HPlum78

Head....

Trying to prove that there is a constant over voltage to a supplier is like pushing water up hill... how old is your building?

About 4.5PB but we don't count your asking secondary schools...

This one is also useful https://www.mail-tester.com/

At least you called yourself out... what's the sync service say? Or have you managed to sort it now?

AAD connect is essentially MIM under the hood the sync tools are installed on your aad connect server.

egrep '^[a-z][a-z][^kd][^i][a-z]$' /usr/share/dict/words|egrep 'k.*d.*i|k.*i.*d|d.*i.*k|d.*k.*i|i.*k.*d|i.*d.*k'|grep -v '[auobe]'|less this is how i work it out these days!

Yeah its going ro be something daft as @Steve21 suggest.

Is this only happening on the group of machines you have applied the new policy to? Just for sanity sake would be worth checking! Is there anything in the gpresult output that could be useful or in the event logs? It's broad so is hard to pin it down from just that screen grab...

Yeah a massive RAT I will nip over with the harpoon sort that little rodant p!$×÷ right out. There are some thing you can try like owl feathers and raw onion were the favourites outside of using WMD!

Nah rats are known for loft living one thing about having rats is you won't have mice nor any other small animals for that matter... (not sure that helps mind!). You can take a loan of my Cockerpoo he loves getting hold of em! Rats can be notoriously difficult to get in a trap and if a rat finds a dead rat near food they will generally leave that food well alone an all... When I was a fair bit younger and a lot less wise. We used to air rifel them down on the farm, then we thought that using a whaling harpoon would be a good idea one day. We missed the rat smashed a massive hole in the back of the barn, while my mate found himself about 30ft from where we started lacking a couple of teeth. All good fun until someone loses an eye :-D So to sum up don't use a bazooka to swat a fly! Here is man using nature to solve an issue with unwanted visitors, viewer discretion is advised as the commentary not suitable for delicate ears:

Happy to share what we do, as we are a little larger than you are @ ~600 Windows servers. Also if I can help script wise ping me.

Sorry the point I was trying to make there is when you might not have control of the server as some tools/ ransome ware requires a reboot and being able to identify reboots outside of your knowns as it were is useful...

On the point of two way radio Teams can do this now... not saying that's the solution mind.

You could home brew this with some pi zeros and such likes (I would be all over that!) or something like the following https://www.safezoneapp.com/how-it-works. It depends on what you want to spend/ how much you want to develop/ support after implementation...

