This article addresses some common questions about WSUS maintenance for Configuration Manager environments.
Category Archives: Script
Get AD Nested Group Members with Powershell
Use the following script to get nested AD group members using powershell.
Import-Module ActiveDirectory
function Get-ADNestedGroupMembers {
[cmdletbinding()]
param ( [String] $Group )
Import-Module ActiveDirectory
$Members = Get-ADGroupMember -Identity $Group -Recursive | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail}
$members
}
Get-ADNestedGroupMembers "GROUP" | Select Name,SamAccountName,mail,enabledMicrosoft 365 – Self-service purchase
Self-service purchase gives users a chance to try out new technologies and develop solutions that ultimately benefit their larger organizations. Central procurement and IT teams have visibility to all users who buy and deploy self-service purchase solutions through the Microsoft 365 admin center. Admins can turn off self-service purchasing on a per product basis via PowerShell..
To read more about the Self-service purchase option, go to: Self-service purchase FAQ | Microsoft Docs
To disable the AllowSelfServicePurchase do the following:
#Install module
Install-Module -Name MSCommerce
#Import module
Import-Module -Name MSCommerce
#Connect
Connect-MSCommerce
#Get details
Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase
#Disable ProductID (or $True to enable)
Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0KP0N -Enabled $FalseThe following table shows the ProductID needed to enable or disable
| Product | ProductId |
|---|---|
| Power Apps per user | CFQ7TTC0KP0P |
| Power Automate per user | CFQ7TTC0KP0N |
| Power Automate RPA | CFQ7TTC0KXG6 |
| Power BI Premium (standalone) | CFQ7TTC0KXG7 |
| Power BI Pro | CFQ7TTC0L3PB |
| Project Plan 1 | CFQ7TTC0KXND |
| Project Plan 3 | CFQ7TTC0KXNC |
| Visio Plan 1 | CFQ7TTC0KXN9 |
| Visio Plan 2 | CFQ7TTC0KXN8 |
source: Use AllowSelfServicePurchase for the MSCommerce PowerShell module | Microsoft Docs
Cannot Tenant to Teams Only upgrade mode in Teams Admin Center
When changing the coexistence mode to Teams only you get the following error: Please see the unsaved sections higlighted in red below:
We cannot see what the problem is when switching to teams only. With powershell it has better error messages. Use the following powershell to connect to teams and change the tennant
#Connect with the SkypeOnlineConnector
Import-Module SkypeOnlineConnector
$sfbSession = New-CsOnlineSession
Import-PSSession $sfbSession
#Change the tennant to TeamsOnly
Grant-CsTeamsUpgradePolicy -PolicyName UpgradeToTeams -GlobalThe following message appears:
This organization cannot be upgraded to TeamsOnly at the tenant level because there is an on-premise deployment of Skyp
e for Business detected in 1 or more of it sip domains
To change this use the following command:
Disable-CsOnlineSipDomain -Domain domainname
After all domains have been altered, you can change the tenant to TeamsOnly with Powershell or the GUI:
sources:
Office 365 Hide mailboxes from the GAL
Export all mailboxes who are shown in the GAL
Get-Mailbox -ResultSize Unlimited | Where {$_.HiddenFromAddressListsEnabled -eq $false}| select UserPrincipalname, HiddenFromAddressListsEnabled | Export-Csv "c:\temp\gal.csv" -NoTypeInformation -Encoding UTF8Show all private groups which are shown in the GAL (Teams groups are default hidden)
Get-UnifiedGroup | Where-Object {$_.AccessType -eq 'Private'} | select Displayname, PrimarySMTPAddress
To hide a single mailbox use the following command:
Set-Mailbox -Identity [email protected] -HiddenFromAddressListsEnabled $trueTo hide multiple mailboxes from the GAL, create a CSV file and use that as input to hide the mailboxes:
Import-Csv 'C:\Hide_Mailboxes.csv' | ForEach-Object {
$upn = $_."UserPrincipalName"
Set-Mailbox -Identity $upn -HiddenFromAddressListsEnabled $true
}To hide a single group use the following command:
Set-UnifiedGroup <group> -HiddenFromAddressListsEnabled $trueOr hide all private groups at once:
Get-UnifiedGroup | Where-Object {$_.AccessType -eq 'Private'} | Set-UnifiedGroup -HiddenFromAddressListsEnabled $trueSources:
Find mailboxes hidden from the GAL using Powershell – MorganTechSpace
Hide Office 365 Group from GAL using Powershell – MorganTechSpace
Check Microsoft 365 email forward
When you want to know which users has email forwards on their Microsoft 365 mailbox, use the following powershell command:
Get-Mailbox -Filter {ForwardingsmtpAddress -ne $null} | ft Name,ForwardingsmtpAddress,DeliverToMailboxAndForward -AutosizeThis will list all mailboxes with an forwarding rule.
