell | GPO Link report

[array]$Report = @()

$GPOs = Get-GPO -all | Sort-Object Displayname

foreach ($GPO in $GPOs) {


    Write-Host "Processing GPO $($GPO.DisplayName)"
    $XMLReport = Get-GPOReport -GUID $($GPO.id) -ReportType xml
    $XML = [xml]$XMLReport

    foreach ($gpolink in $xml.GPO.LinksTo.SomPath) {
        $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = $gpolink }
       }

    if ($xml.GPO.LinksTo.SomPath -eq $null) {
       $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = "Nolink" }
            }
       
}

$Report | Export-CSv C:\reporting\GPOLinks.csv

RDP session timeouts copy with powershell

#
# using an account as a template update other account to same value.
#yes.. not the best way.
#

$basic=Get-adUser jeff -Properties userParameters | select userParameters

$userlist=Get-aduser -Filter {samaccountname -like "nerds*"}
foreach ($target in $userlist){
$user=get-aduser $target.SamAccountName -Properties userParameters
$user.userParameters=$basic.userParameters
Set-ADUser -instance $user
$user=$null
}

Update Outlook Store Display Name - with powershell

# Outlook Store Display Name
# http://blogs.msdn.com/b/emeamsgdev/archive/2012/10/29/outlook-code-change-the-name-of-the-root-folder-in-outlook-2010-after-an-smtp-address-change.aspx

$outlook = New-Object -ComObject 'Outlook.Application'
$stores = $Outlook.GetNamespace("MAPI").Session.stores

Foreach ($Store in $stores){
If ($store.ExchangeStoreType -eq "0") {
       
        $updatestore=$store.GetRootFolder()
        $updatestore.Name="Work-Email"       
        }
}

Powershell | Event Log Message content

Security Event Log Taken from 2003 Domain Controller
fixed with http://www.cwflynt.com/logFixer/
Filtered with Eventvwr on Windows 10 saved as evtx

Loaded into powershell and filtered on the message content.


#
# Eventlog filtering
#
$logdetail=Get-WinEvent -path .\filteredchanges.evtx
$results=@()

Foreach($event in $logdetail){
        $mess=$event.message -split "`n"
        $a=$Mess| select-string "Target Account Name"
        $a=$a.ToString().split(":")[1]
        $b=$mess | select-string "Don't Expire Password"
        $c=$mess | select-string "Logon Hours"
        $c=$c.ToString().split(":")[1]
        $d=$mess | select-string "Caller User Name"
        $d=$d.ToString().split(":")[1]

                        $tempObJ = "" | Select Name,Expired,Logon,Changetime,userid
                        $tempObJ.Name = $a
                        $tempObJ.ChangeTime = $event.TimeCreated
                        $tempObJ.Expired = $b
                        $tempObJ.Logon = $c
                        $tempObJ.userid = $d
                        $results+=$tempObJ
}

Powershell : Clone DNS

$xraydns=Get-DnsServerResourceRecord -zonename "elephant.com.au" -ComputerName acdc001 -RRType A
foreach ($dns in $tangodns){
Add-DnsServerResourceRecordA -ZoneName "panda.com.au" -ComputerName acdc001 -Name $dns.hostname -IPv4Address $dns.recorddata.IPv4Address.IPAddressToString #-WhatIf
}

XenApp 6.5 published Windows Explorer using powershell

based on http://support.citrix.com/article/CTX131423

Using a Batch launcher for flexibility to run a powershell script instead of autoit.

[ExplorerLauncher.cmd]
@echo off
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -executionPolicy bypass -file "C:\Program Files\AppScripts\ExplorerLauncher.ps1"
exit

[explorerlauncher.ps1]

#$Process = [Diagnostics.Process]::Start("notepad")
$process = Start-Process notepad -WindowStyle Minimized -PassThru
$id = $Process.Id
Write-Host "Pre-Launch Process created. Process id is $id"
Write-Host "sleeping for 2 seconds"
Start-Sleep -Seconds 2
Write-Host "Loading explorer"
Start-Process "Explorer" -ArgumentList "Z:\"
Write-Host "sleeping for 2 seconds"
try {
Stop-Process -Id $id -ErrorAction stop
Write-Host "Successfully killed the process with ID: $ID"
} catch {
Write-Host "Failed to kill the process"
}
Start-Sleep -Seconds 2
Write-host "Exiting Launch completed"
exit

windows 10 | cleanups debloat

if you dare...

follow this
- https://www.reddit.com/r/Windows10/comments/3f38ed/guide_how_to_disable_data_logging_in_w10/


my Debloat script...
Help from
- http://blogs.technet.com/b/deploymentguys/archive/2013/10/21/removing-windows-8-1-built-in-applications.aspx
- https://www.reddit.com/r/Windows10/comments/3diylq/powershell_commands_to_uninstall_unwanted_builtin/

#
# Cleans up Windows 10 Bloatware... Perform at your own risk :) !
#

$Removelist=@"
Microsoft.BingFinance                   
Microsoft.BingWeather
Microsoft.BingNews
Microsoft.Windows.Photos                
Microsoft.WindowsCamera
Microsoft.XboxApp                       
Microsoft.ZuneMusic                     
microsoft.windowscommunicationsapps
Microsoft.SkypeApp                      
Microsoft.ZuneVideo                     
Microsoft.WindowsSoundRecorder          
Microsoft.WindowsScan                   
Microsoft.WindowsReadingList            
Microsoft.WindowsPhone                  
Microsoft.WindowsMaps                   
Microsoft.Reader                        
Microsoft.People                        
Microsoft.Office.OneNote                
Microsoft.MicrosoftSolitaireCollection  
Microsoft.MicrosoftOfficeHub            
Microsoft.BingTravel                    
Microsoft.BingSports                    
Microsoft.BingHealthAndFitness          
Microsoft.BingFoodAndDrink
#Microsoft.3DBuilder
"@

