Exchange 2013

Export Transport Rules from On-Premise Exchange 2010 or Later and Import it to Office 365

December 19, 2016 by Prabakar Ponnusamy 1 Comment

Today got a task to import all the transport rules in On-Premise Exchange servers to Office 365. Creating new transport rules in O365 with same condition will work but more than 50 transport rules are in On-Premise Exchange Server and will take long time to create as well as condition may not match properly. So planned to export the existing transport rules in On-Premise Exchange Server using PowerShell Commands and details are as follow:

PS Cmdlet to export the existing transport rules in On-Premise:

$onpremrule = Export-TransportRuleCollection

Set-Content -Path “C:\Rules.xml” -Value $onpremrule.FileData -Encoding Byte

Import will overwrite the existing transport rules in O365, please take a backup of O365 rules before importing On-premises rules to O365.

PS Cmdlet to import the exported transport rules in Office 365:

[Byte[]]$O365 = Get-Content -Path “C:\Rules.xml” -Encoding Byte -ReadCount 0

Import-TransportRuleCollection -FileData $O365

Please share your thoughts by clicking Leave a Comment and if you like the articles in this site, please subscribe to get Email notification when a new article has been published. Thank You.

PowerShell Commands to get users having Full Access and Send As Permission

September 11, 2016 by Prabakar Ponnusamy Leave a Comment

Today got a task to collect the users with Full Access and Send-As permission in my organization and didn’t expect that I can finish the task but PowerShell make it as simple.

You have to use the PowerShell command below to get all the users who have Full Mailbox Permission for the user mailboxes or shared mailboxes, etc. other than their own NT account.

Get-Mailbox –Resultsize “Unlimited” | Get-MailboxPermission | Where-Object {($_.AccessRights –like ‘FullAccess’) –and –not ($_.user –like ‘NT Authority\Self’)}

NB: If you have multiple domains and you have to collect the information of mailboxes in the entire domain then use the PowerShell commands below to verify the mailboxes in the entire Forest:

Set-ADServerSettings -ViewEntireForest $true

You may get more rows and columns in the result and you may not be able to view all those information. To check all the information, just append Export-CSV to export the result in a CSV file.

Get-Mailbox –Resultsize “Unlimited” | Get-MailboxPermission | Where-Object {($_.AccessRights –like ‘FullAccess’) –and –not ($_.user –like ‘NT Authority\Self’)} | Export-CSV <File path followed by file name.csv>

If you have to verify any particular user has Full Mailbox access to any other User mailbox or Shared mailbox, etc. then use the PowerShell command below:

Get-Mailbox –Resultsize ‘Unlimited’| Get-MailboxPermission | Where-Object {($_.Accessrights -like ‘FullAccess’) -and ($_.user -like ‘domain\SamAccount’)} | Export-CSV <File path followed by file name.csv>

You have to use the PowerShell commands below to get all the users who have Send-As permission for User Mailboxes or Shared Mailboxes, etc. other than their own NT Account.

Get-Mailbox –Resultsize “Unlimited” | Get-ADPermission | Where-Object {($_.Extendedrights -like ‘Send-As’) -and –not ($_.User -like “NT Authority\Self”)}

You may get more rows and columns in the result and you may not be able to view all those information. To check all the information, just append Export-CSV to export the output in a CSV file.

Get-Mailbox –Resultsize “Unlimited” | Get-ADPermission | Where-Object {($_.Extendedrights -like ‘Send-As’) -and –not ($_.User -like “NT Authority\Self”)} | Export-CSV <File path followed by file name.csv>

Get-Mailbox –Resultsize “Unlimited” | Get-ADPermission | Where-Object {($_.Extendedrights -like ‘Send-As’) -and ($_.User -like “Domain\SamAccount”)} | Export-CSV <File path followed by file name.csv>

Please share your thoughts by clicking Leave a Comment and if you like the articles in this site, please subscribe to get Email notification when a new article has published. Thank You.

Exchange Transaction logs not truncating for a database which was enabled with circular logging

September 10, 2016 by Arunkumar Selvanathan Leave a Comment

Issue:

Exchange transaction logs not truncating for a database which was enabled with circular logging.

Cause:

One of the database copy on the passive server was failed and suspended because of which the log files started to accumulate as those logs were still waiting for replication to the passive copy.

Lets see some information about Circular logging and steps taken to prevent the database from dismounting:

Circular logging is of two types JET circular logging and Continuous replication circular logging (CRCL). JET circular logging is performed by Information Store, and CRCL is performed by the Microsoft Exchange Replication Service.

If the mailbox database is not replicated, it will use JET circular logging. In this case, enabling or disabling JET circular logging will require a dismount and mount of the database.
If the mailbox database is replicated, it will use CRCL. In this case, enabling or disabling CRCL takes effect dynamically; there is no need to dismount and re-mount the database.

You enable and disable both features the same way; either by using the checkbox on the Maintenance tab of the database Properties dialog that says Enable circular logging, or by using the Set-MailboxDatabase cmdlet with the -CircularLoggingEnabled parameter

Here in our case CRCL type was enabled as the mailbox database is replicated.

We noticed that the disk space of the logs stored drive for the database DB1 on the mounted server EXserver1 and another healthy server EXServer2 decreased drastically. On checking further, we noticed that the transaction logs keep on accumulating and not truncating though circular logging is enabled.