So the code below is what we have in place we use a function (Get-PendingReboot - by Brian Wilhite) this is distributed as a schedule task to our servers and is run at the end of the maintenance window (we have a similar script that runs each night that just emails the list of servers that require a reboot). The script also has a reg key that is updated via group policy if we want the script to not reboot a server/ group of servers. By using this we are capturing the reboots of servers and this helps us identify servers that are rebooted outside of their maintenance window. The next update to this is to write out an event to the application log so that we can surface these reboots in our other monitoring tools. Function Get-PendingReboot { <# .SYNOPSIS Gets the pending reboot status on a local or remote computer. .DESCRIPTION This function will query the registry on a local or remote computer and determine if the system is pending a reboot, from either Microsoft Patching or a Software Installation. For Windows 2008+ the function will query the CBS registry key as another factor in determining pending reboot state. "PendingFileRenameOperations" and "Auto Update\RebootRequired" are observed as being consistant across Windows Server 2003 & 2008. CBServicing = Component Based Servicing (Windows 2008) WindowsUpdate = Windows Update / Auto Update (Windows 2003 / 2008) CCMClientSDK = SCCM 2012 Clients only (DetermineIfRebootPending method) otherwise $null value PendFileRename = PendingFileRenameOperations (Windows 2003 / 2008) .PARAMETER ComputerName A single Computer or an array of computer names. The default is localhost ($env:COMPUTERNAME). .PARAMETER ErrorLog A single path to send error data to a log file. .EXAMPLE PS C:\> Get-PendingReboot -ComputerName (Get-Content C:\ServerList.txt) | Format-Table -AutoSize Computer CBServicing WindowsUpdate CCMClientSDK PendFileRename PendFileRenVal RebootPending -------- ----------- ------------- ------------ -------------- -------------- ------------- DC01 False False False False DC02 False False False False FS01 False False False False This example will capture the contents of C:\ServerList.txt and query the pending reboot information from the systems contained in the file and display the output in a table. The null values are by design, since these systems do not have the SCCM 2012 client installed, nor was the PendingFileRenameOperations value populated. .EXAMPLE PS C:\> Get-PendingReboot Computer : WKS01 CBServicing : False WindowsUpdate : True CCMClient : False PendComputerRename : False PendFileRename : False PendFileRenVal : RebootPending : True This example will query the local machine for pending reboot information. .EXAMPLE PS C:\> $Servers = Get-Content C:\Servers.txt PS C:\> Get-PendingReboot -Computer $Servers | Export-Csv C:\PendingRebootReport.csv -NoTypeInformation This example will create a report that contains pending reboot information. .LINK Component-Based Servicing: http://technet.microsoft.com/en-us/library/cc756291(v=WS.10).aspx PendingFileRename/Auto Update: http://support.microsoft.com/kb/2723674 http://technet.microsoft.com/en-us/library/cc960241.aspx http://blogs.msdn.com/b/hansr/archive/2006/02/17/patchreboot.aspx SCCM 2012/CCM_ClientSDK: http://msdn.microsoft.com/en-us/library/jj902723.aspx .NOTES Author: Brian Wilhite Email: bcwilhite (at) live.com Date: 29AUG2012 PSVer: 2.0/3.0/4.0/5.0 Updated: 01DEC2014 UpdNote: Added CCMClient property - Used with SCCM 2012 Clients only Added ValueFromPipelineByPropertyName=$true to the ComputerName Parameter Removed $Data variable from the PSObject - it is not needed Bug with the way CCMClientSDK returned null value if it was false Removed unneeded variables Added PendFileRenVal - Contents of the PendingFileRenameOperations Reg Entry Removed .Net Registry connection, replaced with WMI StdRegProv Added ComputerPendingRename #> [CmdletBinding()] param( [Parameter(Position=0,ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)] [Alias("CN","Computer")] [string[]]$ComputerName="$env:COMPUTERNAME", [string]$ErrorLog ) Begin { }## End Begin Script Block Process { Foreach ($Computer in $ComputerName) { Try { ## Setting pending values to false to cut down on the number of else statements $CompPendRen,$PendFileRename,$Pending,$SCCM = $false,$false,$false,$false ## Setting CBSRebootPend to null since not all versions of Windows has this value $CBSRebootPend = $null ## Querying WMI for build version $WMI_OS = Get-WmiObject -Class Win32_OperatingSystem -Property BuildNumber, CSName -ComputerName $Computer -ErrorAction Stop ## Making registry connection to the local/remote computer $HKLM = [uInt32] "0x80000002" $WMI_Reg = [WMIClass] "\\$Computer\root\default:StdRegProv" ## If Vista/2008 & Above query the CBS Reg Key If ([int32]$WMI_OS.BuildNumber -ge 6001) { $RegSubKeysCBS = $WMI_Reg.EnumKey($HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\") $CBSRebootPend = $RegSubKeysCBS.sNames -contains "RebootPending" } ## Query WUAU from the registry $RegWUAURebootReq = $WMI_Reg.EnumKey($HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\") $WUAURebootReq = $RegWUAURebootReq.sNames -contains "RebootRequired" ## Query PendingFileRenameOperations from the registry $RegSubKeySM = $WMI_Reg.GetMultiStringValue($HKLM,"SYSTEM\CurrentControlSet\Control\Session Manager\","PendingFileRenameOperations") #$RegValuePFRO = $RegSubKeySM.sValue $RegValuePFRO = @($RegSubKeySM.sValue).Where({$_ -ne ""}) ## Query ComputerName and ActiveComputerName from the registry $ActCompNm = $WMI_Reg.GetStringValue($HKLM,"SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName\","ComputerName") $CompNm = $WMI_Reg.GetStringValue($HKLM,"SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\","ComputerName") If ($ActCompNm -ne $CompNm) { $CompPendRen = $true } ## If PendingFileRenameOperations has a value set $RegValuePFRO variable to $true $PendFileRename = $false $noRebootFiles = @() If ($RegValuePFRO) { foreach($regValue in $RegValuePFRO) { If ($RegValue -like "*\C:\windows\system32\spool\*" -or $RegValue -like "*\C:\Program Files (x86)\Google\*" -or $RegValue -like "*\C:\Users\*") { $noRebootFiles += $regValue } else { $PendFileRename = $true } } } $manualReboot = $false If (Test-Path c:\temp\RebootRequired.txt) { $loops = 0 Do{ Start-Sleep -Seconds 5 Remove-Item c:\temp\RebootRequired.txt -Force $loops++ } Until (!