EmailRSS

Tag Archives: Attributes

Display Username and Current Computer for Incoming Emails

Posted on by

A recent email stated: “My computer isn’t working!” I had several immediate thoughts. First, no one ever emails just to say hi. Second, what computer is this person using?[note]It’s not like we support several thousand machines…[/note] So I modified a script that David Lee provided me many years ago. It now queries AD for the username and current computer of any internal person when they email me. This information appears between the full name and subject of the email when using Office Outlook.

To get this information into Outlook, we have to do two things. First, we need to know the computer that a user is using. Second, we need to add a custom field to Outlook and query Active Directory.

Writing the Current Logged in Computer to an AD User Attribute

When an email arrives from an internal user, an Outlook macro looks at an AD user attribute to see the current computer name. I have written about this method a few times before, specifically where a logon script writes the current username to the ManagedBy (or Description) attribute of a computer account. In this case, we will write to an attribute on the user’s account instead of the computer’s account.

First, download this .vbs text file and remove the .txt extension. Open the SetextensionAttribute2.vbs file in notepad. On the second to last line, you will see that the Computername value is written to extensionAttribute2 of the current user. This is sometimes called Custom Attribute 2. If you already use this attribute, change this line and replace any extensionAttribute2 references in the macro that is attached in the next section.

You can test this script by running it manually on your computer. After running it, open Active Directory Administrative Center – find your user – click Extensions – click on Attribute Editor. Scroll down to extensionAttribute2. You should see your computer name listed.

Next, create/edit a GPO that is linked to your staff. Set this script to run as a logon script.

Finally, we need to allow staff to edit their extensionAttribute2 value. Right click on your staff OU in Active Directory Administrative Center and select Properties. Select Security – Advanced. Press Add.

  • For the Principal value, enter SELF
  • For the Type, leave it at Allow
  • For Applies to, change this to Descendant User objects

  • Scroll to the very bottom of the Permission Entry screen and press Clear all
  • Scroll back up and find Read Custom Attribute 2 and Write Custom Attribute 2. Place a check next to both boxes. Press Ok and apply the permissions. When staff logon to their computer again, their computer name should appear under extensionAttribute2.

Using an Outlook Macro to Import Additional AD Information

Grab this .txt file and copy the contents. In Microsoft Office Outlook, press ALT + F11. This should open the Microsoft Visual Basic for Applications window.  In the left side of the window, expand Project1 – expand Microsoft Outlook Object – double click on This Outlook Session. A new blank project window should open. Paste in the contents of the text file. Select File – Save. Your screen should now look like this picture:

Close the Microsoft Visual Basic for Applications window and then go to File – Options – Trust Center – Trust Center Settings. Select Macro Settings and select Notifications for all macros. Press ok and close Outlook Options.

Close Outlook and re-open it. You will receive a warning that you are loading the thisoutlooksession macro. Press enable macros.[note]You can also sign your macro with an internal code signing certificate for a bit more security.[/note]

In Outlook, select View – Add Columns. In the Show Columns window, change the Maximum number of lines in compact mode to 3. Still in the Show Columns window, change from Frequently-used fields to User-defined fields. Select Username and add it to the list on the right. Finally, move the Username column so that it is between the From column and Subject column. Press Ok.

New emails from internal addresses will now show a username value and a computer name value if the user is logged in.[note]If the user has logged out, this value is their last used computer.[/note] Office Outlook does need to be open when the email is received, or those values will not appear. If you have any questions, comments, or improvements – let me know!

A Year with Adaxes and a Major Update to 2018.1

Posted on by

About a year ago, I started using Adaxes. I have been a fan of this software for quite a while because it fills many of the holes in an Active Directory environment. Out of the box, Adaxes provides mobile management, user self-service, and a mighty AD management console. Softerra has now released their most comprehensive update for Adaxes yet. Now that I have had a bit of time to get used to it, I wanted to write up some of my personal experiences and review where we were, where we are now, and where we hope to be with Active Directory management.

Before Adaxes and Our Current State

One word could summarize our environment in the past. That word is messy. We had many inconsistent naming schemes for every object type. Attributes, like descriptions or Outlook details, varied depending on when the object was created. Most actions were driven through multiple people and many routine AD management tasks were done by hand.