When we checked the database copy status we have found that the database copy DB1 on the server EXserver3 was failed and suspended. This is the reason why the logs keep on accumulated .

When one of the database copy on the passive server is failed the Microsoft Exchange Replication Service which manages CRCL maintains the log continuity and won’t delete it if they are still needed for replication. The Microsoft Exchange Replication Service and the Microsoft Exchange Information Store service communicate by using remote procedure calls (RPCs) regarding which log files can be deleted.

Use the command Get-Mailboxdatabasecopystatus to check the database copy status

[PS] C:\Windows\system32> Get-Mailboxdatabasecopystatus DB1

Name Status CopyQueue Length ReplayQueue Length

—- —— ——— ———–

DB1\EXServer1 Mounted 0 0

DB1\EXServer2 Healthy 0 1

DB1\EXServer3 Failed and Suspended 2776986 0

Before reseeding the database we need to make sure the disk space of the drive where logs are stored should be reclaimed to prevent the database from dismounting.

In exchange Power Shell go to the folder where log files are located and run eseutil.exe /mk .\E00.chk to find the log files which were committed and currently in use.

Here the checkpoint value is 4DFA1F which means that log files lower than E08004DFA1F were committed and are no longer required by database. Select those log files and move it to another drive where enough space is available to gain some disk space.

Then update the failed database copy using the Power Shell command below and make sure it becomes healthy.

Update-MailboxDatabaseCopy “DB1\EXServer3” -DeleteExistingFiles:$true

Once the database become healthy we could see enough disk space on the log drive of the affected database DB1 in all the servers, because the mailbox replication service provides confirmation for deleting the replicated logs.

What we have learned from the scenario above is if any of the database copy is failed or failed and suspended the messaging administrator must act fast to make the copy healthy and also must check the disk space associated with the affected database log drive on the mounted server and other servers which holds the healthy copy of the database to prevent the database from getting dismounted.

If you enjoyed this post, I’d be very grateful if you’d help it spread by emailing it to a friend, or sharing it on Twitter or Facebook.

Please do comment for any queries

How to Block the Display Picture in Skype for business, Outlook, OWA in on premises and office 365

July 23, 2016 by Arunkumar Selvanathan Leave a Comment

The user photo in messaging clients such as Skype for Business, Outlook Web App and Outlook enhances the end-user experience. Looking at how the communication flows nowadays among end-users, we will realize that we see pictures all the time. You see them when you are checking your email in Outlook, receiving a new message, receiving an instant messaging and so forth. However, there may be organizations who have strict policies will be requesting the Messaging administrators to block this feature to prevent the users from uploading unusual pictures (Eg: Avatar Image). This article will help you with the steps to block the display pictures in Skype for business, Outlook and OWA.

We all are aware that when we try to change a picture in Skype for business client, we will be redirected to our OWA where we have options to upload the photos.

After uploading a picture, it is shown in the client and to all.

To disable this we have to modify the client policy using the PowerShell command below.

Set-CSClientPolicy –Identity Global –DisplayPhoto NoPhoto

The Same command is used in Skype for business online, however, one restriction is that only the global policy can be modified in SFB online.

Please refer steps below to connect to Skype for business online PowerShell.

How to Connect to Skype for Business Online

This first command will capture administrative credential for future connections.

$credential = get-credential

This command will import the Skype for Business module into your PowerShell session.

(The module can be downloaded from https://www.microsoft.com/en-us/download/details.aspx?id=39366 )

Import-Module SkypeOnlineConnector

This command will remotely connect to Skype for Business and then allow you to manage your settings.

$Session = New-CsOnlineSession -Credential $credential –OverrideAdminDomain “yourcompanydomainname.onmicrosoft.com”

This imports commands from your PowerShell session.

Import-PSSession $Session

After changing the client policy you could see that the Picture option is not shown under tools options and also in other places in Skype for business client.

However the Picture will be still shown in OWA and Outlook. To block this and to prevent the users from uploading the pictures, we need to remove the pictures which were already set by the users and have to disable this feature in the OWA mailbox policy.

First of all we have to fetch the users who have set the pictures using the command below.

Get-Mailbox -ResultSize Unlimited | Where {$_.HasPicture -eq $True}

After cross checking the users we have to remove the pictures which were already set by the users using the PowerShell command below. The reason why we are removing the pictures is that the OWA policy change will not reflect to the users who had set the picture already.

Get-Mailbox -ResultSize Unlimited | Where {$_.HasPicture -eq $True} | Remove-UserPhoto -Confirm:$false

After removing the pictures we have to disable the My Personal Information in Default Role Assignment Policy (EAC ->Permissions -> Users Roles)to restrict the users from uploading the picture under users My account option.

Then finally disable the picture option in OWA mailbox policy using the PowerShell command below.

Set-OwaMailboxPolicy -Identity “OWApolicyname” -SetPhotoEnabled $false -DisplayPhotosEnabled $false

After changing the Default role assignment policy and OWA mailbox policy the users will be restricted to upload pictures in OWA and users My account option.

The Exchange commands used here are applicable for office 365 as well. Please refer the link below for the steps to connect to exchange online PowerShell.

https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx

If you enjoyed this post, I’d be very grateful if you’d help it spread by emailing it to a friend, or sharing it on Twitter or Facebook.

Please do comment for any queries.

Thank you!