Tag Archives: powershell

Problems in connection to a Webservice from Windows Server 2016 / 2019

Today, I have this issue, that i could not connect to a webservices, that are hosted by the Danish Tax Service, the URL where: https://emcstest.skat.dk
I got this warning:

Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

When running these commands

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$WebResponse = Invoke-WebRequest "https://emcstest.skat.dk"

No matter what I did. But final I tested the webpage against SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=emcstest.skat.dk
Found these ciphers

I then run these commands:

Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384
Enable-TlsCipherSuite TLS_AES_128_GCM_SHA256
Enable-TlsCipherSuite TLS_CHACHA20_POLY1305_SHA256
Enable-TlsCipherSuite TLS_AES_256_GCM_SHA384

And finally I where able to access the webpage though powershell.

Computer won’t join Azure AD

When going to Settings -> Accounts -> Access work or school, og push the “connect” buttom. I could just see that the popup, asking for my mail address, just popup, but then disapear again very quick.

Starting a powershell with administrative rights, and type in the command

Get-AppXPackage | foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

And let it run, it toke 1-3 minutes to complete, but when it completed i could push the buttom, and the popup show just fine.

Again this is a danish screenshot.


Get Certificate from remote computers

If you need to get all certificates, from a list of remote computers, you can use this script:

$Servers = "kennethdalbjerg-dc01",
           "kennethdalbjerg-dc02",
           "kennethdalbjerg-exch01",
           "kennethdalbjerg-fs01"
 
  $Results = @()
  $Results = Invoke-Command -cn $Servers {
          $Certs = @{} | Select Certificate,Expired
          $Cert = Get-ChildItem Cert:\LocalMachine\My
          If($Cert){
              $Certs.Certificate = $Cert.subject
              $Certs.Expired = $Cert.NotAfter
          }
          Else{
              $Certs.Certificate = " - "
              $Certs.Expired = " - "
          }
          $Certs
  } | Select-Object @{n='ServerName';e={$_.pscomputername}},Certificate,Expired
 
  #Display results in console
  $Results | Sort-Object Expired -Descending
 
  #Save results to CSV file
  $Results | Sort-Object Expired -Descending | Export-Csv -Path C:\users\$env:username\desktop\cert_results.csv -NoTypeInformation -Force
 
  #Open results in new window
  $Results | Sort-Object Expired -Descending | Out-GridView -Title "Final results"

Found groups that a 365 contacts is member of

If you need to found out whitch groups (mailling groups) a contact is member of in Microsoft 365, then you case use these powershell commands:

$getsessions = Get-PSSession | Select-Object -Property State, Name
$isconnected = (@($getsessions) -like '@{State=Opened; Name=ExchangeOnlineInternalSession*').Count -gt 0
If ($isconnected -ne "True") {
Connect-ExchangeOnline
}

$dn = (Get-MailContact "[email protected]").DistinguishedName
Get-Recipient -Filter "Members -eq '$dn'"

Replace [email protected] with yours mail address.

Passler PRTG Windows update Probe says missing updates, but none in windows update

You can run this commands to see what updates, that PRTG windows update probes is warning about.

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher();$searcher.Search("Type='Software'").Updates | Sort-Object -Property Dates -Descending | ft -autosize IsInstalled, MsrcSeverity,title

Compare two folders with Powershell

This script checks first that folders exist, then that filename are the same, and then that file Hash is the same

#$folder1 = "C:\Temp\test"
#$folder2 = "C:\Temp\test2"


if ((Test-Path -Path $folder1) -and (Test-Path -Path $folder2)) {
    echo "The folders exist"
    echo "Folder1: $folder1"
    echo "Folder2: $folder2"
    $sourceFiles = Get-ChildItem $folder1 -Recurse
    $destFiles = Get-ChildItem $folder2 -Recurse
    if (Compare-Object $sourceFiles.Name $destFiles.Name) {
        echo "The folders is not the same"
    } else {
        echo "Check of the folders show us that there have the same content - OK"
        $SourceDocs = Get-ChildItem –Path $folder1 -Recurse | foreach  {Get-FileHash –Path $_.FullName}
        $DestDocs = Get-ChildItem –Path $folder2 -Recurse | foreach  {Get-FileHash –Path $_.FullName}
        if ($SourceDocs.Hash -ne $destDocs.Hash) {
            echo "There are difference in the the files"
            echo "folder1 Hash: $SourceDocs.hash"
            echo "folder2 Hash: $DestDocs.hash"
        } else  {
            echo "The folders are the same!"
        }
    }
} else {
    Echo "One of the folders or both, dosn't exist"
}

Add Exchange management Shell to “normal powershell

Here are a script, that you can include in yours script, to add Exchange management shell, to “normal” powershell scripts.

