Skip to content

Commit

Permalink
Change Get-MSOLUser to Get-Mailbox
Browse files Browse the repository at this point in the history 
Reworked this script to use Get-Mailbox instead of Get-MSOLUser, since if you have an AD synced Tenant, this will probably have a good number of MSOLUsers that aren't tied to Mailboxes.

Moved big Get-Mailbox pull to top and reused the data
Added Mailbox param to UPN (to save having to re-lookup whose mailbox it's connected to)

Also, fixes
 (OfficeDev#41)
  • Loading branch information
@PsychoData
PsychoData committed Dec 16, 2018
1 parent 4874135 commit cc07c0c
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 15 deletions.
19 changes: 7 additions & 12 deletions DumpDelegatesandForwardingRules.ps1
View file
Original file line number Diff line number Diff line change
@@ -1,29 +1,24 @@
#Import the right module to talk with AAD
import-module MSOnline

#Let's get us an admin cred!
#Let's get us an admin cred!
$userCredential = Get-Credential

#This connects to Azure Active Directory
Connect-MsolService -Credential $userCredential

#Connecting to Exchange Online
$ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $userCredential -Authentication Basic -AllowRedirection
Import-PSSession $ExoSession
Import-PSSession $ExoSession -DisableNameChecking | Out-Null

$allUsers = @()
$AllUsers = Get-MsolUser -All -EnabledFilter EnabledOnly | select ObjectID, UserPrincipalName, FirstName, LastName, StrongAuthenticationRequirements, StsRefreshTokensValidFrom, StrongPasswordRequired, LastPasswordChangeTimestamp | Where-Object {($_.UserPrincipalName -notlike "*#EXT#*")}
$AllUsers = Get-Mailbox -ResultSize Unlimited

$UserInboxRules = @()
$UserDelegates = @()

foreach ($User in $allUsers)
{
Write-Host "Checking inbox rules and delegates for user: " $User.UserPrincipalName;
$UserInboxRules += Get-InboxRule -Mailbox $User.UserPrincipalname | Select Name, Description, Enabled, Priority, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage | Where-Object {($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)}
$UserDelegates += Get-MailboxPermission -Identity $User.UserPrincipalName | Where-Object {($_.IsInherited -ne "True") -and ($_.User -notlike "*SELF*")}
$UserInboxRules += Get-InboxRule -Mailbox $User.UserPrincipalname | Select-Object @{Name='Mailbox';Expression={$user.UserPrincipalName}},Name, Description, Enabled, Priority, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage | Where-Object {($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)}
$UserDelegates += Get-MailboxPermission -Identity $User.UserPrincipalName | Where-Object {($_.IsInherited -ne "True") -and ($_.User -notlike "*SELF*")}
}

$SMTPForwarding = Get-Mailbox -ResultSize Unlimited | select DisplayName,ForwardingAddress,ForwardingSMTPAddress,DeliverToMailboxandForward | where {$_.ForwardingSMTPAddress -ne $null}
$SMTPForwarding = $allUsers | Select-Object DisplayName,UserPrincipalName,ForwardingAddress,ForwardingSMTPAddress,DeliverToMailboxandForward | Where-Object {($_.ForwardingSMTPAddress -ne $null) -or ($_.ForwardingAddress -ne $null)}

$UserInboxRules | Export-Csv MailForwardingRulesToExternalDomains.csv
$UserDelegates | Export-Csv MailboxDelegatePermissions.csv
Expand Down
7 changes: 4 additions & 3 deletions DumpDelegatesandForwardingRulesFromFile.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,9 @@ $userCredential = Get-Credential
#This connects to Azure Active Directory
Connect-MsolService -Credential $userCredential

#Connecting to Exchange Online
$ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $userCredential -Authentication Basic -AllowRedirection
Import-PSSession $ExoSession
Import-PSSession $ExoSession -DisableNameChecking | Out-Null


