HPlum78

Sorry was in meetings yesterday, did this get sorted? if not something along these lines:- Get-Cluster | Get-ClusterParameter Note down the values of any parameters (if they are there they will look like CAUGwyrCyp9/GwyrCAU) but its always worth a look. You say that the cluster resources for the CAU are already missing from AD but if not delete them. Then run the following (PowerShell needs to be running as admin) Get-Cluster | Set-ClusterParameter "CauResourceName" -Delete Get-Cluster | Set-ClusterParameter "CauVCOName" -Delete then you should be able to run the cluster aware updating setup again.

https://blogs.msdn.microsoft.com/powershell/2017/05/10/announcing-powershell-for-visual-studio-code-1-0/ The new preferred PowerShell code editor (sort of)

Sorry @Steve21 miss read what you put there and yes you are correct.

Screen Grab of the CAU AD computer in my Dev Environment. This is nothing to do with a VM, In AD you should have a Cluster Aware Updating Resource with that name. If that is not in AD then for what could be a number of reasons it has gone. Need to reconfigure the CAU probably will need to use PowerShell and forcibly remove the current Cluster Aware Updating Configuration and then recreate. Oh and I will add this, even if the CAU resource is in AD I would guess that some of the supporting configuration for the CAU is not there! so ether way you are going to be removing the current CAU setup and recreating it from the ground up....

https://social.technet.microsoft.com/wiki/contents/articles/13590.known-issues-windows-server-2012-failover-clustering.aspx May help.

Can you take a look at the logs and see if just before these errors an update cycle is being initiated.

I seem to remember there was an issue with this way back in server 2012 but I thought it had been resolved in R2, but I suppose it could still be an issue if the servers were originally 2012 and then in-place upgraded, I will have a dig around to see if I can find anything and if my thoughts are correct....

CAU is Cluster Aware Updating

That was not for this post! pay no attention to me and I will go and post that in the correct place!

For licencing assignments we use a binary number to represent the licences a user should have assigned this is based on, on prem AD group membership and is calculated with a PowerShell script that writes the value to extensionattribute10 on the users account. So for talking sake a user is a member of following groups on prem Outlook (1), Skype (16) and Teams (32) they will have a number of 96 in the extensionattribute10. Another PowerShell script runs that looks at the value in each users extensionattribute10 and then assigns the correct licences based on what number is stored. This means that if a user moves between departments and that department is not using Teams for instance then the script recalculates the binary and the Teams licence is then removed from that user in the office admin portal. I should have said that this was before the days of being able to use the FIM sync service (Azure AD Connect or whatever we are calling it this week!) to manage this for you, see here https://blogs.technet.microsoft.com/askpfeplat/2017/08/07/assigning-office-365-licenses-automatically/

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers These may help, the concept of PDC's and BDC's are long since gone with the advent of ADDS on server 2000.

Not a google apps user but will try and throw up a dev env, just looking and thought I would share this ADFS v3 on Server 2012 R2 – Allow Chrome to automatically sign-in internally | Jack Stromberg In fact scratch that I have just realised what that fix was for.....

If you have ever read the book Mindhunter by John Douglas and Mark Olshaker, I have just stumbled across Mindhunter on Netflix and thus far I would reccomed a look. Be mindful that the subject of this is a look into the minds of mass murders/ serial killers and how these guys came to set up the FBI's criminal profiling unit by interviewing some of Americas worst sociopaths.

Not much response to this, I guess that people use Salamander/ Scripts to provision accounts.... I just wanted to try and understand if anyone has looked at using MIM (FIM) to manage the Joiners/ Movers /Leavers processes? It's the same sync engine used for Azure AD Connect!

