HPlum78

What is salamander using to do that sync into exchange? And yes i will share the code, will get it posted shortly.

Powershell all day long, in fact have just done ~200 of them. We have a couple of special cases that are managed by our IT department these guys are allowed to script their membership on our local AD and these have one of the Extension attributes set to AzureSync then AAD connect (or whatever we are calling it today) has a rule that essentially looks at that extension attribute for that value and then syncs the group up.

So are you setting out the teams that are allowed? Teams I think is a tool that is used not just for static teams (Finance, Office, SLT) but for virtual teams so new school xyz project , new MIS project. Never thought of mandating it, we give the users the ability to request there own teams via our help desk and then have Flow (or whatever we are calling it this week) and PowerShell do the grunt work of creating the Team. Also IT do not have any access to those Teams. We just manage the life cycle piece and have a PowerShell script check that the teams meet a certain set of criteria, if they don't the they are deleted.

Known knowns, known unknows and unknown unknowns, that's how life is even more so when you do IT! as for what you need to learn well i am guessing that you are a fair few years younger than me and have not had any thoughts about where you are going to be/ want to be. So the question is are you going to become an SME or are you going to continue on spreading yourself across a broad spectrum of IT? then you can start to answer the question of what should I spend time learning. One thing i will say is PowerShell will not be a bad investment...

You need to get a WAYF (less) url by the looks of things. That page that you are hitting, is in that selection box is that the org name or is that from you ADFS box using idp imitated sign on? (i cannot tell from the image). I guess my other question is do you use Azure? and if so could you not use that I would now advocate moving away from using ADFS for a lot of reasons. If its an on prem app that you want to support via Azure app proxy is the way to go now (you only need one app proxy box, this can support multiple apps)

https://microsoftteams.uservoice.com/forums/555103-public-preview/suggestions/16925362-sign-in-to-client-with-multiple-accounts

Another take on the above would be to create a reg key and then check if its there or not

In place is fully supported https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers i cannot find the 2019 version for this, but its essentually supported.

Need to post in a few other places but have had an interesting and busy week! in the mean time this is worth looking at for all of you who use PS and need have had to find interesting ways to deal with passwords. https://devblogs.microsoft.com/powershell/secrets-management-development-release/ hope some of you guys find it useful. H.

Yep absolutely security is like the forgotten child it's a tough balancing act.

You do know how you get compromised? So a phishing (spear or on mass) or a MIM exposes a standard users account then that account gets used to start to infiltrate the network and gain lateral and horizontal privileged access. I am making an assumption that you don't allow logging into workstations and surfing the Web with any type of privileged account? Its scares me that MI5 is being used as a comparison for threat! security is all about the basics it's not going to take MI5 to hack your networks if you are not doing the basics to be secure it's going to be Johnny the 8 year old that owns you.

@mavhc you are correct but it's about reducing your attack surface. And I ain't even mentioned the bat file as if your using PS then just use PS! Also if you are not monitoring/ and using AGPM for your GPOs then I suggest you look into it.

A few thoughts on this and these are only things to make you think not saying there is a right or wrong way. -executionpolicy Bypass and by holding your script in a \\share location that all your systems access. So I as a malicious actor gain access to your environment and with little lateral movement get the ability to edit that script that is called by all your workstations on your networks. How long before your entire environment is being run by someone else? if you are holding scripts and calling them from a central repo I would look at having some code signing, also is this the best way to deploy software is another question? Again nothing more than a nudge, not saying that anyone is wrong or right here just got my security hat on.

Sorry for the delay been on other stuff, I have fixed the checking you mention in point 1 and when I have looked at how the script is dealing with checking if the users should remain I have decided to rewrite that as you only really want to update the script in one place so I have been refactoring the script to work that way. Then I got thinking about something else when updating users on mass and if you use AAD connect you will know that it has an upper limit on the amount of change that is allowed before it essentially says this don't feel right and emails the global admins saying that its hit the delete limit for example. So with that in mind I was looking at adding a switch to the script so a -maxchange (or something like) to limit the scrip and a way to arm an disarm based on a manual intervention. Anyhow I will aim to put some code up later today, however its Six Nations today and I love my rugby.

