StephenHardy

Haahaa School Boy error: netsh WINHTTP import proxy source =ie Now all hunky dory: Import-Module msonline $cred = Get-Credential Connect-MsolService -cred $cred $Session = New-PSSession -ConfigurationNameMicrosoft.Exchange -ConnectionUri https://ps.outlook.com/powershell-Credential $cred -Authentication Basic -AllowRedirection Import-PSSession $Session cmdlet Get-Credential at command pipeline position1 Supply values for the following parameters: WARNING: Your connection has been redirected to thefollowing URI: "https://podXXXXXpsh.outlook.com/powershell-liveid?PSVersion=4.0" WARNING: The names of some imported commands fromthe module 'tmp_cuyndfqy.jnd' include unapproved verbs that might make themless discoverable. To find the commands with unapproved verbs, run theImport-Module command again with the Verbose parameter. For a list of approvedverbs, type Get-Verb. ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Script 1.0 tmp_cuyndfqy.jnd {Add-AvailabilityAddressSpace, Add-DistributionGroupMember,Add-MailboxFolderPermission, Add-Ma...

I've put a service request in with MS to see if they can resolve this...

Import-Module msonline $cred = Get-Credential Connect-MsolService -cred $cred $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $cred -Authentication Basic -AllowRedirection Import-PSSession $Session 　 Get-User -RecipientTypeDetailsUserMailbox | where {$_.Title -eq "Student User"} | Set-CASMailbox -ActiveSyncEnabled $False

yeah definitely a pasting issue

I've tried: $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Cred -Authentication Basic -AllowRedirection Import-PSSession $Session Get-User -RecipientTypeDetailsUserMailbox | where {$_.Title -eq "Student User"} | Set-CASMailbox -ActiveSyncEnabled $False Still the same issue

Got an issue connecting to Office 365 to disable activesync for a specific set of users however I don't seem to be able to connect to the URI, any ideas what the URI should be? $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://outlook.com/domain-name.com/" Error: New-PSSession : [outlook.com] Connecting to remote server outlook.com failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic. At C:\SWSC Office 365 Scripts\Office 365\Students_Provision_Disable_Services.ps1:6 char:12 + $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "h ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : WinRMOperationTimeout,PSSessionOpenFailed Import-PSSession : Cannot validate argument on parameter 'Session'. The argument is null. Provide a valid value for the argument, and then try running the command again. At C:\SWSC Office 365 Scripts\Office 365\Students_Provision_Disable_Services.ps1:7 char:18 + Import-PSSession $Session + ~~~~~~~~ + CategoryInfo : InvalidData: ( [import-PSSession], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.ImportPSSessionCommand

This script kind of works: Import-Module MSOnline $powerUser = "[email protected]" $powerPass = "XXXXXX" $password = ConvertTo-SecureString $powerPass -AsPlainText -Force $adminCredential = New-Object -TypeName System.Management.Automation.PSCredential -argumentlist $powerUser,$password Connect-MSOLService -Credential $adminCredential Import-module ActiveDirectory $AccountSkuId = "XXXXXX:STANDARDWOFFPACK_STUDENT" $UsageLocation = "GB" $LicenseOptions = New-MsolLicenseOptions -AccountSkuId $AccountSkuId $Users = Get-ADUser -Filter * -SearchBase "OU=Students,OU=XXX,OU=Establishments,DC=XXX,DC=XXX" $Users | ForEach-Object { Set-MsolUser -UserPrincipalName $_.UserPrincipalName -UsageLocation $UsageLocation Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $AccountSkuId -LicenseOptions $LicenseOptions } it throws errors RE: Being unable to assign licenses to existing licensed users Set-MsolUserLicense : Unable to assign this license because it is invalid. Use the Get-MsolAccountSku cmdlet to retrieve a list of valid licenses. At C:\XXXX Office 365 Scripts\Office 365\Students_Provision.ps1:15 char:2 + Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $Accou ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: ( [set-MsolUserLicense], MicrosoftOnlineException + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InvalidUserLicenseException,Microsoft.Online.Administration.Automation.SetUserLicense However, I now need to do the following: A) Copy every email either sent or received to every user into a separate email account for protection purposes B) Hide teaching staff from Students GAL Anyone have any ideas? Thanks Stephen

Our student are in nested OUs under a main students one and staff are in other OUs so jszkudlapski's script may work..anyway to store the admin username and password though so it runs silently?

We use group memberships to security groups James. I'd also like to know how on earth to read the SKUs when they appear to be over a certain character length 😜

PITA - got it yes indeed, it really shouldn't be that damn hard. I have 4 user groupings. Teaching, non-teaching, domain admins and students, I want the staff types to have one set of licences and a mailbox created and students a different licence and mailbox. Pretty simple, and if I used an on site exchange it would be easy...

Cheers PITA?