Since that time, we have moved to a very streamlined (but still not perfect) management scheme. In our environment, AD is the source for many of our applications and user data. Almost everything ties back into it. Because of this, our goal is a single console and service for all AD management. In the past, we would do some routine management (like a weekly task list) in ADAC and have various scripts running as scheduled tasks. All of that is now managed by Adaxes because we could use many of the built-in tasks and import scripts that were previously written. Below is a truncated screenshot showing the scheduled tasks agenda view in Adaxes. Even though I receive status notifications from these Adaxes tasks, I love getting to see this 30,000-foot view of future automated actions.

At our current state, most object management and maintenance are automatically handled by the scheduled task features in Adaxes. This makes the behind-the-scenes stuff simple, but what about the front-end? To be honest, our users are probably not even aware that we are using Adaxes to extend Active Directory because it integrates so well. Features like self-service password reset magically show up on the login screen. Our HR and Finance staff go to their custom designed Adaxes web portal for their AD management tasks. This is a considerable improvement over the clunky custom Active Directory Users and Computers MMC as I can design workflows for our staff to use.

Adaxes 2018.1 made AD web administration and management so much better! In previous versions, web consoles were created with a separate utility. While not difficult to use, I spent a lot of time jumping back and forth between the on-server utility and the console while making modifications. Now, web consoles are modified in the same browser. The screenshot, above, shows me modifying the Administrator web console. Everything is on one page – neatly divided with headers – and searchable.

From the end user standpoint, the web consoles are cleaner and easier to navigate in. Below is a screenshot of the AD console that our department can use for mobile access. Four buttons cover the majority of AD actions required in the field. When I am in a classroom or office, I can push out some software or a printer in just a few clicks from my phone.

With the new web consoles in Adaxes 2018.1, most routine work can be pushed into the browser wherever the user is located. From IT’s perspective, management is more accessible due to the unified management tool, unified login, and unified creation. Regarding customization, the browser management platform is superior. Every bit of content can be changed or rearranged for specific roles or tasks.

For more complex work, I spend most of my time working in the new Adaxes Administration console. Below is a screenshot of the console in our environment. It still has the traditional Active Directory view when I expand the Active Directory Node, but I also get to view our maintenance tasks, approval requests, workflows, and reporting within the same window. One thing to note is that Adaxes licenses per active user that you want to manage. We have licenses for all of our users, and it was a little confusing when they didn’t show up under the Active Directory node.

If you have ever worked with System Center Configuration Manager, you probably found it impressive to see software, updates, operating systems, security settings, inventory, etc. in the same console. I get that same happy feeling when I see AD reports, logging, tasks, etc. in the Adaxes console. One new feature that I am enjoying, which I highlighted above, is the inclusion of Best Practices as reports.

Almost every report breaks out into an interactive console. Computers, Users, and Groups each have an Overview Dashboard. When I click on Groups, I get a 30,000′ view of my group structure. If I click on the (5) Created Recently button, I get a custom view that shows these groups and the related attributes.

I do wish that Adaxes would combine AD audit events into their single pane of glass approach. If an environment audits group creation/deletion and the Adaxes service is delegated permission to read those events, the console should merge that data into their reports. Because the reporting platform is so flexible, it would be possible to pull this data in through external scripts that you set up. As of right now, that data is just not native to a report.

Going Forward with Adaxes

Like I said at the beginning, I don’t feel that I am at a perfect environment yet, but Adaxes is helping me get there. Going forward, I would like to look at moving some of the scheduled tasks over to business rules. This would allow our HR/finance staff to drive staff changes in real-time instead of feeding them into a scheduled task. I would also like to get a bit more redundancy built into my setup. Adaxes 2018.1 does streamline this with their new shared hierarchy models.

Adaxes is excellent, but I would like to recommend some future features. First, tie in AD domain controller audit events into the Logging and Report nodes. These events have always been a pain to read, and their integration would allow us to have a clearer insight into our environment. Second, make the Active Directory node an accurate view of AD – this will keep administrators in the console instead of having to fall back to ADUC/ADAC at times. The 30,000′ views are fantastic – keep adding to them! For example, property patterns allow us to create consistent computer accounts once implemented. A report showing naming irregularities would provide insight into our previously misnamed machines. Custom commands can allow us to fix these issues fairly quickly. Finally, add additional right-click management tools (similar to the SCCM Right Click Tools) and allow administrators to modify/add their own. Being able to right click and remote into a computer would be one example. Another would be a right-click – rename feature that works on one computer or a group of computers. Linking these right-click options to reports would provide insight and action with one tool. As of right now, custom commands can be added here. I have been told that the next big update will make these additional options easier to implement!

