Powershell Calculated Values - RecipientTypeDetails | msExchRecipientTypeDetails

Hi,

sorry will pretty this up when I get a change. :)

want to replace the exchange email value for msExchRecipientTypeDetails with readable text for an Active Directory Users Report


$userlist=Get-adUser -filter * -Properties name,SamAccountName,Enabled,mail,extensionAttribute5,msExchRecipientTypeDetails,extensionAttribute6,company,Department,Manager,office,title,description,CanonicalName,lastlogondate,proxyAddresses,passwordneverexpires,passwordlastset,otherpager,PasswordExpired,whenCreated,AccountExpirationDate,telephoneNumber,otherTelephone,mobile,msRTCSIP-PrimaryUserAddress

$atext=@'
RecipientTypeDetails,ObjectType
1,User Mailbox
2,Linked Mailbox
4,Shared Mailbox
8,Legacy Mailbox
16,Room Mailbox
32,Equipment Mailbox
64,Mail Contact
128,Mail-enabled User
256,Mail-enabled Universal Distribution Group
512,Mail-enabled non-Universal Distribution Group
1024,Mail-enabled Universal Security Group
2048,Dynamic Distribution Group
4096,Mail-enabled Public Folder
8192,System Attendant Mailbox
16384,Mailbox Database Mailbox
32768,Across-Forest Mail Contact
65536,User
131072,Contact
262144,Universal Distribution Group
524288,Universal Security Group
1048576,Non-Universal Group
2097152,Disabled User
4194304,Microsoft Exchange
2147483648,Remote User Mailbox
8589934592,Remote Room Mailbox
17173869184,Remote Equipment Mailbox
34359738368,Remote Shared Mailbox
'@

$RTD=ConvertFrom-Csv $atext

$userlist|select name,SamAccountName,UserPrincipalName,Enabled,mail,msRTCSIP-PrimaryUserAddress,@{N='msExchRecipientTypeDetails'; E={ $user=$_ ;($rtd | where {$_.RecipientTypeDetails -eq $user.msExchRecipientTypeDetails}| select "ObjectType").ObjectType} },extensionAttribute5,extensionAttribute6,company,Department,Manager,office,title,description,CanonicalName,lastlogondate,passwordneverexpires,passwordlastset,otherpager,PasswordExpired,AccountExpirationDate,whenCreated,proxyAddresses|Convert-ADValues  | Export-Csv E:\inetpub\reports\activedirectory\UsersList.csv -NoTypeInformation

Splunk | Never Expire | Table Filter

Splunk search

"'Don't Expire Password' - Enabled"  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

indexes the Account Name field then maps out for easy viewing.

<search here>  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

GPO Registry Values with recursive array

Sorry using a global array, in function, just needed to get it done. no time today.
Read a GPO, locate the keys need then
Then clone the settings to another GPO

http://pastebin.com/ipDjYMds

Powershell | GPO Link report

[array]$Report = @()

$GPOs = Get-GPO -all | Sort-Object Displayname

foreach ($GPO in $GPOs) {


    Write-Host "Processing GPO $($GPO.DisplayName)"
    $XMLReport = Get-GPOReport -GUID $($GPO.id) -ReportType xml
    $XML = [xml]$XMLReport

    foreach ($gpolink in $xml.GPO.LinksTo.SomPath) {
        $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = $gpolink }
       }

    if ($xml.GPO.LinksTo.SomPath -eq $null) {
       $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = "Nolink" }
            }
       
}

$Report | Export-CSv C:\reporting\GPOLinks.csv

RDP session timeouts copy with powershell

#
# using an account as a template update other account to same value.
#yes.. not the best way.
#

$basic=Get-adUser jeff -Properties userParameters | select userParameters

$userlist=Get-aduser -Filter {samaccountname -like "nerds*"}
foreach ($target in $userlist){
$user=get-aduser $target.SamAccountName -Properties userParameters
$user.userParameters=$basic.userParameters
Set-ADUser -instance $user
$user=$null
}

Update Outlook Store Display Name - with powershell

# Outlook Store Display Name
# http://blogs.msdn.com/b/emeamsgdev/archive/2012/10/29/outlook-code-change-the-name-of-the-root-folder-in-outlook-2010-after-an-smtp-address-change.aspx

$outlook = New-Object -ComObject 'Outlook.Application'
$stores = $Outlook.GetNamespace("MAPI").Session.stores

Foreach ($Store in $stores){
If ($store.ExchangeStoreType -eq "0") {
       
        $updatestore=$store.GetRootFolder()
        $updatestore.Name="Work-Email"       
        }
}

Powershell | Event Log Message content

Security Event Log Taken from 2003 Domain Controller
fixed with http://www.cwflynt.com/logFixer/
Filtered with Eventvwr on Windows 10 saved as evtx

Loaded into powershell and filtered on the message content.


#
# Eventlog filtering
#
$logdetail=Get-WinEvent -path .\filteredchanges.evtx
$results=@()

Foreach($event in $logdetail){
        $mess=$event.message -split "`n"
        $a=$Mess| select-string "Target Account Name"
        $a=$a.ToString().split(":")[1]
        $b=$mess | select-string "Don't Expire Password"
        $c=$mess | select-string "Logon Hours"
        $c=$c.ToString().split(":")[1]
        $d=$mess | select-string "Caller User Name"
        $d=$d.ToString().split(":")[1]

                        $tempObJ = "" | Select Name,Expired,Logon,Changetime,userid
                        $tempObJ.Name = $a
                        $tempObJ.ChangeTime = $event.TimeCreated
                        $tempObJ.Expired = $b
                        $tempObJ.Logon = $c
                        $tempObJ.userid = $d
                        $results+=$tempObJ
}