Exchange Transport Queues at glance

Modified Exchange Transport queue powershell command: displays only queues that have emails in them:

Get-ExchangeServer | ?{$_.serverrole -eq 'HubTransport'} | Get-Queue | Where-Object {$_.MessageCount -ne 0} |Select-Object Identity, DeliveryType, NextHopDomain, MessageCount | Sort-Object MessageCount -Descending

Powershell Tip: how to analyze many text files in the folder

For example, IIS Logs of Exchange CAS servers:

Get-ChildItem | Select-String -Pattern "emailaddress@yourdomain.com"

Resolve-DNSName: useful addition to Powershell commands

Resolve-DNSName (available in Windows 2012 R2 version of Powershell) is very useful command to obtain various statistics about DNS zone.

For example, if zones.txt file consists of the zones to check following command will help to find SOA record for every zone in the file:

Get-Content zones.txt | Resolve-DnsName -Type SOA | Select-Object Name, PrimaryServer | Export-Csv zones.csv -notype

Good article about usage of the command: http://exchangeserverpro.com/use-powershell-to-quickly-check-multiple-mx-records/

List of Users with expired password - Quest Powershell

Get-QADUser -SearchRoot "OU=YourOU,DC=YourDomain,DC=com" -SearchScope Subtree -Enabled -Size 0 | Where-Object {($_.PasswordIsExpired) -eq $True} | fl displayname, *password*

How to get list of mailboxes for enabled users only

Task: Provide the list of mailboxes for only accounts that are enabled (excluding the mailboxes for disabled accounts).  This is frequently required for any type of Exchange mailbox migration projects, when disabled mailboxes will not be migrated.

1. Get the all mailboxes list - including disabled (distinguishedname only): in Exchange Management Console run following command:"Get-Mailbox -resultsize unlimited | select-object distinguishedname | export-csv c:\admin\dn_mailboxes_all.csv -notype"
2. Get the list of distinguishednames of disabled accounts: using Quest ActiveRoles Management Shell: "Search-ADAccount -AccountDisabled | select-object distinguishedname | export-csv c:\admin\disabled-objects.csv -notype"
3. So - now we have 2 spreadsheets, first has all mailboxes, second all disabled objects - use your favorite way to select only items that exist in person first spreadsheet, but not in second.  I use Excel Pivot table: I combine both spreadsheets in one (simple copy/paste will work) and then I insert Pivot Table with 'count' option for that column...  The lines that have count '2' exist in both files, therefore disabled, so I need only lines that have count '1'.
4. Copy the ones that have count "1" (therefore either enabled objects or disabled non-user objects) to txt file (c:\admin\enabledobjects.txt in our case).
5. In Exchange Management Console run following command: "get-content c:\admin\enabledobjects.txt | Get-Mailbox -resultsize unlimited | select-object displayname, Organizationalunit, UserPrincipalname, PrimarySMTPAddress, ServerName | export-csv c:\admin\mailboxes_enabled_users.csv -notype" (note that when you run the script, non-user objects will produce error, that is normal: non-user objects do not have a mailbox, therefore the resulting file will have correct information with only enabled user mailboxes).

I am sure there maybe more elegant ways to do this...

Assign permissions to the tree of OUs when inheritance turned off (through Powershell)

Recently I needed to add permission to move computer objects to OUs for the group of users. I added the permissions to the “root” OU and tested it: everything worked great.
After I reported that task is done, I heard from the users in that group that they still get ‘Access is denied’ trying to move computer objects. I discovered that in AD permissions inheritance was disabled for most of the sub-OUs. So, there are more than 1,000 OUs to add permissions to.
Following script took care of the task for me:
#Require Quest "Active Roles Management Shell for Active Directory".

#Put following to the text document saved as *.ps1:

add-PSSnapin quest.activeroles.admanagement
$OU = “root OU DN”
get-qadobject -searchRoot $OU -searchScope 'SubTree'-Type organizationalUnit -SizeLimit 0 |
Add-QADPermission -Account “domainname\user group to add permissions” -Rights CreateChild -ApplyTo All -ChildType
Computer