$StopWatch = [System.Diagnostics.StopWatch]::StartNew()
Function Test-Command ($Command)
{
    Try
    {
        Get-command $command -ErrorAction Stop
        Return $True
    }
    Catch [System.SystemException]
    {
        Return $False
    }
}

IF (Test-Command "Get-Mailbox") {Write-Host "Exchange cmdlets already present"}
Else {

    $CallEMS = ". '$env:ExchangeInstallPath\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto -ClientApplication:ManagementShell "

    Invoke-Expression $CallEMS
$stopwatch.Stop()
$msg = "`n`nThe script took $([math]::round($($StopWatch.Elapsed.TotalSeconds),2)) seconds to execute..."
Write-Host $msg
$msg = $null
$StopWatch = $null
}

Exchange and TLS problems

Today i have a problem that an exchange will not send mails though TLS, no matter what i do.

I find out that, somehow this exchange servers where creating new send connector, with forcehelo = True.

Witch mean that the Exchange server is using the OLD HELO instead of the EHLO, when talking to other SMTP servers. Setting this to false help. Now the Exchange server send with TLS.

So FORCEHELO=$TRUE breaks TLS.

To see if this is the problem, you can type:

get-sendconnector | select id, forcehelo

To set it to false, for the send connector “Default_OUT” you can run this powershell command:

get-sendconnector -id Default_OUT | set-sendconnector -forcehelo $false

Also you might need to set the TLS certificate to the right certificate. Remember that the certificate need to have the hostname in the certificate. Se more on this link:

https://practical365.com/exchange-server/configuring-the-tls-certificate-name-for-exchange-server-receive-connectors/

Remote Desktop seesions – See sessions on all servers in Active directory

If you have enabled that a user get lock out in Active Directory, if the user type the password wrong X times.
Then you might have experienced, that yours admin account get locked out multiple times, just after you have change the password for the admin account.

It could be that you have left a session on a server in you Active Directory logged on, and that session now trying to authenticated it self, by using you old password.

You can run this script, to check all servers in Active Directory, to see where there are user session on it.

function Get-LoggedOnUsers ($server) {
    if($server -eq $null){
        $server = "localhost"
    }
 
    $users = @()
    # Query using quser, 2>$null to hide "No users exists...", then skip to the next server
    $quser = quser /server:$server 2>$null
    if(!($quser)){
        Continue
    }
 
    #Remove column headers
    $quser = $quser[1..$($quser.Count)]
    foreach($user in $quser){
        $usersObj = [PSCustomObject]@{Server=$null;Username=$null;SessionName=$null;SessionId=$Null;SessionState=$null;LogonTime=$null;IdleTime=$null}
        $quserData = $user -split "\s+"
 
        #We have to splice the array if the session is disconnected (as the SESSIONNAME column quserData[2] is empty)
        if(($user | select-string "Disc") -ne $null){
            #User is disconnected
            $quserData = ($quserData[0..1],"null",$quserData[2..($quserData.Length -1)]) -split "\s+"
        }
 
        # Server
        $usersObj.Server = $server
        # Username
        $usersObj.Username = $quserData[1]
        # SessionName
        $usersObj.SessionName = $quserData[2]
        # SessionID
        $usersObj.SessionID = $quserData[3]
        # SessionState
        $usersObj.SessionState = $quserData[4]
        # IdleTime
        $quserData[5] = $quserData[5] -replace "\+",":" -replace "\.","0:0" -replace "Disc","0:0"
        if($quserData[5] -like "*:*"){
            $usersObj.IdleTime = [timespan]"$($quserData[5])"
        }elseif($quserData[5] -eq "." -or $quserData[5] -eq "none"){
            $usersObj.idleTime = [timespan]"0:0"
        }else{
            $usersObj.IdleTime = [timespan]"0:$($quserData[5])"
        }
        # LogonTime
        $usersObj.LogonTime = (Get-Date "$($quserData[6]) $($quserData[7]) $($quserData[8] )")
 
