Aug 30, Update Your Java NOW!

Java has a severe security flaw in it that is publicly known and exploited by a number or virus toolkits. Oracle has finally realeased and update that fixes this flaw. This flaw is severe enough and well known enough that it is being released outside of the standard update cycle.

By default Java does not check for daily updates, it might be up to a month before your system automatically detects that there is a new update. If you have not already been prompted to update Java, you should do it manually.

1. In Control Panel, open Java. (you can also type Java from the search box in Start menu to find it)
2. On the Update tab, click Update Now.
3. Follow the onscreen instructions.

Reference: https://blogs.oracle.com/security/entry/security_alert_for_cve_20121

Monitor and Start Critical Services with PowerShell

We have multiple virtual machines running on a single Hyper-V host. Due to resource contention during startup, sometimes not all services start properly on one VM. To resolve this I created small PowerShell script that checks the status of some specific critical services and if they are stopped, starts them. I've scheduled the script to run hourly.

$services="MSExchangeADTopology","MSExchangeAntispamUpdate","MSExchangeEdgeSync","MSExchangeFDS","MSExchangeIS","MSExchangeMailboxAssistants","MSExchangeMailSubmission","MSExchangeSA","MSExchangeSearch","MSExchangeServiceHost","MSExchangeTransport","MSExchangeTransportLogSearch"

Foreach ($s in $services) {
    If ($s.status -ne "Running") {
        Start-Service $s
        }
    }

The $services variable contains the list of all the services names that are monitored. The script uses a foreach loop to examine the status of each service and start the service if the status is anything other than Running.

MED-V (Not for Windows 8)

MED-V is a virtualization technology that was enabled by Virtual PC on Windows 7. It had the advantage of presenting applications installed in a Windows XP virtual machine directly in Windows 7. Nice, but not widely used.

In Windows 8, Virtual PC has been replaced in Windows 8 by Client Hyper-V. As a consequence MED-V is not supported on Windows 8. The Windows XP Mode included as part of Windows 7 is also unsupported due to the loss of Virtual PC.

An announcement is here: http://windowsteamblog.com/windows/b/business/archive/2012/06/12/mdop-news-at-teched-north-america-2012.aspx

PowerShell Cmdlets for Networking

Windows Server 2012 and Windows 8 include PowerShell 3 with some new cmdlets for networking. For me this means the end of netsh for network configuration. It’s not that I ever used netsh much but it was occasionally useful for scripting. The following is a list of what I think will be some useful cmdlets.

Get-NetIPInterface: Queries and displays a list of interfaces on the computer. The list includes the IP addresses associated with an interface. Each interface has an index number that you can use to identify the interface with other cmdlets. So, this is similar to IPConfig /all.

Get-NetIPInterface | Format-List

Set-NetIPInterface: Modifies the configuration of an interface on the computer. You can use this to enable DHCP on an interface.

Set-NetIPInterface –InterfaceIndex 12 –DHCP Enabled

New-NetIPAddress: Adds an IP address to an interface. It is not possible to change an existing IP address, you must remove and create a new IP address. This cmdlet allows you to set the default gateway and subnet mask.

New-NetIPAddress –InterfaceIndex 12 –IPaddress 172.16.0.50 –DefaultGateway 172.16.0.2 –PrefixLength 24

Set-NetIPAddress: Modifies the configuration of an IP address, such as modifying the prefix length. You cannot modify the default gateway with this cmdlet.

Remove-NetIPAddress: Removes an existing IP address from an interface.

New-NetRoute: Used to add a new route to the local routing table. You can use this to change the default gateway, but you must remember to remove the existing default gateway.

New-NetRoute –InterfaceIndex 12 –DestinationPrefix 0.0.0.0/0 –NextHop 172.16.0.1

Remove-NetRoute: Used to remove routes from the routing table. Remember to include the NextHop parameter or it will remove all routes matching the destination prefix on the interface.

