OneDrive for Business Probs

[JRowley]

But can I just clarify, how do you populate the password field on a per user basis?

 

Your script says simply:

 

$emailpassword = "password"

 

Which implies you manually add the password in plain text to the script.

[Michael]

You can do it several ways - plain text (as per my example), or you can run ConvertTo-SecureString in Powershell which encrypts your password so it's not in plain text.

[JRowley]

You can do it several ways - plain text (as per my example), or you can run ConvertTo-SecureString in Powershell which encrypts your password so it's not in plain text.

 

What I'm trying to get at is that unless your going to create this script 100/1000 times (or once for every staff/student) there is no practical way for you to get the password from AD, or O365, or from CSV. Making this approach a bit unwieldy to say the least. Of course it depends how far you take it but I don't see this being a viable approach without ADFS to automate for you.

[Michael]

What I'm trying to get at is that unless your going to create this script 100/1000 times (or once for every staff/student) there is no practical way for you to get the password from AD, or O365, or from CSV. Making this approach a bit unwieldy to say the least. Of course it depends how far you take it but I don't see this being a viable approach without ADFS to automate for you.

 

I agree with what you're saying, however I support many small(er) sites, rather than single large sites where ADFS would be the better solution I agree. Still a modified version for ADFS would/could work in the same/similar fashion, just obtaining the credentials directly from AD instead of from the script itself.

[Michael]

Slight change/improvement, on the more systems I've tried -

 

$user = "user.name"
$user2 = "user_name"

$siteName = "examplesch"
$emailDomain = "exampleschool.co.uk"
$urlDomain = "_exampleschool_co_uk" # The Email Domain split up with '_' for dividers, the leading one is important

$urlsite = "https://" + $siteName + "-my.sharepoint.com/personal/"
$mapsite = "" + $siteName + "-my.sharepoint.com@SSL\DavWWWRoot\personal"
$urlsite2 = "https://outlook.office365.com/owa/"

$emailusername = $user + "@" + $emailDomain
$emailpassword = "password"
$urlFile = $urlsite + $user2 + $urlDomain + "/Documents"
$mapPath = $mapsite + $user2 + $urlDomain + "\Documents"

$driveLetter = 'O:'

If(!(Test-Path -Path $driveLetter)) # Checks if the drive is in use
{
   $ie = new-object -com InternetExplorer.Application
   $ie.navigate("http://login.microsoftonline.com/logout.srf")
   do {sleep 1} until (-not ($ie.Busy)) 

   $ie.quit()

   $ie = new-object -com InternetExplorer.Application
   $ie.navigate("https://login.microsoftonline.com/login.srf")
   $ie.Visible = $true
   do {sleep 1} until (-not ($ie.Busy)) 
  
   try
   { 
       $ie.document.GetElementById("_link").click()
    do {sleep 1} until (-not ($ie.Busy)) 
   }
   catch { $null }

   try
   { 
       $ie.document.GetElementById("cred_userid_inputtext").value = $emailusername
       $ie.document.GetElementById("cred_password_inputtext").value = $emailpassword
       $ie.document.GetElementById("cred_keep_me_signed_in_checkbox").click()
          do {sleep 5} until (-not ($ie.Busy))
    $ie.document.GetElementById("cred_sign_in_button").click()
          do {sleep 5} until (-not ($ie.Busy)) 
   }
   catch  {$null }
   
   sleep -seconds 5

   $ie.navigate($urlFile)
   do {sleep 1} until (-not ($ie.Busy))
   sleep -seconds 5
   
   $ie.navigate($urlSite2)
   do {sleep 1} until (-not ($ie.Busy))
   sleep -seconds 5

   #$ie.quit()
      
   NET USE $driveLetter $mappath /PERSISTENT:YES
   $regkey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##" + $sitename + "-my.sharepoint.com@SSL#DavWWWRoot#personal#" + $user2 + $urldomain + "#Documents"
   sleep -seconds 1
   New-ItemProperty -Path $regkey -Name _LabelFromReg -Type String -Value OneDrive
   }

 

Add the following to trusted sites:

 

https://*.outlook.com/
https://*.sharepoint.com/
https://*.microsoftonline.com/
https://*.lync.com/

 

You can do this via GPO:

 

User Config > Policies > Admin Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page - Site to Zone Assignment List - Enabled, all with a value of 2

 

Make sure the WebClient service is started and set to Automatic on Windows 7. Windows 8 and Windows 10 have it already started.

 

You can do this via GPO (RSAT):

 

Computer Config > Policies > Windows Settings > Security Settings > System Services - WebClient

[spc-rocket]

I don't think you'll be able to do it this way without ADFS. There's no link between your O365 account and AD so you have to enter separate credentials, you can't do this automatically I don't think. You also can't to my knowledge grab the password from AD and then feed it into the authentication for O365, the only way would be if the password was stored in plain text, which it obviously isn't.

 

Hello there,

 

I was wondering will this actually cache the cookie so that when the staff who have domain joined laptops can have drives mapped at home (using the school provided laptops)? I'm not sure how long the cookie lasts?

 

We have ADFS deployed and everything works fine (i haven't tried your script yet by the way) in regards to SSO etc.

 

Thanks,

 

Ash.

[JRowley]

Hello there,

 

I was wondering will this actually cache the cookie so that when the staff who have domain joined laptops can have drives mapped at home (using the school provided laptops)? I'm not sure how long the cookie lasts?

 

We have ADFS deployed and everything works fine (i haven't tried your script yet by the way) in regards to SSO etc.

 

Thanks,

 

Ash.

 

I couldn't tell you, I don't actually use the script it was just something I tested at the time. The script will however work anywhere in the world, you don't need access to your internal domain to run it so you could use it at home. The script also just launches IE and auto populates the login fields, so it's as if you manually logged into IE, so the cookie will be cached the same and will last the same amount of time as normal.

 

My advice would be to stick the script on a laptop and just run it manually at home and see how it works for yourself.

[browolf]

Seems like adfs makes a lot of this stuff easier.

 

can you have adfs installed/configured on server2008r2 whilst keeping the old login system going?