#Let's Pull in the list of all GUIDS
Expand All @@ -19,7 +20,7 @@ $allUsers = @()

foreach ($guid in $UserGuids)
{
$allUsers += Get-MsolUser -ObjectID $guid.ObjectId | select ObjectID, UserPrincipalName, FirstName, LastName, StrongAuthenticationRequirements, StsRefreshTokensValidFrom, StrongPasswordRequired, LastPasswordChangeTimestamp
$allUsers += Get-MsolUser -ObjectID $guid.ObjectId | select-Object ObjectID, UserPrincipalName, FirstName, LastName, StrongAuthenticationRequirements, StsRefreshTokensValidFrom, StrongPasswordRequired, LastPasswordChangeTimestamp
}

$UserInboxRules = @()
Expand All @@ -28,7 +29,7 @@ $UserDelegates = @()
foreach ($User in $allUsers)
{
Write-Host "Checking inbox rules and delegates for user: " $User.UserPrincipalName;
$UserInboxRules += Get-InboxRule -Mailbox $User.UserPrincipalname | Select Name, Description, Enabled, Priority, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage | Where-Object {($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)}
$UserInboxRules += Get-InboxRule -Mailbox $User.UserPrincipalname | Select-Object @{Name='Mailbox';Expression={$user.UserPrincipalName}}, Name, Description, Enabled, Priority, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage | Where-Object {($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)}
$UserDelegates += Get-MailboxPermission -Identity $User.UserPrincipalName | Where-Object {($_.IsInherited -ne "True") -and ($_.User -notlike "*SELF*")}
}

Expand Down

1 comment on commit cc07c0c

@PsychoData
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reworked this script to use Get-Mailbox instead of Get-MSOLUser and then hopefully finding Matching Mailboxes by UPN
If you have a DirSynced AAD, not all MSOL Users will have a Mailbox by a LONG shot, unless you configured your sync rules really well.

I ran this against about 6 client tenants, and found that this wasn't very useful, as-is.
The problem is that the extra MSOL accounts glob up the Command window, making it look like it's failing all over the place, and just.... ugly.

Plus, why are we trying to find the Mailboxes by the MSOLUsers in the first place? If we want Mailboxes and THEIR info, let's start with mailboxes.

$userCredential = Get-Credential

#Connect to MSOL, no need to erase old sessions. it overwrites
Connect-MsolService -Credential $userCredential

#Cleanup Old runs attached to different Tenants 
Get-Module  tmp* -ErrorAction SilentlyContinue | Remove-Module -ErrorAction SilentlyContinue 
Get-PSSession -Id ($ExoSession.Id)  | Remove-PSSession

#Connect to Exchange again
$ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $userCredential -Authentication Basic -AllowRedirection
Import-PSSession $ExoSession -DisableNameChecking | Out-Null

#basically from https://github.com/OfficeDev/O365-InvestigationTooling/blob/47eab28f2cad1ec0e18778bf52268b34831aea99/DumpDelegatesandForwardingRules.ps1#L14 
$allMSOLUsers = Get-MsolUser -All -EnabledFilter EnabledOnly | select ObjectID, UserPrincipalName, FirstName, LastName, StrongAuthenticationRequirements, StsRefreshTokensValidFrom, StrongPasswordRequired, LastPasswordChangeTimestamp | Where-Object {($_.UserPrincipalName -notlike "*#EXT#*")}

$allMailboxes = Get-Mailbox 

$overlapUsers = $allMSOLUsers | foreach {
    try {
        Write-Host ("Attempting to Get Mailbox for MSOLUser {0}:" -f $_.userPrincipalName) -NoNewLine
        Get-Mailbox ($_.UserPrincipalName) -ErrorAction Stop
        Write-Host "Found"  } 
    Catch {
        Write-host -foregroundcolor Red "NOT FOUND"
    }
}
Write-host ("Num Mailboxes    :{0}" -f $allMailboxes.count)
Write-host ("Num MSOL Users   :{0}" -f $allMSOLUsers.count)
Write-host ("Num OverLap Users:{0}" -f $overlapUsers.count)

This gives you an idea how many MSOLUsers do not have a matching mailbox, and how there are sometimes mailboxes without a matching MSOLUser
Screenshot of data

Long story short, looking up from MSOLUser -> Mailbox might not always be 100% right.
I also can't think there would ever be a situation where you would have an extra mailbox with no MSOL User it is connected to.

Please sign in to comment.