$removelist=$Removelist.split("`n")

ForEach ($App in $removeList){

$app=$App.Trim()

$Packages = Get-AppxPackage | Where-Object {$_.Name -eq $App}

if ($Packages -ne $null){

Write-Host "Removing Appx Package: $App"

foreach ($Package in $Packages)

{

Remove-AppxPackage -package $Package.PackageFullName 

}

}

else

{

Write-Host "Unable to find package: $App"

}

$ProvisionedPackage = Get-AppxProvisionedPackage -online | Where-Object {$_.displayName -eq $App}

if ($ProvisionedPackage -ne $null)

{

Write-Host "Removing Appx Provisioned Package: $App"

remove-AppxProvisionedPackage -online -packagename $ProvisionedPackage.PackageName 

}

else

{

Write-Host "Unable to find provisioned package: $App"

}

}

Powershell | Array, Element, SQL

working on extracting elements from a array then uploading into SQL

#test array
$comp = New-Object System.Object
$comp | Add-Member -type NoteProperty -name DSAType -value "xtra"
$comp | Add-Member -type NoteProperty -name Hostname  -value "Host"
$comp | Add-Member -type NoteProperty -name Fails -value "failures"

#foreach ($comp in $warrantarray){
$cl=$null
$dl=$null
($comp|gm)|where{$_.membertype -eq 'noteproperty'}|% {
$cl+=$_.Name+","
$dl+=($comp).($_.name)+","
}
$cl=$cl.Substring(0,$cl.Length-1)
$cl
$dl=$dl.Substring(0,$dl.Length-1)
$dl
# do sql stuf... but write-hosting here...

write-host "INSERT INTO $dbTable ($cl) VALUES ($dl)"

#}

also possible to this way.

http://sphints.blogspot.com.au/2014/03/powershell-write-array-of-objects-to.html

BBQ Linux - IPC \ PACMAN update error

Just performed my 2nd built of antergos
for some reason PACMAN was having issues. :|

ran

# dirmngr  << dev

from https://bbs.archlinux.org/viewtopic.php?id=190380

and all was working again...

XenApp Changelog - Last 7 days

Add-PSSnapin Citrix.common.commands
$connectionstring="Data Source=lc28xensql;Initial Catalog=xencfglog;User Id=xencfgviewer;Password=xencfgviewer;Provider=SQLOLEDB;"
$timeperiodfrom=(Get-Date).AddDays(-7)
Get-CtxConfigurationLogReport -ConnectionString $connectionstring -TimePeriodFrom $timeperiodfrom | format-table -Property Date,account,tasktype,itemtype,itemname,description -AutoSize

LSPCI using WMI ( WMIC )

From Command Prompt:
Wmic path win32_pnpentity where "deviceid like '%PCI%'" get name,deviceid

with powershell:
gwmi win32_pnpentity | where{$_.deviceid -match "PCI"} | select name,deviceid

POWERSHELL | Comparing File ACL

#Generate the Base line acl

$TheACL=Get-Acl \\$server\$testpath\LCFSTEST\test.txt
$TheACL|Export-Clixml $logfolder\'base_'$testpath.xml

#ACTION - Modify permissions

$TheACL=Get-Acl \\$server\$testpath\LCFSTEST\test.txt

#Import the BASE ACL

$BaseACL=Import-Clixml $logfolder\'base_'$testpath.xml
If (diff $($TheACL.Access) $($BaseACL.Access) -Property Filesystemrights) { Write-Host Different Check $testpath Permissions}

removing windows 2012 data deduplication volume

thanks to nickwhittome.com/2014/10/01/disabling-data-deduplication-on-windows-server-2012r2

#The unoptimise command
start-dedupjob -Volume E:   -Type Unoptimization
#Check the status
get-dedupjob

Then...

#Clean up the Garbage
start-dedupjob -Volume E: -Type GarbageCollection
#Check the status
get-dedupjob

Then...
 
Disable-DedupVolume -Volume E:

Adobe Reader 10 - Access Denied opening PDF - solved

Some Operational team members moved some data to a Windows 2012 R2 server.
The Citrix Environment is currently in a 'change freeze' and was running 10.0.1.0 of adobe readerX.


When a pdf was opened from network share "access denied"
It could be fixed by untick protected mode.. but then we are unprotected right.

Note: Upgrading the Adobe reader also fixed this issue but 'Change Freeze'

so

Root Cause : Citrix version of Adobe Reader PDF is not trusting any de-duplicated pdf files as they have been “modified”

Process to replicate

1. robocopy  "E:\Data\Group" E:\temp   *.pdf /s  /move
2. robocopy   "E:\temp" "E:\Data\Group"   E *.pdf /s /move
3. [pdf file attribute was A]
4. Forced Dedup Job - Start-DedupJob E: -Type Optimization 
   (note our server was set to MinimumFileAgeDays 0)
5. [pdf file attribute was APL]

so either

Set-DedupVolume –Volume E: -ExcludeFiletype pdf

 or
 Just disabled dedup on this volume.

/thx