Category Archives: Microsoft Azure

Everything about Azure and Cloud technology

Upgrading Exchange Online PowerShell to V2 Module

Managing Exchange Online

If you have Exchange Online and your users are MFA enabled then you most likely will be using Exchange Online’ s ECP (Exchange Control Panel or Admin Center) to connect to Exchange Online PowerShell through the Hybrid Windows since this is the only supported way with MFA.

image

Clicking on Configure would install the PowerShell Module of Exchange Online which looks like the below screenshot.

image

New PowerShell with MFA support

If you have launched Exchange Online PowerShell today then you most likely have noticed there’s a red line stating the possibility to try the new (Preview Version) of Exchange PowerShell V2 .

Microsoft has recently released a new version of Exchange Online PowerShell Module which supports MFA and can be run directly from your computer without the need to login to Exchange Online Admin Center and download any files from there.  Check details in this link

As stated in the article, the Module is just in preview so it has some known and maybe unknown bugs as well.

How to Install it?

The installation process is pretty straightforward, Launch Windows PowerShel as an Administrator (It’s required for the installation).

Run these 4 cmdlets

Set-ExecutionPolicy RemoteSigned

Install-Module PowershellGet –Force

Update-Module PowershellGet

Install-Module -Name ExchangeOnlineManagement

image

You might get a warning that the Module you’re about to install is from an Untrusted Repository, Accept it by typing Y and hit enter

Type the following cmdlet to ensure that Exchange Online Management module is installed

Import-Module ExchangeOnlineManagement; Get-Module ExchangeOnlineManagement

image

Connecting to Exchange Online

To connect to Exchange Online, Run the following cmdlet along with the new parameter –EnableErrorReporting which gives the ability to record all the cmdlets that you have run along with errors generated as well.

Connect-ExchangeOnline -EnableErrorReporting -LogDirectoryPath e:\ExchOnlineLogs.txt -LogLevel All

image

image

After connecting, I am going to try and run two commands the Old Cmdlets and New Cmdlet and see the difference between them:

  1. Get-CASMailbox -ResultSize 10
  2. Get-EXOCasMailbox -ResultSize 10

image

The new Cmdlet has much more details, although it says that it runs faster but it took few seconds more than the old one to run (Probably first time).

image

After you run those two Cmdlets, There will be two files generated in the log directory which we have pointed the parameter to save files to.

The CSV files have details about the two cmdlets and the HTTP Method they are utilizing in order to connect along the Request and response latency.

imageimage

This new version seems to be extremely useful esp in environments where such deep details are needed for troubleshooting issues.

Stay tuned for more

Reference:

https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/exchange-online-powershell-v2/exchange-online-powershell-v2?view=exchange-ps

Deploy Azure Linux and Windows servers in 10 mins via cli

This is a step by step guide about deploying Linux or Windows servers on Azure via CLI.

Why Cli?

Some people prefer using Linux rather than PowerShell and it seems sometimes easier and faster to learn esp if you’re not GUI type of person.

Installation Options

If you’re working on Windows and would like to use CLI, you’ll have two options to install CLI

Option 1

Run Azure CLI installation directly from your Powershell (PowerShell needs to run from a privileged account)

Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList ‘/I AzureCLI.msi /quiet’

As soon as you run this command, it’ll take about 5 mins or less depending on the connection you have.

clip_image001

Option 2

Download the MSI file directly from MS’s link and install it on your Computer.

https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?view=azure-cli-latest

Connect to Azure CLI from PowerShell

Run PowerShell or CMD and type the following command to connect

Az Login then hit enter

As soon as you type this, a web page will be launched asking you for your Azure Account credentials so open the session for your Cli window.

The moment you verified your account, PowerShell will list your azure plans that you have / had before.

clip_image002

If you’re going to use Linux (Ubuntu, Debian) flavor then you’d have to following the following instructions

Manual install instructions

If you don’t want to run a script as superuser or the all-in-one script fails, follow these steps to install the Azure CLI.