(Test-Path c:\temp\RebootRequired.txt) -or $loops -gt 12) $manualReboot = $true } ## Determine SCCM 2012 Client Reboot Pending Status ## To avoid nested 'if' statements and unneeded WMI calls to determine if the CCM_ClientUtilities class exist, setting EA = 0 $CCMClientSDK = $null $CCMSplat = @{ NameSpace='ROOT\ccm\ClientSDK' Class='CCM_ClientUtilities' Name='DetermineIfRebootPending' ComputerName=$Computer ErrorAction='Stop' } ## Try CCMClientSDK Try { $CCMClientSDK = Invoke-WmiMethod @CCMSplat } Catch [system.UnauthorizedAccessException] { $CcmStatus = Get-Service -Name CcmExec -ComputerName $Computer -ErrorAction SilentlyContinue If ($CcmStatus.Status -ne 'Running') { Write-Warning "$Computer`: Error - CcmExec service is not running." $CCMClientSDK = $null } } Catch { $CCMClientSDK = $null } If ($CCMClientSDK) { If ($CCMClientSDK.ReturnValue -ne 0) { Write-Warning "Error: DetermineIfRebootPending returned error code $($CCMClientSDK.ReturnValue)" } If ($CCMClientSDK.IsHardRebootPending -or $CCMClientSDK.RebootPending) { $SCCM = $true } } Else { $SCCM = $null } ## Creating Custom PSObject and Select-Object Splat $SelectSplat = @{ Property=( 'Computer', 'CBServicing', 'WindowsUpdate', 'CCMClientSDK', 'PendComputerRename', 'PendFileRename', 'PendFileRenVal', 'NoRebootFiles', 'RebootPending' )} New-Object -TypeName PSObject -Property @{ Computer=$WMI_OS.CSName CBServicing=$CBSRebootPend WindowsUpdate=$WUAURebootReq CCMClientSDK=$SCCM PendComputerRename=$CompPendRen PendFileRename=$PendFileRename PendFileRenVal=$RegValuePFRO NoRebootFiles=$noRebootFiles #PendFileRenVal=$noRebootFiles RebootPending=($CompPendRen -or $CBSRebootPend -or $WUAURebootReq -or $SCCM -or $PendFileRename -or $manualReboot) } | Select-Object @SelectSplat } Catch { Write-Warning "$Computer`: $_" ## If $ErrorLog, log the file to a user specified location/path If ($ErrorLog) { Out-File -InputObject "$Computer`,$_" -FilePath $ErrorLog -Append } } }## End Foreach ($Computer in $ComputerName) }## End Process End { }## End End }## End Function Get-PendingReboot ################# test server for reboot status and restart if true ######################################## ################# Set Mail server SMTP Address ############################################################# $PSEmailServer = '%YourMAilServerHere%' ############################################################################################################ ###################################### Vars ################################################################ $rb = Get-PendingReboot $strSrv = $env:COMPUTERNAME $strDate = Get-Date -Format dd/MM/yy-h:mm:ss $props = @{ CBServicing = "$($RB.CBServicing)" WindowsUpdate = "$($RB.WindowsUpdate)" PendComputerRename = "$($RB.PendComputerRename)" PendFileRename = "$($RB.PendFileRename)" PendFileRenVal = "$($RB.PendFileRenVal)" NoRebootFiles = "$($RB.NoRebootFiles)" RebootPending = "$($RB.rebootpending)" ManualRebootReq = "$manualReboot" } $objRBP = new-object psobject -Property $props $strMailB1 = $objRBPList | ? {$_.RebootPending -eq "True"} | select RebootPending,CBServicing,WindowsUpdate,PendComputerRename,PendFileRename,PendFileRenVal $strMailB = $strSrv + " Server was restarted by the Restart Computer with Reg Check script at " + $strDate + "`n" + "Restart Reason `n" + "CBServicing : " + $objRBP.CBServicing + "`n" + "Windows Update : " + $objRBP.WindowsUpdate + "`n" + "Pending Computer Rename : " + $objRBP.PendComputerRename + "`n" + "Pending File Rename : " + $objRBP.PendFileRename + "`n" + "Pending File Rename Value : " + $objRBP.PendFileRenVal $strMailSub = $strSrv + " restarted by script" $strMailSubNoReboot = $strSrv + " has not restarted (pending file rename operation)" $strMailBNoReboot = $strSrv + " Server was not restarted by the Restart Computer with Reg Check script at " + $strDate + "`n" + "`n" + "Pending File Rename Value : " + "`n" + $objRBP.NoRebootFiles $strMailBMan = $strSrv + " Server has not deleted its Manual Reboot File, please investigate at " + $strDate $strMailSubMan = $strSrv + " rebooted but didn't remove its Manual Reboot File" $strMailBForceNoReboot = $strSrv + " Server was not restarted by the Restart Computer with Reg Check script at " + $strDate + "`n" + "`n" + "Pending reboot Reason `n" + "CBServicing : " + $objRBP.CBServicing + "`n" + "Windows Update : " + $objRBP.WindowsUpdate + "`n" + "Pending Computer Rename : " + $objRBP.PendComputerRename + "`n" + "Pending File Rename : " + $objRBP.PendFileRename + "`n" + "Pending File Rename Value : " + $objRBP.PendFileRenVal + "`n" + "`n" + "This was due to the No Reboot registry value being set" $strMailSubForceNoReboot = $strSrv + " has not restarted (registry entry)" if ($rb.RebootPending -eq $true){ If(Test-Path -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\PendingRebootCheck\PendingReboot){ $AutoRebootDisabledReg = Get-Item -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\PendingRebootCheck\PendingReboot $AutoRebootDisabled = $AutoRebootDisabledReg.GetValue('AutoRebootDisabled') If($AutoRebootDisabled -eq '1'){ Send-MailMessage -to "YourITTeamHere" -from "[email protected]" -Subject $strMailSubForceNoReboot -Body $strMailBForceNoReboot Exit } } #the line below determines the number of seconds to sleep between the value after minimum and the value after maximum $sleepval = get-random -minimum 0 -maximum 600 #the line below sleeps the script for a number of seconds equal to sleep value Start-sleep -Seconds $sleepval Send-MailMessage -to "YourITTeamHere" -from "[email protected]" -Subject $strMailSub -Body $strMailB If($loops -gt 12) { Send-MailMessage -to "YourITTeamHere" -from "[email protected]" -Subject $strMailSubMan -Body $strMailBMan } Start-Sleep -Seconds 3 Restart-Computer -Force } elseif ($rb.PendFileRenVal) { Send-MailMessage -to "YourITTeamHere" -from "[email protected]" -Subject $strMailSubNoReboot -Body $strMailBNoReboot }

