Tag Archives: exchange

Found groups that a 365 contacts is member of

If you need to found out whitch groups (mailling groups) a contact is member of in Microsoft 365, then you case use these powershell commands:

$getsessions = Get-PSSession | Select-Object -Property State, Name
$isconnected = (@($getsessions) -like '@{State=Opened; Name=ExchangeOnlineInternalSession*').Count -gt 0
If ($isconnected -ne "True") {
Connect-ExchangeOnline
}

$dn = (Get-MailContact "[email protected]").DistinguishedName
Get-Recipient -Filter "Members -eq '$dn'"

Replace [email protected] with yours mail address.

Installation of New Exchange server

If you ever have installed a new Exchange server in an Active Directory orgainisation that allready have an Exchange server (That’s not so often anymore), you may have discovered that users get Certificate warning in Outlook, unto you have changed the URL’s to match the certificates.

But I found this script on Github: https://gist.github.com/kevinblumenfeld/31b03bf439b1f94f460eb754ef74120e

It copy the settings of all IIS url’s to the new Exchange server, when it found it in Active Directory.
So run this script before the start of the installation, and you will not receive the certificate warnings after the installation.

Intune Exchange Connector version is not supported

Microsoft have public this article: https://support.microsoft.com/da-dk/help/4464186/microsoft-intune-exchange-connector-version-not-supported, that tell you to just download a new version from Microsoft Intune Admin portal.

But this warning messages could also happen if you allready have a connector installed on another server, even if microsoft says that the new connector will just replace the old one.
So if you get this warning, just after you have downloaded the software, and you have an old connector, delete the old one first.
Remember to check notice of what User Notification and Unmanaged device access where set to before deleting the old one

Test SMTP TLS with OpenSSL with Auth

On a linux box type these two commands

echo -ne '[email protected]' | base64
echo -ne 'password' | base64

The command will return with the username and password in base64 format.
Example:

root@Linux-homeserver:~# echo -ne '[email protected]' | base64
dXNlcm5hbWVAZG9tYWluLnByZWZpeA==
root@Linux-homeserver:~# echo -ne 'password' | base64
cGFzc3dvcmQ=

So now you need to telnet with OpenSSL to the mailserver:

openssl s_client -debug -starttls smtp -crlf -connect mailserver.kennethdalbjerg.dk:465

After you have connection, you need to present yourself
Example:

ehlo host.kennethdalbjerg.dk

Some mailserver, do check if the ehlo is you corrert PTR record, for the IP address you are coming from, but most do not.

The mail server will return with:
250 mailserver.kennethdalbjerg.dk Hello dell1 [10.10.10.10]

You will now try to authenticated you self, if you don’t need to AUTH, please go to last code example in this blog.

AUTH LOGIN

And the mailserver will return with:
VXNlcm5hbWU6

Here you type you username in base64 format

dXNlcm5hbWVAZG9tYWluLnByZWZpeA==

And the mailserver will return with:
UGFzc3dvcmQ6

Please now type you password in base64 format

cGFzc3dvcmQ=

The server should now return with:
235 2.7.0 Authentication successful

After this you type normal email request to send an email
Example: (You should not type the line starting with a >, it are what the mailserver return to you.

mail from: [email protected]
> 250 2.1.0 Sender OK
rcpt to: [email protected]
> 250 2.1.5 Recipient OK
data
> 354 Start mail input; end with <CRLF>.<CRLF>
test
.
> 250 2.6.0 <604863cb-3dcc-4cee-9c1a-77fb6d951d43@mailserver.kennethdalbjerg.dk> [InternalId=9753870729240, Hostname=mailserver.kennethdalbjerg.dk] 1203 bytes in 1.581, 0,743 KB/sec Queued mail for delivery
quit
>221 2.0.0 Service closing transmission channel

Change autodiscover URL (EWS URL / OAB URL / ECP URL / Activesync URL) – Exchange 2016 / Exchange 2019

If you want to change Mapi, Autodiscover / EWS / OAB / OWA / ECP / Activesync Url, this is how it works

Example you have bought a certificate on you external name, and now you got certificate warnings in outlook.

set-MapiVirtualDirectory -id "SERVERNAME\mapi (Default Web Site)" -internalurl https://owa.domain.prefix/mapi -externalurl https://owa.domain.prefix/mapi

Set-WebServicesVirtualDirectory -Identity "SERVERNAME\EWS (Default Web Site)" -InternalUrl https://owa.domain.prefix/EWS/Exchange.asmx -externalurl https://owa.domain.prefix /EWS/Exchange.asmx -BasicAuthentication:$true