  1. Get packages needed for the install process:

    bash

    
    
    sudo apt-get update
    sudo apt-get install ca-certificates curl apt-transport-https lsb-release gnupg
  2. Download and install the Microsoft signing key:

    bash

    
    
    curl -sL https://packages.microsoft.com/keys/microsoft.asc |
        gpg --dearmor |
        sudo tee /etc/apt/trusted.gpg.d/microsoft.asc.gpg > /dev/null
  3. Add the Azure CLI software repository:

    bash

    
    
    AZ_REPO=$(lsb_release -cs)
    echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" |
        sudo tee /etc/apt/sources.list.d/azure-cli.list
  4. Update repository information and install the

    azure-cli

    package:

    bash

    
    
    sudo apt-get update
    sudo apt-get install azure-cli

Run the Azure CLI with the

az

command. To sign in, use the az login command.

  1. Run the

    login

    command.

    Azure CLI

    Try It

    
    
    az login

    If the CLI can open your default browser, it will do so and load an Azure sign-in page.

    Otherwise, open a browser page at https://aka.ms/devicelogin and enter the authorization code displayed in your terminal.

  2. Sign in with your account credentials in the browser.

To learn more about different authentication methods, see Sign in with Azure CLI.

Deploying Linux (CentOS):

Creating a Resource Group for Azure Container Instances (ACI)

We will start first by creating a Resource Group for our Machine, calling it a AzureLinuxServersGroup to easily identify that this group contains our Linux Servers

az group create –name AzureLinuxServersGroup –location westeurope

clip_image001[4]

Next we will be creating a container to contain the Linux OS on the resource group which we have just created

First, How we know which Image to use and if that will be proper for our deployment?

To answer that, we will use the following command which will view the available latest edition Linux OS with different flavors.

I would like to use CentOS since its identical to RedHat and used by majority of Enterprises.

To list the Images, Enter the following command

az vm image list –output table

clip_image002[4]

Notice there are many columns, The one which we are going to use in terminal command line is the UrnAlias. It’s important to remember this.

az vm create \

–resource-group AzureLinuxServersGroup \

–name AzureCentOSWP \

–image CentOS \

–admin-username Moh10lyUser \

–generate-ssh-keys

clip_image003

Since we are using Bash, It’s a case sensitive and it complained about user having capital letters. So we’ll go ahead and use small letters

clip_image004

After running the command with small letters, it’s telling us where we can find the keys in order for us to reach and get them to use later to login to this newly created machine.

SSH key files ‘/home/moh10ly/.ssh/id_rsa’ and ‘/home/moh10ly/.ssh/id_rsa.pub’ have been generated under ~/.ssh to allow SSH access to the VM. If using machines without permanent storage, back up your keys to a safe location.

The deployment of the machine takes about 3 mins, and it’ll be created with the default minimum resources. Let’s view

clip_image005

Our machine is ready to be accessed now

clip_image006

In order for you to get the SSH Keys, you’ll have to have a bit of knowledge

I am going to go the location mentioned previously after creating a machine and copy the keys from the bash screen into a file. Save the file and Import it into SSH client which I will be using (Bitvise in my case).

From the bash screen goto cd /

Cd /home/user/.ssh/

Cat id_rsa hit enter and copy the key and save it into notepad.

Cat id_rsa.pub and copy/save into a notepad as the public key.

clip_image007

After loading both keys, I was able to successfully login to the Server

clip_image008

clip_image009

clip_image010

Get a list of Azure VMS

az vm image list

clip_image011

Let’s List and deploy a WordPress on CentOS

To view the list of available CentOS images, we’ll use the following cli command

az vm image list -f CentOS –all

The image needs to be grabbed from dockerhub URL

cognosys:wordpress-with-centos-77-free:wordpress-with-centos-77-free:1.2019.1008

az container create –resource-group mohazbackupgroup –name mohcontainer –os-type Linux –image cognosys:wordpress-with-centos-77-free:wordpress-with-centos-77-free:1.2019.1008 –dns-name-label azmohlinux –ports 22

Create Windows Server core with IIS

az container create –resource-group mohazbackupgroup –name mohcontainer –os-type windows –image mcr.microsoft.com/windoervercore/centos –dns-name-label azmohlinux –ports 22ws/servercore/iis:nanoserver –dns-name-label azmohiis –ports 80

clip_image012

Here we go I got a machine ready (took about 5 mins)

clip_image013

azmohiis.westeurope.azurecontainer.io

To delete the container, you can write the following

az container delete –resource-group mohazbackupgroup –name mohcontainer

clip_image014

clip_image015

Stay tuned for more articles about Azure.