Oh yeah see what I have done there let me take a look and rejig it sorry. And yes I will dig out a function for the mailing part as well, it was another thing I wanted to cover TBH. As if the script fails at any a catch and then exits you would want to know that had happened. The way I have written the script means that it's a hard fail at a couple of points and no one would know. Will get on to it hopefully later today. H.

Import-Module ActiveDirectory ## Your AD domain name $ADDomain = (Get-ADDomain).distinguishedName ## Dynamic group name$ADGroupname = 'FLS-Staff' ## Logfile$logPath = "C:\localapp\PowerShell\Logs\DynGrpScript\" $LogFile = "dyn_Grp_Script_$(Get-Date -format filedatetime).txt" if(!(Test-Path $logPath$LogFile)){ Try{ New-item -Path $logPath -Name $LogFile -ItemType File $Log = Get-Item $logPath$LogFile } Catch{ Exit }} ## OU list to search users $ADOUs = @("OU=Staff,OU=User Accounts,$ADDomain") # Searching users in the specified OUs$users = @() $ADOUs.ForEach({ Try{ $users += Get-ADUser -Filter * -SearchBase $_ Add-Content $Log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | getting users from $_.)" } Catch{ Add-Content $Log.FullName "ERR | $(get-date -Format dd/MM_HH:MM:ss) | getting users from $_.)" } })$users[0..10].ForEach({ Try{ Add-Content $log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | Trying to add $($_.samaccountname) to $ADGroupname" Add-ADGroupMember -Identity $ADGroupname -Members $_.samaccountname } Catch{ Add-Content $log.FullName "WRN |$(get-date -Format dd/MM_HH:MM:ss) | Trying to add $($_.samaccountname) to $ADGroupname" } }) ## Make sure that each user in the group meets the selection criteria. If not, they are removed from the group Try{ Add-Content $log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | Getting group members of group $ADGroupname" $members = Get-ADGroupMember -Identity $ADGroupname } Catch{ Add-Content $log.FullName "ERR | $(get-date -Format dd/MM_HH:MM:ss) | Failed to get members of $ADGroupname" Exit } Add-Content $log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | Checking groups and memebership" $members.ForEach({ Add-Content $log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | Checking $($_.distinguishedname)" Try{ if($_.distinguishedname -notlike "*$ADOUs*"){ Add-Content $log.FullName "INFO | $(get-date -Format dd/MM_HH:MM:ss) | Removing $($_.distinguishedname) from group $ADOUs" Remove-ADGroupMember -Identity $ADGroupname -Members $_.samaccountname -Confirm:$false } } Catch{ Add-Content $log.FullName "WRN | $(get-date -Format dd/MM_HH:MM:ss) | Failed to Remove $($_.samaccountname) from group $ADOUs" } }) So thats what i have come up with, error trapping is a kind of art in its self and although i have written the logging inline as it were if you take a look at one of my previous posts you can grab the function that I have posted for writing out error logs. Also I think that function creates the log file as well. The other advantage of writing log this way is the output looks like this:- INFO | 29/01_20:01:54 | Trying to add PN851052 to FLS-Staff INFO | 29/01_20:01:54 | Trying to add PN908418 to FLS-Staff WRN | 29/01_20:01:54 | Failed to add PN463155 to FLS-Staff INFO | 29/01_20:01:54 | Getting group members of group FLS-Staff INFO | 29/01_20:01:54 | Checking groups and memebership INFO | 29/01_20:01:54 | Checking CN=Debbia Dziewatkoski,OU=Staff,OU=User Accounts,DC=PLUMNET,DC=CO,DC=UK INFO | 29/01_20:01:54 | Checking CN=Johnnalynn Terzer,OU=Staff,OU=User Accounts,DC=PLUMNET,DC=CO,DC=UK INFO | 29/01_20:01:54 | Checking CN=Eleithyia Pathiyiljose,OU=Staff,OU=User Accounts,DC=PLUMNET,DC=CO,DC=UK so you can go to your log folder for the script and run the following PS command:- cat *.* | Select-String Rem This command will return something like the following from all the logs in the directory: INFO | 29/01_20:01:55 | Removing CN=Servanne Eckeard,OU=Students,OU=User Accounts,DC=PLUMNET,DC=CO,DC=UK from group OU=Staff,OU=User Accounts,DC=PLUMNET,DC=CO,DC=UK essentially the command lets you plough through your logs looking for a string/ part of a string, allowing you to quickly find what has happened on your accounts/ groups in your domain. Note that getting your folder structure for your script logging right is a must. (again i have written a function to search the whole log tree or the function lets you select the script logs to search, I will post that function if anyone requires it) Oh and the users in my test domain have all been created by a handy little script on GitHub you can find it here https://github.com/RobBridgeman/ADImporter (I used it to create ~5000 staff/ student users for testing this script in a few mins) ##Edit - Code formatting went sideways so did what I could! should still work....