So, what is my final take with Adaxes and the 2018.1 Update? It is an incredible design for modern AD management. I think it will keep getting better! Adaxes is one of the few companies that I would consider holding a maintenance agreement with and that is because they provide solid feature rich updates on a regular basis. If you have never tried it before, play around with their live demo environment here.

Matching Usernames to Pictures by Comparing Attributes

Posted on by

Welcome back to another edition of PowerShell Scripts I Hope You Never Need. I’m your host, a frustrated IT Admin. When our high school went to print student IDs this year, we found out that the photo company provided no exact link between the student and the photo. Instead, of using a Student ID, username, or even an email to name the photo – we got garbage.

They provided us a text file (with various formats throughout) that contained names and grade level. The pictures were given the default name that each camera generated, and this name was in their list as well.

To fix this, I started by opening Excel, importing the text file and creating a few headers. After formatting, aligning the data, and removing duplicates (yes – there were a ton of duplicate entries), I could start working with this mess in PowerShell. I planned to import the CSV and use the Get-ADUser cmdlet to compare each attribute. I found out, rather quickly, that the grade level value was inconsistent. It appears that one camera operator entered the student’s future grade level while another used their current grade level (or we had a lot of students held back).

This left me with only the firstname and lastname attributes to compare against. To prevent a lot of duplicate matches, I limited the searchbase for the Get-ADUser cmdlet to a single student OU. I also included the optional property Title because that is where we store the student’s current grade.

$PictureList = import-csv "C:\Pictures\PictureList.csv"
$SearchBase = "OU=SomeOU,OU=AnotherOU,DC=DOMAIN,DC=COM"
$Students = Get-ADUser -Filter * -SearchBase $SearchBase -Properties Title

With our two comparisons ready, we can start trying to match data. I created a folder named C:\Pictures and saved the cleaned PictureList.csv file there. I then put all of the student pictures in C:\Pictures\Combined (remember that these files are named by the camera). Finally, I created an UnMatched and a Matched folder under C:\Pictures. This structure allows us to plan for the potential outcome of each matching attempt. The possible results are:

  • The full name from the picture data has a single match to an AD user at that school.
  • The full name from the picture data does not have any matches at that school (i.e., the student has transferred).
  • The full name from the picture data matches multiple AD users at that school. This event is handled manually with a pause statement with the grade value as a way of deciding.
foreach ($Record in $PictureList) {
    write-host $Record

    $LastNameMatch = $Students | where Surname -eq $Record.Lastname
    $FirstNameMatch = $LastNameMatch | where GivenName -eq $Record.FirstName

    if ($FirstNameMatch -eq $Null) {
        write-host "Student Not Found: " $Record -ForegroundColor Yellow
        $PicturePath = "C:\Pictures\Combined\" + $Record.PictureName
        $UnMatchedPictureName = $Record.FirstName + " " + $Record.LastName + "_" + $Record.PictureName
        Move-Item -Path $PicturePath -Destination "C:\Pictures\UnMatched\$UnMatchedPictureName" -Force
    }

    #Pauses on Duplicate Students
    if (($FirstNameMatch).count -gt 1) {
        Write-Host "Duplicate Name: $Record"
        pause
    }

    else {
        $NewPictureName = $FirstNameMatch.SamAccountName + ".jpg"
        $PicturePath = "C:\Pictures\Combined\" + $Record.PictureName
        $MatchedProperties = @{"FirstName" = $FirstNameMatch.GivenName; "LastName" = $FirstNameMatch.Surname; "Grade" = $FirstNameMatch.Title; "IDNumber" = $FirstNameMatch.SamAccountName; "OldPictureName" = $Record.PictureName; "NewPictureName" = $NewPictureName}
        $StudentExport += New-Object PSCustomObject -Property $MatchedProperties
        $MatchedPictureName = $NewPictureName
        Move-Item -Path $PicturePath -Destination "C:\Pictures\Matched\$MatchedPictureName" -Force
        sleep -Seconds 1
    }  
}

After running the whole script, our Combined folder (the one that started with all of the pictures) should only contain pictures that matched multiple AD users (our duplicate scenario). The UnMatched folder should contain students with no matching AD account due to the student leaving the school system. Our Matched folder should contain the pictures of any student at that school. The picture file is also renamed to their Student username to make uploads easier. Finally, all of that matched data is saved to a PowerShell Object ($StudentExport). If you want, you can run $StudentExport | Export-CSV to generate a nice and clean CSV.

