Technology | Fitness | Food
Yes, I know it may seem counter productive to make a web version of it, but I wanted to have an interactive web version so that it is easier for people to use then Microsoft’s version. The data is the same as the PowerShell version and will be updated at the same time as they are pulling from the same source.
Functionality:
Web Version: EntraFIDOFinder
PowerShell Version: EntraFIDOFinder
Let me know what you think, and have a great day!
Wow, can’t believe it! 1,000 downloads of 365AutomatedLab! Thank you all! And I just want to start out saying apologies for not updating it more. Big work projects, summer, and life got in the way, but learned a lot and can’t wait to spread that info.
Still saddened that Microsoft hasn’t brought back the free Developer tenant program, but you can still use these in production to standardize adding and removing objects when dynamic groups aren’t an option. Please let me know if there are any features you wish it had, and I’ll see what I can do.
I did make a quick update to the module due to the PnP.PowerShell module changes where I removed the Connect-PnP in functions as you cannot use the old way anymore. I didn’t want you or others to be blocked from using those functions because of it, but will be adding back the newer way in the near future, I just want to find the best way to give you options to connect. If you already have a working function, I’d be glad to add it as well.
In addition to 365AutomatedLab, I’d been working on 365AutomatedCheck which is still in beta, but it checks if your 365 tenant is formatted and/or configured correctly to your company standards. Some of its capabilities are making sure that field values follow company standards, making sure phone numbers are filled in, and even on the fly correcting of those fields. This isn’t a Maester replacement, in fact all of the Pester tests work in Maester, and encourage you to add these to your Maester setup, but as of right now the auto correct fields function doesn’t work. Maybe we can make that happen!
Again, thank you for using 365AutomatedLab, as this is a fun side project for me, and never thought it would get this much traction. It’s a dream come true, and can’t wait to start working on it again!
Hope you have a great day!
365AutomatedLab
PowerShell Gallery: https://www.powershellgallery.com/packages/365AutomatedLab/2.11.0
GitHub: https://github.com/DevClate/365AutomatedLab
365AutomatedCheck
PowerShell Gallery: https://www.powershellgallery.com/packages/365AutomatedCheck/0.0.11
GitHub: https://github.com/DevClate/365AutomatedCheck
Maester
PowerShell Gallery: https://www.powershellgallery.com/packages/Maester/0.3.0
GitHub: https://github.com/maester365/maester
PnP.PowerShell Announcement
https://github.com/pnp/powershell/issues/4250
365AutomatedLab and new companion module coming soon
I promise I haven’t forgotten about 365AutomatedLab, but I’ll be honest after Microsoft made the announcement of no more new Dev tenants it hurt a bit as I know how useful they are on learning and testing features and PowerShell without hurting your production environment. 365AutomatedLab will still be used for people that have Dev tenants whether they are free or not, but you can use these functions in production as well.
Now about the new module, it hasn’t been released yet, but finishing cleaning it up to at least beta stage. I won’t say exactly what it does yet, but it is a companion to 365AutomatedLab in that it helps you keep your 365 tenant organized. A little teaser though, is that some of the parts will work with the amazing module Maester and if you don’t already use it, go install it now. Seriously, go do that and while that is downloading, think of ways you would like to see 365AutomatedLab improved.
Maester.dev – Test Automation Framework to keep control of your 365 security configuration
365AutomatedLab – Setup a 365 Tenant from an Excel Workbook
As always, thank you for taking the time and have a great day!
Here’s the scenario…
An executive forwards an email to your ticketing system and asks why they are receiving it. Then sends another from the day before. There is a Microsoft 365 distribution list(DL) in both emails, but not one they would be on. What do you do?
Check and see if there are any tickets for that DL, and you see there haven’t been any tickets for that DL or even that person. You then check the DL, and indeed see they are in it…. but how?
PowerShell to the rescue! Have you ever used “Search-UnifiedAuditLog” which is a cmdlet for Exchange Online PowerShell? It is a great for one off investigations in 365, but here we will use it to find any admin activity for that user in the past week. Full disclosure, I’ve used it a handful of times and had never really dug into which was a mistake on my part. Knowing more of what it can do now would have saved me so much time on other resolutions where I had gone through the 365 portal. Don’t be me, start using this now and create your own functions as well Purview to save you time and headaches. Enable it now, as it can’t be backdated.
# See if you have it enabled
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
# If not enabled, run this
Enable-OrganizationCustomization
# Enable Audit logs - this can take up to 60 mins
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Hopefully you already have it enabled, or you enabled it right now and can wait for it to start ingesting the logs so when you do need it, it is available.