Error After Migrating ADFS from 2012R2 to 2016

The Story:

You might have got a request to upgrade from ADFS 2012 R2 to Windows ADFS 2016.

This process can be complicated especially if you’ll have to migrate the Database as well and it would be more of an issue when the Database is WID (Windows Internal Database) since there’s no much documentation about troubleshooting issues involving WID on ADFS.

I have got a request from a client whom have done a migration with another consultant and obviously it was not done right.

Symptoms

On Windows 2016 ADFS when trying to update the ADFS SSL certificate I get the following error:

Set-AdfsSslCertificate -ThumbPrint A7etc : PS0159 : The Operation is not supported at the current Farm Behavior Level ‘1’. Raise the farm to at least version ‘2’ before retrying.

At line:1 char:1

clip_image001

Trying to update the database from 1 to 2,3 will also fail with the following error:

Invoke-AdfsFarmBehaviorLevelRaise

image

Error:

Database upgrade cannot be performed on AdfsServer.domain.com. Error: A database for the target behavior level already exists.

Troubleshooting:

If you’re installing ADFS on WID (Windows Internal Database) you should run the following to get the database name/Connect String

On ADFS Server

Open Windows PowerShell

  1. Enter the following:
    $adfs = gwmi -Namespace root/ADFS -Class SecurityTokenService

    and hit Enter

  2. Enter the following:
    $adfs.ConfigurationDatabaseConnectionString

    and hit enter.

  3. You should see the connect string information.

image

Go to Service Console and stop ADFS Service or from Powershell type Net stop adfssrv

Run SQL Server 2017 Database Engine Tuning Advisor as an administrator

clip_image001[4]

Use the Server name as this

\\.\pipe\MICROSOFT##WID\tsql\query

As for Authentication, Use the Windows Authentication with the user you’re logged into if you know that’s a privileged user and can authenticate, If not try with a user which you’ve done the upgrade of ADFS with.

image

After authenticating, You will be able to see AdfsConfiguration , AdfsConfigurationV3 and AdfsArtifactStore. What we need to see is that AdfsConfigurationV3 has data in it and is not totally empty.

clip_image001[6]

After checking and comparing the size between V1 and V3, It appeared that V3 database is empty. So what next?

Solution

Deleting the AdfsConfigurationV3 was the first thought that hit my mind however, before deleting anything I always take a snapshot of the VM since backing up the WID is more painful and takes more time than simply backing up the VM (Checkpoint, Snapshot).

So the steps to fix this issue is

  • Taking a VM Snapshot/Checkpoint/Backup.
  • Download Microsoft SQL Server Management Studio from this link https://go.microsoft.com/fwlink/?linkid=864329
  • Install Microsoft SQL Server Management Studio on ADFS Server
  • Run MS SQL Server Management Studio as Administrator
  • In the Server Name type :

\\.\pipe\MICROSOFT##WID\tsql\query

Leave the Authentication as it is and logon.

image

  • From the SQL Object Explorer right click and Delete the AdfsConfigurationV3 and leave AdfsConfiguration Database only.

image

  • After deleting the Database, Start ADFS Service to make sure that it can load the old database without an issue.
  • Then run the cmdlet Invoke-AdfsFarmBehaviorLevelRaise and Accept by typing Y and Enter.

image

This might take about 5 minutes to finish.

image

When this process is done, You should see the following message indicating the success of the Database Upgrade.

image

To double check, We will run the cmdlet Get-AdfsFarmInformation

image

Updating Certificate

After this success, I am going to run the cmdlet below to replace the current certificate with the new one

Set-AdfsSslCertificate -Thumbprint 9b19426e17180c0b9c5d4atye53dda3bce9dbff

And here we go. It works perfectly fine

image

References:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-sql

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/design/federation-server-farm-using-sql-server

kms Server Deployment step by step Guide

So What is KMS ?

