WIth this command you can see witch user that have SysAdmins access.
SELECT name,type_desc,is_disabled FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name
WIth this command you can see witch user that have SysAdmins access.
SELECT name,type_desc,is_disabled FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name
To show all MSSQL databases except the normal system databases.
select * from sys.databases WHERE name NOT IN ('master', 'tempdb', 'model', 'msdb');
If you have enabled that a user get lock out in Active Directory, if the user type the password wrong X times.
Then you might have experienced, that yours admin account get locked out multiple times, just after you have change the password for the admin account.
It could be that you have left a session on a server in you Active Directory logged on, and that session now trying to authenticated it self, by using you old password.
You can run this script, to check all servers in Active Directory, to see where there are user session on it.
function Get-LoggedOnUsers ($server) { if($server -eq $null){ $server = "localhost" } $users = @() # Query using quser, 2>$null to hide "No users exists...", then skip to the next server $quser = quser /server:$server 2>$null if(!($quser)){ Continue } #Remove column headers $quser = $quser[1..$($quser.Count)] foreach($user in $quser){ $usersObj = [PSCustomObject]@{Server=$null;Username=$null;SessionName=$null;SessionId=$Null;SessionState=$null;LogonTime=$null;IdleTime=$null} $quserData = $user -split "\s+" #We have to splice the array if the session is disconnected (as the SESSIONNAME column quserData[2] is empty) if(($user | select-string "Disc") -ne $null){ #User is disconnected $quserData = ($quserData[0..1],"null",$quserData[2..($quserData.Length -1)]) -split "\s+" } # Server $usersObj.Server = $server # Username $usersObj.Username = $quserData[1] # SessionName $usersObj.SessionName = $quserData[2] # SessionID $usersObj.SessionID = $quserData[3] # SessionState $usersObj.SessionState = $quserData[4] # IdleTime $quserData[5] = $quserData[5] -replace "\+",":" -replace "\.","0:0" -replace "Disc","0:0" if($quserData[5] -like "*:*"){ $usersObj.IdleTime = [timespan]"$($quserData[5])" }elseif($quserData[5] -eq "." -or $quserData[5] -eq "none"){ $usersObj.idleTime = [timespan]"0:0" }else{ $usersObj.IdleTime = [timespan]"0:$($quserData[5])" } # LogonTime $usersObj.LogonTime = (Get-Date "$($quserData[6]) $($quserData[7]) $($quserData[8] )") $users += $usersObj } return $users } $strCategory = "computer" $strOperatingSystem = "Windows*Server*" $objDomain = New-Object System.DirectoryServices.DirectoryEntry $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objSearcher.SearchRoot = $objDomain $objSearcher.Filter = ("OperatingSystem=$strOperatingSystem") $colProplist = "name" foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} $colResults = $objSearcher.FindAll() foreach ($objResult in $colResults) { If ($Err -ne $null) { Remove-Variable Err } $objComputer = $objResult.Properties; $ServerName = $objComputer.name $isalive = Test-Connection -BufferSize 32 -Count 1 -ComputerName $servername -Quiet if($isalive -eq $True) { $wmi = Get-WmiObject -class "Win32_Process" -namespace "root\cimv2" -computername $ServerName -EV Err -EA SilentlyContinue if ($Err) { } Else { Get-LoggedOnUsers $ServerName | ft -autosize } } }
You can change this last command:
Get-LoggedOnUsers $ServerName | ft -autosize
to
Get-LoggedOnUsers $ServerName | ? { $_.Username -eq ‘kda’ } | ft -autosize
to only see where KDA is loggedon
When you try to delete a mailbox, you may get this error:
This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, public folder mailboxes or arbitration mailboxes. To get a list of all mailboxes in this database, run the command Get-Mailbox -Database Database ID. To get a list of all mailbox plans in this database, run the command Get-MailboxPlan. To get a list of archive mailboxes in this database, run the command Get-Mailbox -Database Database ID -Archive. To get a list of all public folder mailboxes in this database, run the command Get-Mailbox -Database Database ID -PublicFolder. To get a list of all arbitration mailboxes in this database, run the command Get-Mailbox -Database Database ID -Arbitration. To disable a non-arbitration mailbox so that you can delete the mailbox database, run the command Disable-Mailbox Mailbox ID. To disable an archive mailbox so you can delete the mailbox database, run the command Disable-Mailbox Mailbox ID -Archive. To disable a public folder mailbox so that you can delete the mailbox database, run the command Disable-Mailbox Mailbox ID -PublicFolder. Arbitration mailboxes should be moved to another server; to do this, run the command New-MoveRequest Parameters. If this is the last server in the organization, run the command Disable-Mailbox Mailbox ID -Arbitration -DisableLastArbitrationMailboxAllowed to disable the arbitration mailbox. Mailbox plans should be moved to another server; to do this, run the command Set-MailboxPlan MailboxPlan ID -Database Database ID. + CategoryInfo : InvalidOperation: (Database ID:DatabaseIdParameter) [Remove-MailboxDatabase], AssociatedUserMailboxExistException + FullyQualifiedErrorId : [Server=Server,RequestId=RequestId,TimeStamp=TimeStamp] [FailureCategory=Cmdlet-AssociatedUserMailboxExistException] XXXXXXXX,Microsoft.Exchange.Management.SystemConfigurationTasks.RemoveMailboxDatabase + PSComputerName : Computer Name
This is because the mailbox database still contains data, that need to be moved, before you can deleted it.
If you run Exchange 2013, run these commands to check witch data, that are still located in the database.
Get-Mailbox -Database "Database" Get-Mailbox -Database "Database" -Archive Get-Mailbox -Database "Database" -Arbitration Get-Mailbox -Database "Database" -PublicFolder
In Exchange 2016, a new mailbox type is introduce call Auditlog. So here you also need to run this command
Get-Mailbox -Database "Database" -AuditLog
I have a customer, where we have taken over the support from an old supplier, so we don’t know much about their background.
The first thing we do, was to update the Exchange Server.
But after have move all mailboxes, public folders, system mailbox.
I still got this error:
This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, or arbitration mailboxes. To ge t a list of all mailboxes in this database, run the command Get-Mailbox -Database <Database ID>. To get a list of all m ailbox plans in this database, run the command Get-MailboxPlan. To get a list of archive mailboxes in this database, ru n the command Get-Mailbox -Database <Database ID> -Archive. To get a list of all arbitration mailboxes in this database , run the command Get-Mailbox -Database <Database ID> -Arbitration. To disable a non-arbitration mailbox so that you ca n delete the mailbox database, run the command Disable-Mailbox <Mailbox ID>. To disable an archive mailbox so you can d elete the mailbox database, run the command Disable-Mailbox <Mailbox ID> -Archive. Arbitration mailboxes should be move d to another server; to do this, run the command New-MoveRequest <parameters>. If this is the last server in the organi zation, run the command Disable-Mailbox <Mailbox ID> -Arbitration -DisableLastArbitrationMailboxAllowed to disable the arbitration mailbox. Mailbox plans should be moved to another server; to do this, run the command Set-MailboxPlan <Mail boxPlan ID> -Database <Database ID>.
Mailbox Plan is only used on the cloud.
I have look every places, unto i run this command:
dsquery * domainroot -attr * -limit 0 > result.txt
i then open the result.txt in notepad, and found some reference to the old database
msExchDisabledArchiveDatabaseLink: CN=Exch2013MB_Archive,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Fibia,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=XXXX,DC=local
After delete this reference, i could delete the database.