Back to our executive incident. How do we find out what happened. The quick way is to run:
# Check for all admin activity for named user
Search-UnifiedAuditLog -StartDate 2/1/2024 -EndDate 3/16/2024 -ObjectIds execuser@domain.com
And this is the way I originally did it to get the answer I needed. That’s it! Then you will see in “AuditData” which groups they were added/removed from and any operations that happened with the groups they are in. This broad search will show even more, but only mentioning parts related to this task. At the end of this post I’ll have a list of great resources on how to get granular on your searches.
Now you can see that another engineer accidentally added them(after confirming with engineer), and you can just remove them from the list. This is best case scenario, as if I hadn’t looked and just removed the executive without searching and asking the engineer, they could have been added by a compromised account seeing what kind of privileges they had.
There is a way clean up the audit data so it is easier to view, but that will be in a longer blog post coming soon. Again, I’ll have some links at the end to give you a head start. Honestly, this was only supposed to be a quick one liner post, that definitely grew, and I’ve spent more time than I would like to admit researching it. It has given me more ideas on how to use it and I’ll put together functions in a repository or possibly a module of most useful commands.
One function I’ll be creating is one to check to see if a user has changed their password recently, has multiple failed attempts, and/or if they have locked themself out. How nice would that be for you or your help desk if the function sees who submitted the ticket, runs the function then gives you that feedback? To go one step farther, if they aren’t blocked out, automatically send them the password reset portal to reset their password?
If you already use this, what scripts/functions have you created? I’d love to hear about them, and I can create a repository for us to keep them in one spot.
Useful Links:
Search-UnifiedAuditLog – Microsoft Learn Cmdlet
How it works – Services that support auditing
Detailed info – Detailed Microsoft Script
Hope this helps saving you from headaches and can’t wait to hear how you use it! Have a great day!
Read-Only Friday August 4, 2023
Do you still have any Windows Server 2012R2 or earlier in production? This is a friendly reminder that they will be going End Of Life October 10 of this year. If you do have any in production, what is your plan to decommission them? Do you still need the server, or will you be spinning up a new upgraded VM? Do you have the licensing to upgrade? What are your next steps?
Talking about End Of Life, how do you manage and track your equipment and licensing for this scenario? Do you have special asset/license management software, SharePoint list, SQL Database, Excel workbook, or even a csv with dates and costs?
If you’ve made it this far, I’m hoping this isn’t a surprise and this is only a reminder to keep following your plan, but if this is the first time you’re hearing this, please look at this now and put a plan in place, especially if you will need to purchase new licensing. While you are at it, I’d check those servers running 2012R2 and see how much of the services you really need running now, as a lot has probably changed since you first put them into production. Also, do you have enough resources to run both at the same time, or do you have to take a current backup(test to make sure the backup works), delete(or turn off and hope you don’t accidently turn it on while new server is on) your current 2012R2, then build the new on?
Good luck with your migrations and as always if there is anyway I can help, feel free to reach out! Have a great Friday, and remember no unscheduled changes today.
Ever needed to check a computer or server and see how much disk space is being used? It could be for multiple reasons such as are any disks too low on space, too much available space assigned(think VMs where you need storage for a new server, but assume all of your storage is tied up), or you just need to see drives that have more than a certain amount of free space due to company standards.
This little one-liner is a great template for you then. This one liner will show any drive on the current computer that has more than 30gb of space free. You could easily change the “-gt” to “-lt” and only show drives with less than 30gb of space free.
Get-PSDrive -PSProvider 'FileSystem' | Where-Object { ($_.Free / 1GB) -gt 30 } | Format-Table -AutoSizeI know your thinking, I can easily click on my computer and check hard drive space, but what about if you have 10, 100, or 1000+ devices you have to manage? Do you really want to do all of those clicks? You could even set this up as a scheduled task and have it notify you, send to teams/discord/etc, or even email a Distribution List with a report. That sounds like a lot better idea than wasting time clicking around.
If your curious on how to have this capture multiple computers, one way is:
$Computers = 'Computer1', 'Computer2', 'Computer3' # Replace with your computer names or IPs
$ScriptBlock = {
Get-PSDrive -PSProvider 'FileSystem' |
Where-Object { ($_.Free / 1GB) -gt 30 } |
Format-Table -AutoSize
}
foreach ($Computer in $Computers) {
Invoke-Command -ComputerName $Computer -ScriptBlock $ScriptBlock
}I hope you found this one-liner useful, and would love to hear how you use it or have used it in the past! And as always if you have any questions, please feel free to reach out and if I can’t help you out, and I can find someone that can.