Below is the full script:

$PictureList = import-csv "C:\Pictures\PictureList.csv"
$SearchBase = "OU=SomeOU,OU=AnotherOU,DC=DOMAIN,DC=COM"
$Students = Get-ADUser -Filter * -SearchBase $SearchBase -Properties Title

Clear-Variable StudentExport
$StudentExport = @()
foreach ($Record in $PictureList) {
    write-host $Record

    $LastNameMatch = $Students | where Surname -eq $Record.Lastname
    $FirstNameMatch = $LastNameMatch | where GivenName -eq $Record.FirstName

    if ($FirstNameMatch -eq $Null) {
        write-host "Student Not Found: " $Record -ForegroundColor Yellow
        $PicturePath = "C:\Pictures\Combined\" + $Record.PictureName
        $UnMatchedPictureName = $Record.FirstName + " " + $Record.LastName + "_" + $Record.PictureName
        Move-Item -Path $PicturePath -Destination "C:\Pictures\UnMatched\$UnMatchedPictureName" -Force
    }

    #Pauses on Duplicate Students
    if (($FirstNameMatch).count -gt 1) {
        Write-Host "Duplicate Name: $Record"
        pause
    }

    else {
        $NewPictureName = $FirstNameMatch.SamAccountName + ".jpg"
        $PicturePath = "C:\Pictures\Combined\" + $Record.PictureName
        $MatchedProperties = @{"FirstName" = $FirstNameMatch.GivenName; "LastName" = $FirstNameMatch.Surname; "Grade" = $FirstNameMatch.Title; "IDNumber" = $FirstNameMatch.SamAccountName; "OldPictureName" = $Record.PictureName; "NewPictureName" = $NewPictureName}
        $StudentExport += New-Object PSCustomObject -Property $MatchedProperties
        $MatchedPictureName = $NewPictureName
        Move-Item -Path $PicturePath -Destination "C:\Pictures\Matched\$MatchedPictureName" -Force
        sleep -Seconds 1
    }  
}

Bonus (unrelated) note: As most of you know, I work in a K-12 school system in south Georgia. We are hiring a school technician and the position is open until 08/22/18. In the unlikely chance that you are interested, just send me an email or leave a comment. I will get you the job information and application.

Populating AD thumbnailPhotos from a Staff Directory

Posted on by

No matter where I work, I always load a headshot picture into my profile or email. I think it adds a personal touch to technology as people know who is helping them. After a short amount of time, people recognize me in person because of this. This would lead to conversations where someone would know my name but I would have no idea who they were. Eventually, they would say something about me fixing their problem and I would go, “oh – you’re the lady with that printer” or something like that.

In an effort to reduce that social awkwardness*, I needed a way to import user photos into Outlook. The thumbnailPhoto attribute is responsible for the user headshot that appears in Outlook or Skype for Business. It can even be synced to the local machine Windows account photo.  With that, I just needed a picture for each staff member that I could match to AD. Most organizations have a staff directory and someone has probably taken the time to match and upload a photo for each employee.

The following script is designed to take pictures from an online staff directory and import them into the matching Active Directory user’s thumbnail attribute. If you use Blackboard as your website host, you might not need to modify anything beyond the last page number (if your directory has multiple pages), the URL, and the searchbase value.  You made need to use the Network tab in Chrome’s developer tools to see where any javascript links end up.

If your staff directory is not ran off of Blackboard, you can still use this script. Using your browser developer tools, look at the structure of your directory and the picture. Ideally, the picture would have first and last name values attached to it. You would need to modify the value names in the script below.

This script does use another tool to convert pictures into an AD Friendly format. Download and extract the contents of the ADPhotos folder into C:\Users\Public\Staff\ . Your file/folder structure should look like this (extra files/folders are fine):

If you have any issues implementing this script, leave a comment or email me (include your staff directory website). I will try to point you in the right direction. As always, be sure to had a few pause statements and -whatif parameters to test the script first.