KMS stands for the abbreviation (Key Management Service) in which enterprises and big companies manage their Software, End user and Servers licenses keys through a single server (Called KMS) which automates the whole process of activation and eliminates the need for an individual or admin interfering to activate them.

Prerequisites for KMS Host:

In order to use KMS, You will need to install Server version of Microsoft Windows. This server can be installed on a Virtual machine or physical one. But still there are requirements to activate other machines.

  • Server needs to be joined to Domain to activate other machines/products.
  • VLSC (Volume License Service Center) Host Key (Can only be acquired through the VLSC portal.
  • If you’re going to activate any Office products (Office 2016/ Office 2019) then you’ll need to download the Office Volume License Pack for those products from the links attached.
  • Run the License Pack you downloaded and enter the Office Key to activate it.

After deploying Windows 2016/2019 Server you can install the role from Server manager or from PowerShell

KMS Installation

Launch powershell in Admin mode and run the following CMDLET

Install-WindowsFeature -Name VolumeActivation

image

image

Continue to the next window and add the required Features

image

The next window will let give you some information about the automation of the license activation for MS products and how KMS works.

image

There are two options of how activating licenses, One is through using a service or the other through joining server/computer to Active Directory KMS will auto activate products if their relevant KMS licenses are entered in the KMS Host server.

image

Install your Windows 2016/2019 KMS Host Server key to create AD Object for KMS

image

Choose your activation Method in order to activate the KMS server

image

If activation continues successfully you’ll be able to see KMS telling you that continuing will create an AD object . Click Yes to continue

image

We’ll wait until this finishes

image

When this works, The next window will give you a warning that Clicking Next will delete the current activation Object which is the AD object that has been previously created. Click Close since we want to keep that.

image

KMS Host Activation

To view the activation of your KMS Host, You can open CMD on the KMS Server and type

slmg.vbs –dlv

As you can see below, it’ll show summary information about the license you entered and other related info.

image

To make sure your installation has went successfully, you can launch ADSI Editor and see if the AD object has been created or not.

From CMD or Powershell type adsiedit.msc

Navigate to Configuration>Services> Microsoft SPP> You should see the Activation Objects there.

image

Activating Office 2016 / 2019

As we mentioned previously to activate office 2016 or Office 2019 you will need to download the Office License pack from the links attached previously.

– Office 2016 License Package link https://www.microsoft.com/download/details.aspx?id=49164

– Office 2019 License Package Link https://www.microsoft.com/en-us/downloads/details.aspx?id=57342

NOTE:

You should not launch Volume License Manager when activating Office products or when trying to enter a KMS License key for Office products, Instead when executing the Office Package it will launch it for you and all you have to do is Enter the Office license key and restart Microsoft Windows Client to get Office activated.

image

Verifying KMS is Working:

To check if KMS is working on the end user’s side we need to get our hands on one of those clients, restart the user’s PC and then launch one of Office apps and see if it’s activated or not. The condition for the End user is that they need to be domain joined to acquire a license from KMS server.

It gets activated right after a restart!

image

Reference

https://docs.microsoft.com/en-us/deployoffice/vlactivation/configure-a-kms-host-computer-for-office

https://docs.microsoft.com/en-us/deployoffice/vlactivation/activate-office-by-using-active-directory

Use Group Based Licensing to Active Office 365 Users

The Story

I got a request to place users into Security Groups for management purposes, The client have already users active but many of those users have left the work place and still have E3 or E1 Licenses which they should not have since this is pricey licenses and backing up users details is the easiest and most cost effective way of handling this.

So, To start (Prerequisites):

The Group based licensing management is a new feature, Was introduced in 2019 and not many people know that it is there however, This feature doesn’t come for free as you know (Since it’s Microsoft) and you must have a license for it or at least have users with E3 licensing model. So the requirements are:

  • – Azure AD Premium P1 or Higher
  • – Office 365 E3 or Higher.
  • – EMS or Higher.

How does it work?

In order for you to get this to work  you need to make sure you have planned from where you want to manage those groups and their licenses, Online? Or On-Premises?