So I would consider all of those things as part(s) of an identity and access lifecycle, So a typical user (Identity) story would be something like this:- New (identity) person added to the HR system (directory) - I guess that no one is using their AD as the Golden Source for identities. That (identity) person is then provisioned in AD (manually/ automated) The (identity) person is then added to any number of other systems (directories) these could include Access Control system/ print systems, finance systems, Office 365, Google Apps...... (manual / automated provisioning) Identity is consumed by the user, this will include access to the above systems and resources protected by the identity (Could be via SSO (ADFS/ Shib) or require some use of 2FA. I suppose what I am getting at is what if any thing are people doing about managing all of these desperate systems (directories) is there a lot of manual process or a number of automation scripts being run to create identities in these? how is everyone dealing with changes? what about deprovisioning?

So I guess you have your users home folders set to something like E:\StaffShare\First.Last or E:\StaffShare\samAccountName or something along those lines.... so :- $NumberofDays = '32' $Time = (get-date).AddDays(-$NumberofDays) $UserNames = get-aduser -SearchBase "OU=Users,OU=StaffAccounts,DC=SCHOOL,DC=COM" -Filter * | Select samAccountName $UserNames | %{ $FldrPath = "E:\StaffShare\$($_)\downloads" Get-ChildItem $FldrPath | Where-Object {$_.CreationTime -lt $Time} | Remove-Item -Recurse } The above is one approach that you could use.... I would throw in a test-path and again some logging.

@ADMaster sorry was not having a dig, and you are correct write-host is a valuable tool when scripting a one shot script. I would say that where possible I would use write-output/ write-verbose as you can do something with the output rather than just limiting it to the console. I am very much in the camp of Jeff Snover and Don Jones on the use of write-host and as Don Jones says "Every time you use write-host a cat dies" What To Do / Not to Do in PowerShell: Part 1 | PowerShell with a Purpose Blog Write-Host Considered Harmful | Jeffrey Snover's blog

Just wondering what people are using to manage identities in your systems? if you do use a solution, Are you managing the entire lifecycle and using one "golden source" for all of your systems? if so who manages that "golden source"? Do you use an identity solution to provision those identities into other systems like access control/ catering systems and the like? Do you automate the deprovisioning of identities?

#### Script that finds all the files and folders in a directory older than xx number of days #### #### Enter the number of days to subtract ##### $NumberofDays = '32' #### Enter the path to search here #### $FldrPath = 'C:\Users\sa_o365sync\AppData\Local\Temp' $Time = (get-date).AddDays(-$NumberofDays) Get-ChildItem $FldrPath | Where-Object {$_.CreationTime -lt $Time} | Remove-Item -Recurse A slightly different take on @ADMaster script. To cover the "import names into it if I had to" you could use import-CSV \\FilesToDelete\FilesToDelete.csv and have a list of files that you want to delete in that file. and then pipe that into the remove-item cmdlet it would look like:- #### Script that finds all the files and folders in a directory older than x number of days #### #### Enter the number of days to subtract ##### $NumberofDays = '32' #### Enter the path to search here #### $FldrPath = 'C:\Users\sa_o365sync\AppData\Local\Temp' $Time = (get-date).AddDays(-$NumberofDays) Get-ChildItem $FldrPath | Where-Object {$_.CreationTime -lt $Time} | Remove-Item -Recurse #### Files to delete #### $Files = import-CSV \\FilesToDelete\FilesToDelete.csv #### Path to your files list $files | Remove-Item -Recurse I will add my general caveats around adding logging logic and that using write-host (echo) in scripts should be avoided (no one really runs scripts in the consoles).

http://www.edugeek.net/forums/educational-software/152615-smart-notebook-creating-random-folders-strange-characters.html I have seen it before as well...... Don't use it anymore but looks the same...

As far as I can see from https://www.vmware.com/support/developer/PowerCLI/PowerCLI41U1/html/Get-VM.html that should use recursion unless told not to do so? - not a vm man mind!

I suppose what we are missing here is that you have little or no access to the exchange server..... exporting .pst from workstations and then on boarding seems like a different name for molasses to me!

The mailbox replication service was available from Exchange 2010, although on boarding is supported back to ex 2003 just have to use a different approache in the older versions.

Is there some kind of RADIUS set up?

Let's call that safe then! Lmao at that :-)