Continue reading →

Move Computers to OUs Automatically Based on Name – Redux

Posted on by

Way back in 2013, I put together a script to move computers to an OU based on a name prefix.  This worked really well for my former environment as we enforced a very strict naming convention. It did not work so well for other environments that did not use my naming convention. It didn’t handle multiple matching OUs very well. It also relied on the older Quest AD PowerShell cmdlets.

At the prompting of a few readers, I reworked this script to be more versatile and I removed the Quest AD cmdlets requirements. Change the OU location specified in line two to any OU that you want to target. For example, you can enter your New Computers / Unassigned Computers OU to automatically move computers to their appropriate locations. You can also use it to move computers from old sites to new sites after they have been renamed.

This script looks at each computer in the OU specified. It removes one character from the computer name and searches Active Directory for any other computer starting with that prefix. If no matches are found, it removes another character and searches again. You can see that searching in the orange text below.

If a single organizational unit match is found, it will move the computer to that OU. If multiple matching OUs are found, it will list the OUs. It will then cycle through each OU by asking if the computer should be moved there. In the picture above, you can see this process in the yellow, white, and green text.

The only two lines that can modify your environment are at line 30 and line 48. Both of these lines have the -whatif parameter added already. When you run the script with the -whatif parameters, you will be able to see where computers would end up being moved.

After you are comfortable with the end result, remove the -whatif parameters to make it so. If you want to set this script up to run automatically, remove lines 37-55. The script will then move any computer that matches a single OU but leave computers matching multiple OUs alone.

As always, please let me know if you have any suggestions or issues when running this script!

#The variable ($UnassignedComputersOU) should be in the distringuished name formart. EX: OU=Something,OU=SomethingELSE,DC=TEST,DC=local
[string]$UnassignedComputersOU = "OU=New Computers,OU=Sites,DC=TEST,DC=local"


Import-Module ActiveDirectory

$UnassignedComputers = Get-ADComputer -Filter * -SearchBase $UnassignedComputersOU | sort name

foreach ($UnassignedComputer in $UnassignedComputers){
    write-host ""
    $ComputerName = $UnassignedComputer.NAME

    #Filter out specific computer names here. 
    if ($ComputerName -notmatch "MININT"){
    $ComputerNameLength = $ComputerName.length
    
        Clear-Variable OUs -ErrorAction SilentlyContinue
        while ($OUs -eq $Null){
        $ComputerNameLength = $ComputerNameLength - 1 
        $Prefix = $ComputerName.substring(0,$ComputerNameLength)
        
        #Filter Canonicalname attribute by removing everything after last back slash, sorting for uniqueness, and removing the new computer/unassigned computer OU from list.
        $OUs = Get-ADComputer -Filter "Name -like '$Prefix*'" -Properties DistinguishedName | Select-Object -ExpandProperty DistinguishedName | sort
        $OUs = $OUs -replace '^[^,]*,',''
        $OUs = $OUs | Select-Object -Unique
        $Ous = $OUs | Where-Object {$_ -NE $UnassignedComputersOU}

        if ($OUs.Count -eq 1){
            Write-host "Moving $ComputerName to $OUs" -ForegroundColor Green
            Move-ADObject -Identity $UnassignedComputer.ObjectGUID -TargetPath $OUs -whatif | Out-Null
                
                If ($? -eq $True){
                        break
                }
            }

        if ($Ous.Count -gt 1){
        Write-Host ""
        Write-Host "Multiple OUs found for computername $ComputerName using computerprefix $Prefix" -ForegroundColor Yellow
        $OUs | Write-Host
        Write-Host ""

            foreach ($OU in $OUs){
                $Move = Read-host "Move $ComputerName to $OU ? Type YES to move or hit enter for NO"

                if ($Move -eq "YES"){
                Write-host "Moving $ComputerName to $OU" -ForegroundColor Green
                Move-ADObject -Identity $UnassignedComputer.ObjectGUID -TargetPath $OU -whatif | Out-Null
                
                    If ($? -eq $True){
                        break
                    }
                }
            }
        }
       
        else{
            Write-Warning "No matching OU found for prefix:$Prefix" 
        }
        
        } 
        Clear-Variable OUs -ErrorAction SilentlyContinue
    }
}