IF Online

If you’re going to do this online, then you need to create a group for each Licensing Model which represents the intended License and its users e.g. Office365-E1 is going to be created as a security group and dedicated to E1 License users.

Office365-E3 will also be created the same way and users of License type E3 will be added to it.

If On-Premises

If you’re going to manage those groups on-premises, Then you must have ADConnect (Azure AD Sync) tool to sync those groups after creating them.

In my case I have created those groups in the following manner:

image

After creating those groups, You will need to sync them to Office 365 using ADConnect. To force this to sync immediately fire up Powershell on Azure Connect Server and type

Start-ADSyncSyncCycle -PolicyType delta

image

image

What If I have users already assigned with License?

If you have users already assigned licenses and want to manage them using Group Based licensing then you’re going to have to get a list of all your users with their Licenses information into a CSV file and Import those users to the groups you created base on the license they have.

I created a PowerShell that would match user’s names and based on the license mentioned in the CSV file would add them to the relevant group but first you need to export Users from Office 365.

Export Users and their license from Office 365

First of all we’ll connect to Office 365 MSOL Service using Online Powershell

image

Get-MsolUser -All |Where {$_.IsLicensed -eq $true } |Select DisplayName,UsageLocation,@{n=”Licenses Type”;e={$_.Licenses.AccountSKUid}},SignInName,UserPrincipalName,@{n=”ProxyAddresses”;e={$_.ProxyAddresses}}| Export-csv -Path C:ExportlicenseUsage.csv -notype

image

So this is how my CSV look right after I exported the users, We need to do some tuning on this CSV file to clean it and get it ready for our PowerShell.

image

There are total of 6 columns in this folder, If for whatever reason you wanted to use the ProxyAddress to distinguish users feel free to keep them in the script but in my case I didn’t need them so I deleted the entire column.

So I will keep the following (Remove Spacing between License Type)

  • DisplayName
  • UsageLocation
  • LicenseType
  • SignInName
  • UserPrincipalName

The Value of the License Type is usually formatted like this “TenantName: License” and in order to make this column useful I am going to remove the Tenant name from all the cells.

Find and Replace can easily remove and clean these values for you.

image

After cleaning the column, this is how it looks

image

This should be useful for us now along with the PowerShell to add the users to their relevant groups.

On Active Directory from an elevated PowerShell

Run PowerShell ISE  from a privileged account and copy + paste this script in ISE,

$ImportedUsers = Import-csv “C:\Users\AD\Desktop\ExportlicenseUsage.csv”

Foreach ($ImportedUser in $ImportedUsers){
$License = $ImportedUser.LicensesType
$E3 = “E3-Office365”
$E1 = “E1-Office365”
$EMS = “EMS-Office365”
$Sam = $ImportedUser.SamAccountName
$ImportedUPN = $ImportedUser.UserPrincipalName

$AllUsers = Get-ADUser -Filter * -Properties *
Foreach ($User in $AllUsers)
{
$UPN = $User.UserPrincipalName

if($user.UserPrincipalName -eq $ImportedUPN -and $License -match “EMS”)
{
Add-ADGroupMember -Identity $EMS -Members $Sam
Write-Host $($UPN) “User has EMS License and has been added to the Group EMS” -ForegroundColor DarkGreen -BackgroundColor White
}
ElseIf ($user.UserPrincipalName -eq $ImportedUPN -and $License -Contains “STANDARDPACK”)
{
Add-ADGroupMember -Identity $E1 -Members $Sam
Write-Host $($UPN) “User has E1 License and has been added to the Group E1” -ForegroundColor black -BackgroundColor green
}
ElseIf ($user.UserPrincipalName -eq $ImportedUPN -and $License -Contains “ENTERPRISEPACK”)
{
Add-ADGroupMember -Identity $E3 -Members $Sam
Write-Host $($UPN) “User has E3 License and has been added to the Group E3” -ForegroundColor Blue -BackgroundColor White
}
}
}

image

Enabling Group Based License from Azure Portal

After this script finishes, I can open Azure Portal

From Azure Active Directory > Licenses > All Products

image   image    image

I will choose the license which I want to assign to a group of which I have created on my on-premises AD

image

Click on the License (Office 365 E1)  and choose Assign from top menu

image

Make sure you select assignment options and customize the license according to the products you want your group members to use then click on Users and Groups and select the relevant Group which you’ve created (In my case it’s E1-Office365)

image

Here, The group has been assigned

image

Click assign and you should be done

image

We will do the same for E3 Users

image

image

NOTE

From now on, Removing any user from this group will revoke their license and any service connected to it, You must be very careful when removing users from this group.