Remove-NetRoute –InterfaceIndex 12 –DestinationPrefix 0.0.0.0/0 –NextHop 172.16.0.5

To view all of the cmdlets that are available for configuring TCP/IP you can use:

Get-Command –Module NetTCPIP

This documentation is not 100% up to date, but you can also check this out:

• http://technet.microsoft.com/en-us/library/hh826123.aspx

Prevent Autodiscovery from Using a Pre-production CAS

When you install a Client Access server (CAS) into an existing Exchange environment, an SCP object is created in Active Directory for autodiscover. That object is immediately available in Active Directory and can be located by Outlook clients. If the CAS is not ready, and you've not configured certificates on the CAS yet, then users may start getting the errors about untrusted certificates.

To prevent clients from using the new CAS before it is configured (effectively disabling autodiscover), you can modify the SCP object by using the following cmdlet:

Set-ClientAccessServer ServerName -AutoDiscoverServiceInternalUri $NULL

Later, when the CAS is ready for production, you need to put the correct URI back into the object with the following cmdlet:

Set-ClientAccessServer ServerName -AutoDiscoverServiceInternalUri https://ServerFQDN/Autodiscover/Autodiscover.xml

Update May 2018
For the last while, I've been hearing about issues when setting the autodiscover URL to $null. It seems that newer Outlook clients see the SCP object in AD and assume that they can use the default URL for that node. So, rather than setting it to $null, set the URL to be the load balanced URL used for the older version.

As a practical example, if you are adding Exchange 2016 to and Exchange 2010 organization, set the URL to point at the Exchange 2010 servers until you've configured and tested the Exchange 2016 servers.

Unable to Filter Get-ADUser Based on Distinguished Name

When you are using the Get-AD* cmdlets to generate a list of users or other objects, it is a best practice to use the Filter parameter. When you use the Filter parameter, you pass a filter directly to Active Directory when you run the cmdlet. This is more efficient than retrieving a large list of objects and then filtering them with Where-Object.

I was working through a query with Get-ADUser that would obtain a list of all disabled users from Active Directory except for two or three OUs. To do this, I was trying to use the Filter parameter as shown below.

Get AD-User -Filter {(enabled -eq $false) -and (distinguishedname -notlike "*cn=users,dc=contoso,dc=com)}

Looks good right? Unfortunately, the filtering based on the distinguished name didn't work. It turns out that you cannot use wildcards when filtering based on the distinguished name. I also tried using the CanonicalName property, but it is a calculated property generated by Get-ADUser. So, CanonicalName cannot be used for a filter. The answer is to use Where-Object.

Get AD-User -Filter * | Where-Object {($_.enabled -eq $false) -and ($_.distinguishedname -notlike "*cn=users,dc=contoso,dc=com)}

**Note that a standard OU would start with ou= rather than cn=. Both the Users container and the Computers container are technically not OUs.

Query Recently Created Mailboxes or Users

You may at some point have a need to query recently created mailboxes. This script queries mailboxes created within the last seven days.

$date=(get-date).adddays(-7)

Get-Mailbox –Filter {WhenCreated –gt $date}

The logic of the script is this:

• Set the variable $date equal to the current date minus 7 days.
• Get a list of mailboxes with a WhenCreated attribute greater than the date 7 days ago

You can use the same basic structure for other objects such as Active Directory users by substituting the Get-ADUser cmdlet for the Get-Mailbox cmdlet.

$date=(get-date).adddays(-7)

Get-ADUser –Filter {WhenCreated –gt $date}

Update (Dec 2015):
The above syntax actually doesn't work. Not sure how I missed it when I first wrote the post. Today when I was writing a script using this syntax, it returned all mailboxes no matter what. So, the $date variable wasn't being properly evaluated. I'm leaving the above example so that people can see what syntax not to use.

Use the following syntax instead:

$date=(get-date).adddays(-7)

Get-Mailbox –Filter "WhenCreated –gt '$date'"

Apparently when building a filter with a variable, you need to enclose the whole filter in double quotes and the variable in single quotes. This syntax worked properly for me.