To get a list of the databases files, and the current disk size in MB, and the Free Space in MB in each fil, you can use this commands
USE [DATABASE_NAME] SELECT DB_NAME() AS DbName, name AS FileName, size/128.0 AS CurrentSizeMB, size/128.0 - CAST(FILEPROPERTY(name, 'SpaceUsed') AS INT)/128.0 AS FreeSpaceMB FROM sys.database_files;
If you need a overview of all yours database this TSQL can be used
CREATE TABLE #FileSize
(dbName NVARCHAR(128),
FileName NVARCHAR(128),
type_desc NVARCHAR(128),
CurrentSizeMB DECIMAL(10,2),
FreeSpaceMB DECIMAL(10,2)
);
INSERT INTO #FileSize(dbName, FileName, type_desc, CurrentSizeMB, FreeSpaceMB)
exec sp_msforeachdb
'USE [?];
SELECT DB_NAME() AS DbName,
name AS FileName,
type_desc,
size/128.0 AS CurrentSizeMB,
size/128.0 - CAST(FILEPROPERTY(name, ''SpaceUsed'') AS INT)/128.0 AS FreeSpaceMB
FROM sys.database_files
WHERE type IN (0,1);';
SELECT *
FROM #FileSize
WHERE dbName NOT IN ('distribution', 'master', 'model', 'msdb');
DROP TABLE #FileSize;
This is how to get an CSV file, including user_SamAccountName;User_FullName;group1;group2;group3, etc
It posible to remove the comment before break, and then break the export after 5 user, to see that it function well.
It will first write it output at the ending of the script, so terminate it, will result in an empty file.
$user_count = 0 $output = "" $OFS = "`r`n" $users = Get-ADUser -Filter * -SearchBase "DC=dalbjerg,DC=local" | SELECT Name,samaccountname foreach($user in $users) { #echo $user.SamAccountName $username = $user.SamAccountName $output += $username + ";" + $user.name + ";" $groups = Get-ADPrincipalGroupMembership $user.Samaccountname | select name foreach($group in $groups) { $output += $group.name + ";" } $output += $OFS $output += $OFS $user_count += 1 if($user_count -eq 5) { #break } } Write-Output $output | out-file C:\temp\export.csv
I need to search for entry in logfiles between 3/8-2017 and 6/8-2017. So i make this powershell script to prevent search all IIS logfiles.
This script will copy all log files from the orginal IIS log path to a temp log directory, including the parent folder.
$destination = "c:\temp\log\" $files = get-childitem "C:\inetpub\logs\LogFiles\" -Recurse | ? {$_.LastWriteTime -ge "08/02/2017" -and $_.LastWriteTime -le "08/06/2017"} Foreach($file in $files) { #Test to see if the file already exists in the destination. If not => Move/Copy/Action you want :D $directory = Split-Path (Split-Path $file.fullname -Parent) -Leaf new-item $destination"\"$directory -type directory Copy-Item -Path $file.fullname -Destination $destination"\"$directory }
To show the queue in sophus, from CLI type:
chroot /var/storage/chroot-smtp /bin/exim -bp
To delete a specific mail type
chroot /var/storage/chroot-smtp /bin/exim -Mrm {mailid}
example:
chroot /var/storage/chroot-smtp /bin/exim -Mrm 1daHZv-000EaR-0A
To see how many mails, there are in queue, you can type:
chroot /var/storage/chroot-smtp /bin/exim -bpc
If you need to give auser access to users calendar, based on if there are member of an group, this is the way.
Start Exchange Management Shell
$users = Get-ADGroupMember [groupname] | select -ExpandProperty name foreach ($user in $users) { $Mailbox = Get-Mailbox $user #The Calendar, is name "Kalender" in danish add-MailboxFolderPermission -identity “$($Mailbox.Name):\kalender” -AccessRights Editor -User [username] set-MailboxFolderPermission -identity “$($Mailbox.Name):\kalender” -AccessRights Editor -User [username] #English calendar add-MailboxFolderPermission -identity “$($Mailbox.Name):\calendar” -AccessRights Editor -User [username] set-MailboxFolderPermission -identity “$($Mailbox.Name):\calendar” -AccessRights Editor -User [username] }