Microsoft has done great job covering this thoroughly and in a great detail including Scripts to be able to do many things like grabbing users who have an inherited license from a group or manually assigned. I am writing down the references if you’re more curious into these.

References:

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-assign

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-ps-examples

How to Sync Cloud User to On-premises AD ?

The Story:

I have got this client who constantly keeps on making the mistake of create user from Cloud and provision them with a license in an Exchange Hybrid environment.

Although this is not difficult to fix but it’s not the recommended approach when creating a new user especially in a Hybrid environment since Exchange on-premises won’t recognize this user and most likely will consider any incoming emails from it as spoof or spam.

How to Create a Cloud user from Exchange On-premises?

From Exchange on-premises ECP Admin panel you have the option to directly create user on-cloud which will also create a user object on on-premises AD.

image

Second option – Using Powershell

It’s not that much different than the Web UI option but it’s just for people who prefer using PowerShell than GUI

Enable-RemoteMailbox –Identity User –RemoteRoutingAddress user@yourTenant.mail.onmicrosoft.com

The reason to follow those two methods is due to the need of Exchange on-premises being aware of each of those users so mail flow between Exchange on-premises and Online would not get affected and route this users mail to the wrong place or flag it as spammed or spoof …etc.

The Real Question now is: How to Sync Cloud User to On-premises AD ?

If by mistake we created a user on Cloud (Office 365) and we forgot to create an AD User for this account, that user might already have started using his account on Office 365 (Sharepoint, Exchange, Teams) etc.

There also might be the intention of moving users from Cloud to On-premises Exchange in case the company wanted to decrease their spending on cloud users and in this case when Migrating a cloud user to on-premises you will get the following errors:

image

test3@domain.com

Status: Failed

test3@domain.com Skipped item details

User status

Data migrated:

Migration rate:

Last successful sync date:

Error: MigrationPermanentException: Cannot find a recipient that has mailbox GUID ‎’03c9764e-8b8e-4f33-94d1-ef098c4de656‎’. –> Cannot find a recipient that has mailbox GUID ‎’03c9764e-8b8e-4f33-94d1-ef098c4de656‎’.

So how do we overcome this situation since syncing a user might require you to delete the cloud user and recreate it on AD?

Solution:

To sync the user from the Cloud to on-premises you will need to follow these steps :

1- Create an on-premises Mailbox where the following attributes would be matching the cloud user

  • UserPrincipalname
  • ProxyAddresses
  • SamAccountName
  • Alias

2- The Location of the OU where the On-premises user is going to be created must be provisioned by ADConnect (Azure AD Connect)

You can look which of these OU are provisioned by Starting AD Connect Sync Manager

image

By verifying the user you created in the AD is in the right OU, You can now start AD Sync from PowerShell to speed up the process.

image

Below, You can see the user has been successfully synchronized to the cloud without any issue.

image

Now we’ll see it from the portal to confirm the user is synced with AD

image

Depending on the Source anchor being used in ADConnect there might be a GUID conflict or not, You will get an error similar to when trying to migrate the user in the beginning however you can solve this by replacing the cloud user’s GUID (ImmutableID) with the on-premises user which will force the user to merge with the On-prem user.

Let’s confirm in our case if the user on-cloud has a matching GUID with the one on-premises.

From CMD or Powershell you can use the following command to get the user’s ImmutableID (ObjectGUID) .

ldifde -f c:\Test.txt -d “cn=Test3,DC=Domain,DC=com”

image

Checking the notepad we just exported you can see the Immutable ID on AD for the User test3 is IkTni9mw7Ee4YefeGpz7IA==

image

To be able to see the user on Office 365, We need to logon to MSOL through Exchange Online powershell

Connect to Exchange Online’s powershell using your Online ECP.

image

Once you click on Configure this should download an executable file that will launch PowerShell Online which allows you to use the Modern Authentication (MFA) to use PowerShell safely.

image

Connect-Msoluser will connect you to Office 365 and you’ll be able to get the user’s properties and see if the Immutable ID is matching to the user’s GUID.