Hi guys, I'm trying to auto-provision/license staff with one plan and students with another in Office 365. I was looking at this: How to Use PowerShell to Automatically Assign Licenses to Your Office 365 Users - TechNet Articles - United States (English) - TechNet Wiki but not being great with LDAP or Powershell, anyone have an idea: I want it to use my 'students' group as the group it looks to to provision students with one of the SKU's (Not that I can see the actual full SKU yet) - any ideas on the ldapDisplayName I need to enter here? Thanks Stephen

Sorted it. It was because I was importing the ADFS settings from an old farm that may of been corrupted. i.e. The Farm was created which created a new cert store, the settings were imported which set the farm to use a no longer existing store: So I followed this: To manually delete this container in Active Directory, follow these steps: 1. Before you remove AD FS 3.0 from the last federation server in the farm, run the following PowerShell commands on the AD FS 3.0 Primary Federation Server to determine the location of the certificate sharing container in Active Directory: Get-AdfsProperties 2. Note the CertificateSharingContainer property in the output from the previous step. 3. Log on to a server where the ADSIEdit tool (ADSIEdit.msc) is installed. 4. Click Start, click Run, type ADSIEdit.msc, and then press ENTER. 5. In the ADSIEdit tool, connect to the Default naming context by following these steps: a. Right-click ADSI Edit, and then click Connect to. b. Under Connection Point, click Select a well-known Naming Context, and then select Default naming context. c. Click OK. 6. Expand the following node: Default naming context, YOUR SITE ID, CN=Program Data, CN=Microsoft, CN=ADFS Note Under CN=ADFS, you see a container named CN={GUID} for each AD FS 3.0 farm that you have deployed, where {GUID} matches the CertificateSharingContainer property that you captured by using the Get-AdfsProperties PowerShell command in step 1. 7. Right-click the appropriate {GUID} container, and then select Delete. Then I re-installed the ADFS Role, setup in the usual way, converted the Domain to Managed using this PS script: $cred=Get-Credential Connect-MsolService -Credential $cred Set-MSOLDomainAuthentication -Authentication Managed -DomainName my-domain.com Then converted back to federated using this PS script:: $cred=Get-Credential Connect-MsolService -Credential $cred Convert-MsolDomainToFederated -DomainName my-domain.com WAP now connects to the ADFS NLB and all is rosey… now onto auto-provisioning students and staff into their respective plans – any suggestions here? Thanks Stephen

Forgot to add, the farm name and server names have been used many times before...

James, Got an issue with the secondary ADFS server, which, if enabled in the NLB and accessed for authentication, causes authentication to fail. I think this is due to the ADFS having a stuck record much like here http://community.office365.com/en-us/f/613/t/59106.aspx. Any ideas how to remove the record for the secondary ADFS server to get this working again? cheers Stephen

Hi James, Yes indeed - would you believe I was actually on the phone for a while to one of your colleagues at the time. 60 odd minutes of testing and it was back to my original assumption of User Rights Assignment, which you answered Cheers Buddy, now onto getting accounts to auto provision based on group membership... Stephen

James That's the one - thanks Stephen

Tried with a local service account, no dice.... I cant use a GMSA as its Server 2012R2 and the domain is Server 2008R2... At present, every time I reboot either ADFS server I have to remove, re-add and re-setup the Farm.

Hi All, We are running 2 x Server 2012 R2 Servers as an ADFS Farm (Server 2008R2 Domain however) for Office 365. Everything installs fine and we can pass-through authenticate through the Web Application Proxy NLB we have setup. However, when we reboot either of the ADFS servers the ADFS Service never starts, if you try to manually start the service you receive a 1297 error - looks like User Rights Assignment for the Domain Admin account running the service. Does anyone know what rights this needs - cant seem to find anything online - I've been trawling all day... Thanks Stephen

That seems to have done the trick. The pop up message was being caused by the HAP helpdesk - we don't use this so I deleted the link and the error went away Cheers Nick

Hi Nick, I get this error straight after logon: My Hap Config file looks like this: Any ideas? Thanks Stephen

Hi Nick, I think you said this before when I was tying to get this up an running on an old 2008R2 NLB. Can you give any guidance on where how to create these and how/where to use these keys? Will these keys also help with issue no.1? Thanks as always Stephen

Hi There, Having a couple of issues with an install on a Server 2012 Load Balanced setup. 1) When accessing either via the NLB or direct to an individual server I get a pop out window saying "Message from WebPage" The Error being 'Not Found' - see screenshot 1 2) The second error only occurs when access via the NLB - when accessing the My Files section I get a "Padding is invalid and cannot be removed" message - see screenshot 2 Does anyone have an idea on this - I'm keen to move our production environment to Server 2012 R2 ASAP. Thanks Stephen

Pain in the absolute butt. IT manager with no PC and unable to fix it or get to a shop to get spares Ha

Would you believe it. On a 5 day course away from my school and my (rather expensive) PC falls over and won't turn on (suspect motherboard or PSU) and no access to spares! Usually it's a quick trip with it to work one day and use spares for diagnostic testing. Typical