Veeam: Your License consumption has been exceeding the license cap
When using Veeam backup for Microsoft Office 365 it is possible you get a license error during backup. This is because when you move a Microsoft 365 license to a new user, this needs a backup to and counts as a second Veeam license.
Normally this should not be a problem, you can use more Veeam licenses than you have (10% of extra licenses or 10 user accounts -whichever is greater-) to overcome this issue. And if a user does not have a restore point in the past 31 days the license will be available again. To see the more information about licenses check this page out: Licensing and License Types – Veeam Backup for Microsoft Office 365 Guide
If Veeam is not backing up anymore because you do not have enough license, you should purchase new ones or free some.
To revoke licenses without waiting you can use powershell. To revoke licenses you need to remove all of the user’s data from all the repositories prior to revoking the license.
Use the following procedure to remove user licenses: Remove User License in Veeam Backup for Microsoft Office 365
Use the following powershell command to check which data a user has on a repository:
$repository = Get-VBORepository -Name "REPOSITORY"
$user = Get-VBOEntityData -Type User -Repository $repository -Name "[email protected]"
$userIf the user has email existing on the repository, you will use the following section:
#This remove script is used for repositories containing users Email
#Fill in "REPOSITORY" with the name of the repository as it is showing in Veeam Backup for Office 365 and the email address of the user you wish to remove the data for "[email protected]"
$repository = Get-VBORepository -Name "REPOSITORY"
$user = Get-VBOEntityData -Type User -Repository $repository -Name "[email protected]"
Remove-VBOEntityData -Repository $repository -User $user -Mailbox -ArchiveMailbox -OneDrive -Sites
#Y will accept the deleting of dataRemove License
Once you have removed the user’s data from all configured repositories, then you can remove the license for this user. The below script will pull the organization you have added into the console and desired user to then release the license. If you missed a repository, the error will tell you on what repository you still have remaining data:
#If there is no more data for this user on any repository you can use the following to remove the license
#Fill in the domain name as it is shown in Veeam Office 365 "DOMAIN.onmicrosoft.com" and the users email address "[email protected]"
$org = Get-VBOOrganization -Name "DOMAIN.onmicrosoft.com"
$licensedUser = Get-VBOLicensedUser -Organization $org -Name "[email protected]"
Remove-VBOLicensedUser -User $licensedUserNo Email
If a user has no email data look at the following article to delete sharepoint or onedrive data: Remove User License in Veeam Backup for Microsoft Office 365
Failed To Disable The Mailbox Due To a Conflict In Directory Settings
If you have a conflict in directory settings between Microsoft 365 and your on premise location use the next procedure to solve this
Check if the affected mailbox in Exchange Online is an usermailbox
get-recipient user | fl recipient*
If not already, disable the user account in the on-premise environment.