Once you’re connect you can use the following cmdlet to get the user’s properties.

Get-MsolUser -UserPrincipalName test3@domain.com |fl DisplayName,ImmutableID

image

You can see they are matching each other, In case there’s a conflict then you can simply set the online user’s Immutable ID to the on-premises user and that should solve the problem.

Ref:

https://support.microsoft.com/en-us/help/2956029/migrationpermanentexception-cannot-find-a-recipient-that-has-mailbox-g

https://docs.microsoft.com/en-us/exchange/hybrid-deployment/create-cloud-based-archive

Export Office 365 users from specific domain and change their passwords

First of all you will need to connect to your tenant with your global admin account using the following script

Import-Module MSOnline

$O365Cred = Get-Credential

$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUrihttps://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection

Import-PSSession $O365Session

Connect-MsolService –Credential $O365Cred

After connecting you will need to type the following command line which will export all users in a specific domain that’s added to your portal if you have more than one domain added there.

Get-MsolUser -DomainName Domain.com | Select UserPrincipalName | Export-Csv C:\users.csv –NoTypeInformation

clip_image001

Change passwords for those users by using the following command and pressing enter you’ll be giving a line to enter your new password that you wanna set for all users in the exported file.

$PASS = Read-Host

clip_image002

Run this command to change the passwords

Import-Csv C:\Users.csv | % {Set-MsolUserPassword -userPrincipalName $_.UserPrincipalName -NewPassword $PASS -ForceChangePassword $True}

clip_image003

That’s it. Now users inside the exported csv file have the new password which you have just set.

Note that users will be prompted to reset their passwords upon login, if you don’t want this to happen you can remove the -ForceChangePassword $True parameter.

del.icio.us Tags: Office365,Office 365,Exchange Online,Azure

Copy Immutable ID and Proxy Addresses from Azure to Active Directory

Matching Users after migrating to new Active Directory Forest

Installing ADConnect in a new forest for the same users which have been migrated to a new Active Directory forest

In order to do so you will have to launch Azure powershell in admin mode and connect to MSOL service as in the following snapshot

$cred = get-credential
After connecting then type/copy the following 
Get-MsolUser -ReturnDeletedUsers -All | Out-GridView

clip_image001[5]

Once you type enter a GUI will come up showing you all the deleted users list, you should delete any old non-usable account that has similar attributes to the ones that you’re about to Sync from the AD to O365. 

clip_image002[4]

Once you’re sure about what do you want to delete you can go ahead with the following Command to delete the users

Note:
You must be sure that when you run this command, you will no longer be able to restore any deleted item or object later on.

Get-MsolUser -ReturnDeletedUsers -All | Remove-MsolUser -RemoveFromRecycleBin -Force –Verbose

clip_image003[4]

Now you should run the following Script on the same open power shell in order to start the copying process. 

Import-Module Msonline
Import-Module ActiveDirectory
$cred = Get-Credential
Connect-MsolService -Credential $cred
$onlineusers = Get-MsolUser -All
$adusers = Get-ADUser -Filter *

Press enter and when you want you get prompted to select an option choose 1 and enter

clip_image004[4]

Note:If you would like to receive the powershell script please don’t hesitate to contact me. 

After the copy is finished you can match for yourself the list of ImmutableID along with the GUID 
Ldifde -f dump.txt

Dump.txt

clip_image005[4]
clip_image006[4]

AZURE ACTIVE DIRECTORY SYNC EVENT ID 906 FAILED WHILE PURGING RUN HISTORY INVALID NAMESPACE

Symptoms: 

You may notice that when you try to run the Sync command DirectorySyncClientCmd it doesn’t do anything and just closes right away.