        $users += $usersObj
    }
    return $users
}

$strCategory = "computer" 
$strOperatingSystem = "Windows*Server*" 
 
$objDomain = New-Object System.DirectoryServices.DirectoryEntry 
 
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$objSearcher.SearchRoot = $objDomain 

$objSearcher.Filter = ("OperatingSystem=$strOperatingSystem") 
 
$colProplist = "name" 

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} 

$colResults = $objSearcher.FindAll() 

foreach ($objResult in $colResults) 
    { 
    If ($Err -ne $null) {
        Remove-Variable Err
    }
    $objComputer = $objResult.Properties;  
    $ServerName = $objComputer.name
    $isalive = Test-Connection -BufferSize 32 -Count 1 -ComputerName $servername -Quiet
    if($isalive -eq $True) {
        $wmi = Get-WmiObject -class "Win32_Process" -namespace "root\cimv2" -computername $ServerName -EV Err -EA SilentlyContinue
        if ($Err) {
         } Else {
            Get-LoggedOnUsers $ServerName | ft -autosize
        }

    }
}

 

 

You can change this last command:

Get-LoggedOnUsers $ServerName | ft -autosize

to

Get-LoggedOnUsers $ServerName | ? { $_.Username -eq ‘kda’ } | ft -autosize

to only see where KDA is loggedon

Error when trying to remove a Mailbox Database on Exchange Server

When you try to delete a mailbox, you may get this error:

This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, public folder mailboxes or
arbitration mailboxes. To get a list of all mailboxes in this database, run the command Get-Mailbox -Database
Database ID. To get a list of all mailbox plans in this database, run the command Get-MailboxPlan. To get a list of
archive mailboxes in this database, run the command Get-Mailbox -Database Database ID -Archive. To get a list of all
public folder mailboxes in this database, run the command Get-Mailbox -Database Database ID -PublicFolder. To get a
list of all arbitration mailboxes in this database, run the command Get-Mailbox -Database Database ID -Arbitration.
To disable a non-arbitration mailbox so that you can delete the mailbox database, run the command Disable-Mailbox
Mailbox ID. To disable an archive mailbox so you can delete the mailbox database, run the command Disable-Mailbox
Mailbox ID -Archive. To disable a public folder mailbox so that you can delete the mailbox database, run the command
Disable-Mailbox Mailbox ID -PublicFolder. Arbitration mailboxes should be moved to another server; to do this, run
the command New-MoveRequest Parameters. If this is the last server in the organization, run the command
Disable-Mailbox Mailbox ID -Arbitration -DisableLastArbitrationMailboxAllowed to disable the arbitration mailbox.
Mailbox plans should be moved to another server; to do this, run the command Set-MailboxPlan MailboxPlan ID
-Database Database ID.
    + CategoryInfo          : InvalidOperation: (Database ID:DatabaseIdParameter) [Remove-MailboxDatabase], AssociatedUserMailboxExistException
    + FullyQualifiedErrorId : [Server=Server,RequestId=RequestId,TimeStamp=TimeStamp] [FailureCategory=Cmdlet-AssociatedUserMailboxExistException] XXXXXXXX,Microsoft.Exchange.Management.SystemConfigurationTasks.RemoveMailboxDatabase
    + PSComputerName        : Computer Name

This is because the mailbox database still contains data, that need to be moved, before you can deleted it.
If you run Exchange 2013, run these commands to check witch data, that are still located in the database.

Get-Mailbox -Database "Database" 
Get-Mailbox -Database "Database" -Archive
Get-Mailbox -Database "Database" -Arbitration
Get-Mailbox -Database "Database" -PublicFolder

In Exchange 2016, a new mailbox type is introduce call Auditlog. So here you also need to run this command

Get-Mailbox -Database "Database" -AuditLog