Set-AutoDiscoverVirtualDirectory -Identity "SERVERNAME\Autodiscover (Default Web Site)" -internalurl https://owa.domain.prefix/autodiscover/autodiscover.xml -externalurl https://owa.domain.prefix/autodiscover/autodiscover.xml 

set-OabVirtualDirectory -identity "SERVERNAME\OAB (Default Web Site)" -internalurl https://owa.domain.prefix/OAB -externalurl https://owa.domain.prefix/OAB 

set-EcpVirtualDirectory -identity "SERVERNAME\ecp (Default Web Site)" -internalurl https://owa.domain.prefix/ecp -externalurl https://owa.domain.prefix/ecp

set-OwaVirtualDirectory -identity "SERVERNAME\owa (Default Web Site)" -internalurl https://owa.domain.prefix/owa -externalurl https://owa.domain.prefix/owa 

set-ActiveSyncVirtualDirectory  -identity "SERVERNAME\Microsoft-Server-ActiveSync (Default Web Site)" -internalurl https://owa.domain.prefix/Microsoft-Server-ActiveSync -externalurl https://owa.domain.prefix/Microsoft-Server-ActiveSync

Set-ClientAccessServer -Identity "SERVERNAME" –AutoDiscoverServiceInternalUri https://owa.domain.prefix/autodiscover/autodiscover.xml  

iisreset

 Or if this is a single server installation you can do it like this: (Or if you want all servers to use the same URL

get-mapivirtualdirectory | set-MapiVirtualDirectory -internalurl https://owa.domain.prefix/mapi -externalurl https://owa.domain.prefix/mapi

get-WebServicesVirtualDirectory | Set-WebServicesVirtualDirectory -InternalUrl https://owa.domain.prefix/EWS/Exchange.asmx -externalurl https://owa.domain.prefix/EWS/Exchange.asmx -BasicAuthentication:$true 

get-AutoDiscoverVirtualDirectory | Set-AutoDiscoverVirtualDirectory -internalurl https://owa.domain.prefix/autodiscover/autodiscover.xml -externalurl https://owa.domain.prefix/autodiscover/autodiscover.xml 

get-OabVirtualDirectory | set-OabVirtualDirectory -internalurl https://owa.domain.prefix/OAB -externalurl https://owa.domain.prefix/OAB

get-EcpVirtualDirectory | set-EcpVirtualDirectory -internalurl https://owa.domain.prefix/ecp -externalurl https://owa.domain.prefix/ecp 

get-OwaVirtualDirectory | set-OwaVirtualDirectory -internalurl https://owa.domain.prefix/owa -externalurl https://owa.domain.prefix/owa

get-ActiveSyncVirtualDirectory | set-ActiveSyncVirtualDirectory  -internalurl https://owa.domain.prefix/Microsoft-Server-ActiveSync -externalurl https://owa.domain.prefix/Microsoft-Server-ActiveSync

get-ClientAccessServer | Set-ClientAccessServer  –AutoDiscoverServiceInternalUri https://owa.domain.prefix/autodiscover/autodiscover.xml

iisreset

Add Exchange management Shell to “normal powershell

Here are a script, that you can include in yours script, to add Exchange management shell, to “normal” powershell scripts.

$StopWatch = [System.Diagnostics.StopWatch]::StartNew()
Function Test-Command ($Command)
{
    Try
    {
        Get-command $command -ErrorAction Stop
        Return $True
    }
    Catch [System.SystemException]
    {
        Return $False
    }
}

IF (Test-Command "Get-Mailbox") {Write-Host "Exchange cmdlets already present"}
Else {

    $CallEMS = ". '$env:ExchangeInstallPath\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto -ClientApplication:ManagementShell "

    Invoke-Expression $CallEMS
$stopwatch.Stop()
$msg = "`n`nThe script took $([math]::round($($StopWatch.Elapsed.TotalSeconds),2)) seconds to execute..."
Write-Host $msg
$msg = $null
$StopWatch = $null
}

Exchange and TLS problems

Today i have a problem that an exchange will not send mails though TLS, no matter what i do.

I find out that, somehow this exchange servers where creating new send connector, with forcehelo = True.

Witch mean that the Exchange server is using the OLD HELO instead of the EHLO, when talking to other SMTP servers. Setting this to false help. Now the Exchange server send with TLS.

So FORCEHELO=$TRUE breaks TLS.

To see if this is the problem, you can type:

get-sendconnector | select id, forcehelo

To set it to false, for the send connector “Default_OUT” you can run this powershell command:

get-sendconnector -id Default_OUT | set-sendconnector -forcehelo $false

Also you might need to set the TLS certificate to the right certificate. Remember that the certificate need to have the hostname in the certificate. Se more on this link:

https://practical365.com/exchange-server/configuring-the-tls-certificate-name-for-exchange-server-receive-connectors/

Exchange: Get a list of all email address

For en liste over alle mail adresse

Get-recipient -resultsize unlimited | select name -expand emailaddresses | select name,smtpaddress

For en liste over alle mail adresse på et given domæne

Get-Recipient | Where{$_.EmailAddresses -match "it-grp.dk"} | select name -expand emailaddresses | select name,smtpaddress | where {$_ -match "kennethdalbjerg.dk"}

Search exchange message tracking log for a particular subject

If you want to search Exchange log for a particular subject, or just a bite of it, you can search witch this commands.

This will also export it to a nice CSV files.

Get-MessageTrackingLog -resultsize unlimited | Where-object {$_.MessageSubject -like "*Kenneth Dalbjerg"} | select-object timestamp,Sender,@{l="Recipients";e={$_.Recipients -join " "}},messageSubject | export-csv c:\KennethDalbjerg.csv