If you open your Event viewer you may notice that you are getting the following event

image

Failed while Purging Run History

Invalid namespace
at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode) at System.Management.ManagementScope.InitializeGuts(Object o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize() at System.Management.ManagementObjectSearcher.Get() at Microsoft.Azure.ActiveDirectory.Synchronization.DirectorySyncClientCmd.Program.PurgeRunHistory(TimeSpan purgeInterval) at Microsoft.Azure.ActiveDirectory.Synchronization.Framework.ActionExecutor.Execute(Action action, String description) at Microsoft.Azure.ActiveDirectory.Synchronization.DirectorySyncClientCmd.Program.Main(String[] args)

Cause:

This happens when the WMI object had unregistered itself which might be caused by another tool installed or uninstalled at the time when the problem started to occur.

Resolution:

To resolve the issue, you ‘ll have to run few command lines… each are explained below

mofcomp “D:\Program Files\Microsoft Azure AD Sync\Bin\mmswmi.mof”

As it shows in the command screenshot below the ‘mofcomp’ parses the MMS (FIM) wmi file and goes through the process of adding the classes  to the WMI repository.

image

regsvr32 /s “D:\Program Files\Microsoft Azure AD Sync\Bin\mmswmi.dll”

Registers the WMI mmswmi.dll file to the server.

image

net stop winmgmt /y

image

net start winmgmt
net start “IP Helper”
net start “User Access Logging Service”
net start “Microsoft Azure AD Sync”

image

D:\Program Files\Microsoft Azure AD Sync\Bin\DirectorySyncClientCmd.exe”

clip_image001
clip_image002
clip_image003
clip_image004
image

References:

– https://social.technet.microsoft.com/Forums/en-US/cafd290d-d1a8-4d15-b4db-d79460216438/azure-ad-sync-error?forum=WindowsAzureAD

– http://blogs.technet.com/b/latam/archive/2015/06/01/erros-1603-ao-instalar-o-aadsync-microsoft-azure-active-directory-sync-services.aspx

Add multiple endpoints or port range to an Azure Virtual Machine

If you ever needed to add multiple ports or range of ports endpoints to a particular Virtual machine on Azure. you might have a difficulty doing this since it’s not allowed by design and that will require time to do this manually for range of ports. that’s where this article comes handy.

To achieve this first you will need to connect to your Azure subscription on Azure powershell. Azure PowerShell.

Run Azure powershell as an administrator and type the following cmdlet to get your subscription info

Get-AzurePublishSettingsFile

clip_image001

This will open a page and ask you to sign in to your Azure user account and download a file called Visual Studio Premium with MSDN-DATE-credentials.publishsettings

clip_image002

In the powershell you will have to navigate to where the file is located. And import the settings that have just been downloaded in that file

Import-azurepublishSettingsFile `.\Visual Studio FileLocation`

clip_image003

You can check for your account and Subscription, using Get-azureaccount script

clip_image004

Now I have setup a ubuntu Machine on Azure that hosts Openfire Chat server which requires 10000-10005 port range for the media service. On Azure Web interface the port range option is not yet supported. The only available option is through powershell which will open the required port range for us.

To do so I’ll use the following cmdlet highlighting the required information to enter

To create endpoints for ports 10000-10005:

$vm = Get-AzureVM -ServiceName moh10ly -Name ubunut-mohammed ; 10000..10005 | ForEach { $VM | Add-AzureEndpoint -Name TestEndpoint$_ -Protocol TCP -LocalPort $_ -PublicPort $_} ; $vm | Update-AzureVM

To Acquire your service name, you can simply login to Azure portal and check out All Items and see the cloud service name .. Just like the below screenshot

clip_image005

To Check your VMname simply navigate to Virtual machines tab and on the right side you can see the name.. I have copied it as well in the command.

clip_image006

Once you edited the cmdlet with your information you can enter it in the Powershell and enter

It should return something like this.

clip_image007

Once finished you can check Azure end point portal for the new ports configuration

clip_image008

Here we go .. Ports are created in Azure

clip_image009

To remove the endpoints for ports 10000-10005:

$vm = Get-AzureVM -ServiceName moh10ly -Name ubunut-mohammed ; 10000..10005 | ForEach { $VM | Remove-AzureEndpoint -Name TestEndpoint$_} ; $vm | Update-AzureVM