So there are a few things here, firstly I would use the get-date -Format filedatetime command, not that this will help you with the output but it will get you a nice unique number for your log files and they sort well (also i never knew that this was even a thing until a few weeks ago!) Secondly (actually the first thing and most important) Try Catch statements if you are going to do/ take action on something then you need to handle what happens if something fails. Thirdly (or are we now secondly) I would consider changing how you iterate over your objects so rather than using foreach ($user in $users) I would approach this, this way $Users.foreach({ }) (requires PS v4 or later) you will see significant performance increases in your scripts due to the work that has been put in under the hood to make this more performant. (try it for yourself) This brings me onto what is the real issue and is the enemy while scripting with PS -ErrorAction and how it deals with terminating and none terminating errors essentially what you are doing is killing the informational and error pipes hence why no out to screen or log file. I am rewriting the code will post it shortly....

I don't think they care if its new or second hand! :-P

I have an issue with that statement @mikkydoos as the op has asked for the best MS exam not about the best none MS exam unless Cisco have started writing content for MS products? Like @norpy has said it really depends on what you see yourself getting into, and where you are on you chosen path. Azure/ M365 certification would not be a bad thing to look at but if the cloud (Azure) is not on your horizon anytime soon then admin certifications are a good way to go. Most importantly choose something that you are interested in as Hello World stops most people from going any further. (if you have been doing this as long as i have that will mean something to you!)

Yeah should be a none IT issue but like @FishCustard you ask the question and you get the standard IT Heath Robinson approach of taking something simple and embellishing it. for the younger audience :- https://en.wikipedia.org/wiki/W._Heath_Robinson (Just rock up with a Grandfather clock!) :-P

I am going to send you here https://www.ncsc.gov.uk/blog-post/trouble-phishing Then if you still want to test this way I am sure there are some companies out there that would be willing to help you part with some of you IT/ whole school training budget! :-p

I mentioned Plumsail and if you scroll down the page there is a review of the product by someone off this forum, who is using it in a MAT environment. Maybe worth contacting them directly and get a look see. Jira wow err we use that and it's a lot of product to do just a help desk on good if you are going to leverage all the other stuff but not just a H/D solution in my view.

https://plumsail.com/sharepoint-helpdesk/

The issue is what you have done to the hash splatting here (Get-HotFix -computername $using:server.Name | Select HotFixId,description, @{l="InstalledOn";e={[DateTime]$_.psbase.properties["installedon"].value}}| Sort InstalledOn)[-1] | Select -ExpandProperty InstalledOn You cannot just change that line to select the HotFixID and description and @fordea approach is one way to solve this issue.

Right so one approach is to set the filter to return computers based on an OS filter so -Filter 'OperatingSystem - like "Windows Server *"' -properties Name I have covered on more than one occasion on here the -Filter * -properties * when doing searches against AD you should absolutely avoid doing this. You can be smarter with your searches by firstly doing a Get-ADComputer / Get-Aduser -Identity -properties * and then digging out the best way to filter and then returning only the properties that are needed for your next operation/ export.