啟用或停用信箱稽核記錄

Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true

Set-Mailbox -Identity "Ben Smith" -AuditEnabled $false

啟用信箱的信箱稽核記錄時，系統僅會記錄信箱稽核記錄設定中所指定之系統管理員、代理人和擁有者的行為。

這個範例指定會為 Ben Smith 信箱記錄委派使用者執行的 SendAs 或 SendOnBehalf 動作。







複製


Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf -AuditEnabled $true




這個範例指定會為 Ben Smith 的信箱記錄系統管理員執行的 MessageBind 和 FolderBind 動作。







複製


Set-Mailbox -Identity "Ben Smith" -AuditAdmin MessageBind,FolderBind -AuditEnabled $true




這個範例指定將會為 Ben Smith 信箱記錄信箱擁有者執行的 HardDelete 動作。







複製


Set-Mailbox -Identity "Ben Smith" -AuditOwner HardDelete -AuditEnabled $true

WSUS Script to delete duplicate SID created by Disk Imaging / Disk Cloning

WSUS: Script to delete duplicate SID created by Disk Imaging / Disk Cloning

You might notice that some computers are appearing multiple times in WSUSAdmin - Computers and some of them disappear very often. This is due to duplicate SUS client IDs. Take a look at this script which deletes duplicate SUS client IDs found on a computer. These IDs are often found on computers where the operating system was installed using an image-based setup.

 

Script Code

============================================

@echo off
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stops the wuauserv service
Echo 2.    Deletes the AccountDomainSid registry key (if it exists)
Echo 3.    Deletes the PingID registry key (if it exists)
Echo 4.    Deletes the SusClientId registry key (if it exists)
Echo 5.    Restarts the wuauserv service
Echo 6.    Resets the Authorization Cookie
Echo 7.    More information on http://msmvps.com/Athif
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

============================================

SUS client ID will be generated at next detection.

Delete Duplicate SUS Client IDs
http://www.microsoft.com/technet/scriptcenter/csc/scripts/software/update/cscsw027.mspx

w32tm 網域成員電腦不信任網域主控站

網域成員電腦不信任網域主控站

w32tm /config /update /manualpeerlist:"time.stdtime.gov.tw clock.stdtime.gov.tw tick.stdtime.gov.tw tock.stdtime.gov.tw watch.stdtime.gov.tw,0x1"



w32tm /config /update

Exchange Useful Exchange Commandlets

Useful Exchange Commandlets

Get Mailbox
Get-MailboxStatistics | where {$_.TotalItemSize -gt 1MB} | sort-object DatabaseName, TotalItemSize,LastLogonTime | format-table DisplayName, @{expression={$_.TotalItemSize.Value.ToMB()};label=”TotalItemSize(MB)”}, LastLogonTime, DatabaseName
(This will give you info on the selected users mailbox size, last login time and database)

 you could use:
Get-MailboxStatistics –id “User name” |fl displayname,totalitemsize

Message Trackign log:
Get-MessageTrackingLog -Start "04/13/2009 9:00AM" -End "04/26/2009 5:00PM" -Sender "jamesluo@sg.com" | Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject | export-csv c:\QueryAllRecipients.csv

Add full mailbox permission:
Add-MailboxPermission -Identity 'CN=Journal Technical,OU=Technical,DC=EGRP,DC=local' -User 'EGRP\Domain Admins' -AccessRights 'FullAccess'

How To Check Exchange Database Size with PowerShell
Get-MailboxDatabase -Status | select ServerName,Name,DatabaseSize


Edge Sync
Start-EdgeSynchronization -Server Hub1

Calendar Permissions:
add-MailboxFolderPermission -Identity DarrenBos:\calendar -AccessRights Editor -User Scotteastman

Which Servers are people logged onto
Get-LogonStatistics -Identity "seastman" |fl clientname

Message Tracking
Get-Exchangeserver | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-Messagetrackinglog -sender user@domain.com -MessageSubject "Subject of message” -Start "8/27/2010 7:00 AM" -End "8/27/2010 11:00 AM" | Select-Object Timestamp,Clienthostname,eventid,source,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,serverhostname,SourceContext | Export-Csv c:\temp\Messageinfo.csv


Search mailbox - then put results into my mailbox in folder called XEN:
Search-Mailbox -Identity zwood -SearchQuery "From:'cs@enta.net'" -TargetMailbox seastman -TargetFolder "XEN" -LogLevel Full

Removing Emails from all mailbox's
Get-Mailbox -database "ENTA IT" -resultsize unlimited | Search-Mailbox -SearchQuery "From:'*@*.acidkrew.com'" -DeleteContent