Just a couple of observations here, in your code @mikeglover the write-host no use what so ever,unless someone is sat running the script but the you would not be looking to automate this. The second is a note about just letting servers reboot you should define matanance windows and ensure that the servers are rebooted within those windows and as already noted don't reboot your DC's/ highly available services within one matanance window! And make sure you are capturing when servers are rebooting and why if at all possible.

The get AD-User is the way, but -filter * - properties * is a pet hate (see my previous posts on this) get the properties you need the select statement ('Select-Object DisplayName, Title') has the properties that you are after...

So you could use keyvault to store the keys but that comes with some interesting caveats.. PowerShell secret management is also available as well https://devblogs.microsoft.com/powershell/secretmanagement-and-secretstore-are-generally-available/ Here is the api reference https://docs.microsoft.com/en-us/rest/api/keyvault/get-secret/get-secret

From memory this is all in the unified audit logs, so should be able to be searched for from the compliance search util. See if this points you in the right direction: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#audited-activities

So it's now worth noting that the MSOL cmdlets (module) are being depricated as of the 30 June 2022 so if you are using these to automate your identity management then you need to start retooling using the new tools.

https://practical365.com/microsoft-365-backups-do-you-need-them-part-one/ I will punt you to the above...

When I used to care about these things I think the recommended temp was between 20 and 24 with a relative humidity of around around 40% (from memory). Much colder than 20 you introduce increased risks of condensation and static build up. If you have a large sever room/ data centre you probably want to look at cold aisle cooling solutions.

@Steve21 makes a good point and I am going to add this try to use the v2 commands as they have been reworked and are more performant that the original cmdlets. So Get-EXORecipient for instance, here is the reference for info:- https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps

And I also share @phydii thoughts around how you should approach this if you do care about something on a failing/ fair DC.