One of my customers is using Password Hash Synchronisation (PHS) as their Azure Active Directory authentication method for users synced from on-premises AD. Not having had much experience with PHS, I was a little surprised to learn recently that PHS users have cloud passwords that do not conform to the default AAD 90 day expiry.… Read More: PHS and Password Expiry »
Earlier this week, I had a need to produce a list of Guest users in an Azure AD tenant who had not yet redeemed invitations that had been sent to them. It took me a little while to figure out the Powershell query for this, so I thought I would share it here. The state… Read More: Search for Azure AD B2B Guests who have not redeemed… »
The other day I tried (and failed) to find an easy way to query which applications were assigned to a specific Azure AD Application Proxy Connector Group. Of course if you only have a few applications, you can simply grind through each application in the Azure Portal and view the assignment (see screenshot below). If,… Read More: Report Azure AD Application Proxy Connector Group assignments »
I’ll get to the problem with Powershell Execution Policy shortly, but first a bit of background… If your AAD/O365 admin accounts are configured for multi-factor authentication (which they should be, because it’s free), you will likely be familiar with the Exchange Online PowerShell Module, which is designed to work with MFA. Getting to the Module… Read More: Exchange Online PowerShell Module and Execution Policy »
Actually, this is more of a question than answer – although I have an answer of sorts, albeit far from elegant. I’ve been scheduling some batch onboarding mailbox migrations from a hybrid environment with Exchange 2010 to Exchange Online. The batch process is pretty straightforward, but I haven’t found an easy way to dump the… Read More: How to extract a list of mailboxes from an Exchange… »
Qasim Zaidi has an old but really good blog entry on enabling change notification for Active Directory site links. For a long time now I’ve encouraged my customers (those with decent bandwidth between sites) to enable change notifications on site links rather than wait the 15 minutes (minimum) for replication between sites. Qasim’s blog references a Powershell… Read More: Powershell snippet to enable change notification on all site links »
Like that hipster beard you grew last summer, all good things must eventually come to an end. You will likely be aware that the end of extended support for Windows Server 2003 finishes on July 14th 2015. If you don’t know whether you still have 2003 boxes lurking in the dark recesses of your AD… Read More: Find Windows 2003 Servers in your Active Directory Domain »
Unfortunately Active Directory doesn’t yet provide dynamic security groups in the way that, for example, Exchange provides dynamic distribution groups. Sometimes it is useful to maintain a group’s membership based on a specific attribute, or set of attributes. Here’s a quick Powershell example that shows how to maintain the membership based on the presence of… Read More: Attribute-Based Active Directory Group Membership »
The default location for newly provisioned user and computer objects are (respectively) the Users and Computers containers. Since Windows Server 2003 Active Directory the option has been available to redirect these to OUs that you specificy. Why would you want to do this? Well, the Users and Computers containers are just that – container objects… Read More: Redirecting Users and Computers Containers with Powershell »
There are well known methods for setting Access Control Entries (ACEs) on Active Directory objects using Powershell. One example is the following: http://blogs.msdn.com/b/adpowershell/archive/2009/10/13/add-object-specific-aces-using-active-directory-powershell.aspx The method relies on you knowing the schemaIDGUID of the schema object classes you are working with (e.g. User, Computer, Group). Unless you know your way around AD it’s not… Read More: Dump a list of all schemaIDGUIDs with Powershell »