Get-Mailbox -resultsize unlimited | Search-Mailbox -SearchQuery "From:'xraytechnician.ekcgen@aqveii.acidkrew.com'" -DeleteContent

Get-Mailbox -resultsize unlimited | Search-Mailbox -SearchQuery "From:'User X' To:'All Email Users'" -DeleteContent

Get-Mailbox -resultsize unlimited | Search-Mailbox -SearchQuery "Subject: Update Your E-Mail Details Account" -DeleteContent

Tracking Emails
get-messagetrackinglog -Server "ourExch2007" -Start "10/25/2009 9:34:00 AM" -End "11/6/2009 9:44:00 AM" -resultsize unlimited |where {$_.Sender -like "*@domain.com"}

Wondering how many log files are generated per database every minute? Quickly find out by typing:
Get-MailboxDatabase -Server $env:ComputerName | %{ Get-ChildItem -Path $_.LogFolderPath -Filter "*????.log" | Group-Object -Property {$_.LastWriteTime.Day,$_.LastWriteTime.Hour,$_.LastWriteTime.minute} | ?{$_.Count -gt 1} | Measure-Object - Property Count -Min -Max -Ave }

Mailbox Size
Get-MailboxStatistics -server exchangemb11 | Sort-Object TotalItemSize -Descending | ft Display
Name,@{label="TotalItemSize(MB)";expression={$_.TotalItemSize.Value.ToMB()}},ItemCount | Format-List > c:\file.txt

Export Mailbox Request
New-MailboxExportRequest -Mailbox journal1 -FilePath "\\vmmlibrary\Exchange_Backup\Journal Backup\Master Journal\Journal1.pst"

get-messagetrackinglog -Sender "Jim.Woods@entagroup.com" | Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject | export-csv 'V:\IT\Exchange\LOGS\Jim Woods\jimEdge.csv'

Use the Shell to remove a mailbox export request:
Remove-MailboxExportRequest -Identity "Ayla\MailboxExport"

Use the Shell to remove multiple mailbox export requests:
Get-MailboxExportRequest -Status Completed | Remove-MailboxExportRequest

Archiving Info:
Get-Mailbox | where {$_.ArchiveDatabase -ne $null}

Get-Mailbox | where {$_.ArchiveDatabase -ne $null} | ft name, archivedatabase, archivename, archivequota, archivewarningquota -AutoSize

Find a users Archive information:
get-mailboxstatistics mailboxname –archive

Get-Mailbox -archive | Get-MailboxStatistics -archive |fl DisplayName, Total*

Export Tracking Logs to CSV

Export-MessageTrackingLogsForRecipient.ps1 -Recipient steve -OutputCSV .\output.csv

Mailbox Size Report:

get-mailbox | Get-MailboxStatistics | Sort-Object TotalItemSize -Descending | ft DisplayName,@{
label="TotalItemSize(MB)";expression={$_.TotalItemSize.Value.ToMB()}},@{label="TotalItemSize(GB)";expression={$_.TotalItemSize.Value.ToGB()}} >c:\scott4.xls

Database size report:
Get-MailboxDatabase -status | Sort-Object databaseSize -Descending |ft name,databasesize

Get Managed Folder Assistant
Get-MailboxServer | fl Name,ManagedFolderAssistantSchedule

Get Mailbox Database Copy Status
Get-mailboxdatabasecopystatus -connectionstatus | fl name,outgoingconnections,incominglogcopyingnetwork

Add Domain Admins FULL access rights to every mailbox
Get-MailboxDatabase | Add-ADPermission -user "Domain Admins" -AccessRights GenericAll

Enable Pipeline Tracing
Set-TransportServer -id Exchangemb11 -PipelineTracingEnabled $true -PipelineTracingSenderAddress news@entagroup.com -PipelineTracingPath "C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\PipelineTracing"

First turn it on: Set-TransportServer Server1 -PipelineTracingEnabled $True

This will create a folder called PipelineTracing and all the email messages and info will be in there

Mailbox Permission Change:
Add-MailboxPermission -Identity 'CN=Journal Master4,OU=IT,DC=EGRP,DC=local' -User 'EGRP\Domain Admins' -AccessRights 'FullAccess'

NET disable firewall

netsh firewall set opmode mode=disable

AD Get-ADUser DisplayName Disable-ADAccount

Get-ADUser -Filter {DisplayName -like "123456(陳XX)"} | Disable-ADAccount -Confirm:$false

Exchange 清空信箱

Search-Mailbox -Identity "xxxx" -DeleteContent -Force