disable-mailbox user
Wait (or force) until the changes replicate to Microsoft 365. Once it is synced, enable the on-premise object as an remote user mailbox
Enable-RemoteMailbox user -RemoteRoutingAddress [email protected]
Wait (or force) until the sync to Microsoft 365 has been completed and then check the user. The error message should be gone and a license can be added
Windows Backup Mail Report Script
Earlier i wrote a script to check for windows server backup results. At the next site a better script is written to report the results of windows server backup:
https://jocha.se/blog/tech/wbadmin-backup-mail-report
The following script is from this site:
<# .SYNOPSIS Windows Backup Mail Report Written by Joakim, http://jocha.se .DESCRIPTION Version 4.1 - Updated 2016-05-31 This script will mail a report from the latest Windows Backup job, can also fetch and generate reports from remote servers. The script requires at least PowerShell v3. .EXAMPLE To automate this script, setup a scheduled task. Name: Backup Email Task Description: Notifies backup admin of scheduled backup status Run whether user is logged on or not Trigger > On event > Log=Microsoft-Windows-Backup/Operational > Source=Backup > Event ID(s)= 4,5,8,9,17,22,49,50,52,100,517,518,521,527,528,544,545,546,561,564,612 Action: Start a Program Program: Powershell Arguments: -Command "C:\Scripts\WBJobReport.ps1" -ExecutionPolicy Bypass #> Add-PSSnapin Windows.ServerBackup -ErrorAction SilentlyContinue ####################################### #-------- Variables to change --------# # Uncomment the two rows below and row 207 to enable "Remote Report" generation. #$Servers = New-PSSession -Computername Server01, Server02, Server03 #Invoke-Command -Session $Servers { # Set your Company name $Company = "MyCompany" # Set the recipient/sender email-address $MailTo = "[email protected]" $MailFrom = "$Company Backup <[email protected]>" # SMTP user account password $MailUser = "MyUser" $MailPassword = "MyPassword" # SMTP Server $MailServer = "smtpserver.company.com" # SMTP Port $MailPort = 587 # If your server uses SSL, otherwise set to $false $UseSSL = $true #---- Don't change anything below ----# ####################################### Try { $CurrentTime = (Get-Date).ToString("yyyy-MM-dd HH:mm") $Computer = Get-Content env:computername $WBJob = Get-WBJob -Previous 1 $WBSummary = Get-WBSummary $WBLastSuccess = ($WBSummary.LastSuccessfulBackupTime).ToString("yyyy-MM-dd HH:mm") $WBResult = $WBSummary.LastBackupResultHR $WBErrorMsg = $WBJob.ErrorDescription + "`n" + $WBSummary.DetailedMessage $WBStartTime = $WBJob.StartTime $WBEndTime = $WBJob.EndTime $WBDuration = (New-TimeSpan -Start $WBStartTime -End $WBEndTime) $Password = ConvertTo-SecureString $MailPassword -AsPlainText -Force $Credentials = New-Object System.Management.Automation.PSCredential ($MailUser, $Password) Function FormatBytes { Param ( [System.Int64]$Bytes ) [string]$BigBytes = "" #Convert to TB If ($Bytes -ge 1TB) {$BigBytes = [math]::round($Bytes / 1TB, 2); $BigBytes += " TB"} #Convert to GB ElseIf ($Bytes -ge 1GB) {$BigBytes = [math]::round($Bytes / 1GB, 2); $BigBytes += " GB"} #Convert to MB ElseIf ($Bytes -ge 1MB) {$BigBytes = [math]::round($Bytes / 1MB, 2); $BigBytes += " MB"} #Convert to KB ElseIf ($Bytes -ge 1KB) {$BigBytes = [math]::round($Bytes / 1KB, 2); $BigBytes += " KB"} #If smaller than 1KB, leave at bytes. Else {$BigBytes = $Bytes; $BigBytes += " Bytes"} Return $BigBytes } Function Log-BackupItems { Param ( [System.String]$Name, [System.String]$Status, [System.Int64]$Bytes ) $Item = New-Object System.Object; $Item | Add-Member -Type NoteProperty -Name "Name" -Value $Name; $Item | Add-Member -Type NoteProperty -Name "Status" -Value $Status; $Item | Add-Member -Type NoteProperty -Name "Size" -Value (FormatBytes -Bytes $Bytes); Return $Item; } $results=@() $WBJob | % { $_.JobItems | % { $BackupItem = $null If ($_.Name -eq 'VolumeList') { $_ | % {$_.SubItemList | % { $BackupItem = Log-BackupItems -Name $_.Name -Status $_.State -Bytes $_.TotalBytes $results += $BackupItem }} } Else { $_ | % { $BackupItem = Log-BackupItems -Name $_.Name -Status $_.State -Bytes $_.TotalBytes $results += $BackupItem } } } } # Change Result of 0 to Success in green text and any other result as Failure in red text If ($WBResult -eq 0) { $WBResult = "Successful"} Else {$WBResult = "Failed"} # Assemble the HTML Report $HTMLMessage = @" <!DOCTYPE html> <html> <head> <title>$Company Backup Report for $Computer</title> <style> body { font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 12px } h3{ clear: both; font-size: 150%; margin-left: 20px;margin-top: 30px; } table { padding: 15px 0 20px; width: 500px; text-align: left; } td, th { padding: 0 20px 0 0; margin 0; text-align: left; } th { margin-top: 15px } a, a:visited { color: #2ea3f2; text-decoration: none; } #Report { width: 600px; } #Successful { color: green } #Failed { color: red } </style> </head> <body> <div id="Report"> <p><h3><a href="http://jocha.se">$Company Backup Report for $Computer</a></p></h3> <table id="summary"><tbody> <tr><td>Todays date:</td> <td>$CurrentTime</td></tr> <tr><td>Last Successful Backup:</td> <td>$WBLastSuccess</td></tr> <tr><td>Start time last backup:</td> <td>$WBStartTime</td></tr> <tr><td>End time last backup:</td> <td>$WBEndTime</td></tr> <tr><td>Duration last backup:</td> <td>$WBDuration</td></tr> <tr><td>Backup Result:</td> <td><b id="$WBResult">$WBResult</b></td></tr> <tr><td>Error Message (if applicable):</td> <td>$WBErrorMsg</td></tr></tbody></table> $( $html = $results | ConvertTo-HTML -Fragment $xml=[xml]$html $attr=$xml.CreateAttribute('id') $attr.Value='items' $xml.table.Attributes.Append($attr) | out-null $html=$xml.OuterXml | out-string $html ) </div> </body> </html> "@ $email = @{ SMTPServer = $MailServer UseSSL = $UseSSL BodyAsHtml = $true Port = $MailPort Credential = $Credentials Encoding = ([System.Text.Encoding]::UTF8) To = $MailTo From = $MailFrom Subject = "$WBResult Backup on $Computer" Body = $HTMLMessage } Send-MailMessage @email } Catch { $email = @{ SMTPServer = $MailServer BodyAsHtml = $true UseSSL = $UseSSL # Port is a PowerShell v3 variable Port = $MailPort Credential = $Credentials Encoding = ([System.Text.Encoding]::UTF8) To = $MailTo From = $MailFrom Subject = "Failed Backup on $Computer" Body = "The backup script failed to run!" } Send-MailMessage @email } # Uncomment below to enable "Remote Report". #}
Configure Email notification for Windows Server Backup
When you need to rely on Windows Server Backup, you want some sort of reporting. A lot of scripts with mailing functions are available (e.g. WSB Backup to network with email notification and rotation) . If you want to rely on simple messaging from the server itself, you can use scheduled tasks for this.
Windows Server Backup writes events to its own event log (event logs > Applications and Services Logs > Microsoft > Windows > Backup > Operational). We can use these successful (4) and unsuccessful (5) events as a trigger.
Create two scheduled tasks (can run under system) with the following triggers:
In the action of the tasks, run a powershell command to send a mail.
Source: https://www.bluecompute.co.uk/blogposts/configure-email-notification-for-windows-server-backup/