Quest Support Product Release Notification – Enterprise Reporter 3.0

From Quest

“We are excited to announce a new version of Enterprise Reporter 3.0 is now available for download.
Look what’s new:

  • Check out the “What’s New with Enterprise Reporter 3.0” video
    • Support for Office 365 – Azure AD, Exchange Online, and OneDrive for Business
      • Including Azure Tenant, Subscription and Licensing information
    • Take action with Security Explorer Remediation Reports
    • Performance Enhancements with NTFS Collector
    • Enhanced Data Collections with new attributes
    • Configuration options to integrate with IT Security Search “

Using Windows PowerShell to “normalise” a text string

Long story, but I  needed a way to normalise a text string.  Say this:

$txt = "Correo electrónico del usuario"

and I found this:

[Text.Encoding]::ASCII.GetString([Text.Encoding]::GetEncoding(1251).GetBytes($txt))

and the result is:

Correo electronico del usuario

Awesome, job done!

Office 365 Groups and Primary SMTP Addresses

So here is an interesting one.

We know Office 365 groups are a hybrid Exchange Online / SharePoint Online thing.

When you create an Office 365 Group, it creates an MSOLGroup and a UnifiedGroup object, that you can access using Windows Powershell (Get-MsolGroup / Get-UnifiedGrou).

Any email addresses that are set as Primary on the unified group, replicate up to the MSOLGroup object.

Now, you can remove them from the unified group, but they will NEVER be removed the MSOLGroup object.  Try it ;-)

This means, if you need to do say a Tenant to Tenant migration, and the default msoldomain is a vanity domain, all office 365 groups will have the vanity domain as primary and you cannot remove it!

The only fix, is to delete the group! -or- raise a call with Microsoft and have your engineer engage with the Microsoft Online Domain Services Backend team (Azure AD) to remove them for you.

Enjoy

 

 

 

Quest Migration Manager for AD 8.14

Just received this:

We are excited to announce a new version of Migration Manager for AD 8.14 is now available for download.

Look what's new:
  • The highest priority matching rule with the UserPrincipalName target matching attribute will be automatically configured for each new migration pair. Such matching rule can be manually added to existing migration pairs and collections using Migration Manager for AD (Microsoft Office 365) console.
  • 8.14 can be installed on Microsoft Windows Server 2016.
  • Support for processing of Microsoft Windows Server 2016 using Resource Updating Manager.
  • Support for migration to Windows 2016 AD including: Migrating objects to Windows 2016 AD, Synchronizing objects with Windows 2016 AD in both directions, Synchronizing passwords with Windows 2016 AD, Migrating SID-History to Windows 2016 AD and Migrating computers to Windows 2016 AD.
Migration Manager for AD 8.12 is now in limited support. To determine the current support phase of your product, please refer to the Migration Manager for AD life cycle table.

Be sure to check out the Migration Manager for AD Product Support page to find solution articles, tips and tricks, tutorials, documentation, notifications, life cycle tables, training, and a product user forum.

Important Notice: Due to our recent divestiture from Dell Technologies, we are required to retire any Dell branded software from our Support Portal. This means that all software downloads and technical documentation for Migration Manager for AD prior to version 8.14 will be removed from the Support Portal after November 1, 2017. Please download any older versions now that you may need for your future use.

 

 

List Office 365 Administrators

So, I had a need to see who the other Global Admin are my Tenant.  Knocked this up to help.

The following assumes you already have a remote powershell session to Office 365!

$msoladmin = @()
$roles = Get-MsolRole
ForEach($role in $roles){
  $n = $role.Name
  Write-Host $n " " -NoNewLine -f Green
  [array]$tAdmin = Get-MsolRoleMember -RoleObjectId $role.ObjectId | Select *, @{Expression={$n};l="Role"}
  Write-Host $tAdmin.Count
  $msoladmin += $tAdmin
}
$msoladmin | sort Role,DisplayName | select DisplayName, Role

DirSync and Office 365

I wanted to share this for my own reference, but wanted to share the love.

Have been having a challenge with people thinking I am talking cr@p, which make me smile.  If I am wrong I will admit it.

When you setup DirSync, users from your onPrem AD are copied to the Office 365 Azure AD. Simple.

When you migrate (onboard) a mailbox to Office 365 the onPrem accounts change:

RecipientType RecipientTypeDetails RecipientType RecipientTypeDetails
UserMailbox UserMailbox -> MailUser RemoteUserMailbox
UserMailbox SharedMailbox -> MailUser RemoteSharedMailbox
UserMailbox RoomMailbox -> MailUser RemoteRoomMailbox

Now if you have a filter based on msExchRecipientTypeDetails you need to watch out, as expected the msExchRecipientTypeDetails changes:

Type Before After
User Mailbox 1 2147483648
Shared Mailbox 4 8589934592
Room Mailbox 16 17173869184
Equipment Mailbox 32 34359738368

This caused me some challenges as we had a filter that would only migrate disabled accounts with a value of 4 or 16 in msExchRecipientTypeDetails.

The net result was that after a Shared or Room mailbox was onboarded to o365 they would drop out of DirSync.  This is okay, as they stay in the Azure AD as a deleted user for 30 days.

You can recover a user from deleted users, they appear in Azure AD as “In Cloud” and any mailbox they had is accessible.

This is the fun bit. If the recovered user is added back in to dirsync, dirsync uses the Azure AD ImmutableId and compares that to an OnPrem Guid.  If a match they are become Dirsynced again.

You can see the ImmutableId when your run a get-msoluser.  Essentially it’s a fudge of the OnPrem AD ObjectGuid.  This post explains and here is a script to convert between the two.

Hope this helps someone, it helped me, get an understanding of what the hell was going on!

If this is complete cr@p let me know please!

OnPrem Lync/Skype and Office 365

Had an issue with mailboxes migrated to Office 365 while using OnPrem Lync/Skype.

Lync showed a constant “Enter Credentials” dialog:

LyncEnterCredentials

The KB appears to have fixed it: Office 2013 and Lync 2013 periodically prompt for credentials to SharePoint Online, OneDrive, and Lync Online

A simple registry key that you can rollout with a GPO.