FoxDeploy.com

####################################################################
#     ----Name : Quest Switch Status
#     ---Author: Stephen Owen, 7.24.2014
#     Function : Use this tool to determine if a user account has switched or not, based on the account's Source targetAddress property
#     ---Usage : Get-SwitchedStatus <$username>
 
Function Get-SwitchedStatus {
<
    .Synopsis
       Use this tool to determine if a user account has switched or not, based on the account's Source targetAddress property
    .DESCRIPTION
       This tool connects to the Source (legacy) AD Domain and looks up the specified user object, returning the .targetAddress property
       connects to the target domain to move the user account to the correct OU
    .PARAMETER UserName
       &lt;Mandatory&gt; Specify the username to inquire, will bind to aliases like UserName, LogonName or SAMAccountName.  Accepts Pipeline input.
    .PARAMETER Service
       &lt;Optional&gt;  Specify the Active Directory Service to Query
    .PARAMETER SourceCredential
       &lt;Optional&gt;  Specify the Credentials to use to query the Source AD Infrastructure.  If omitted, this tool will also look for a Global:$Credential object, and attempt to use that.
    .SWITCH WriteWarning
        Provide detailed Warning information if a user is encountered without needed properties.
    .EXAMPLE
       Get-SwitchedStatus -UserName Stephen.Owen
       &gt; This tool will connect to the source, and grab the targetAddress property of the object &lt;Stephen.Owen&gt;.  If this contains *@source.qmm, the account is most likely unSwitched.
         If this value contains *@target.qmm, then the account is most likely Switched and the workstation can be migrated.  If this account does not have a mailbox, the workstation can be migrated.
    .EXAMPLE
       "Stephen.Owen","Mark.Wuerslin" | Get-SwitchedStatus
       &gt; Perform Get-SwitchedStatus on both Stephen.Owen, then Mark.Wuerslin
>
[CmdletBinding()]
param([Alias("UserName","LogonName","SAMAccountName")]
      [parameter(Mandatory=$True,ValueFromPipeline=$True,position=0)][string[]]$UserNames,
        [string]$service="amatldc01",
        [string]$SourceCredential,
        [switch]$WriteWarning)
 
      $obj=@()
      $Host.UI.RawUI.WindowTitle="---Get UserSwitchedStatus Tool"
      Write-Progress -Activity ("Checking for Quest Active Roles PSSnapIn...") -PercentComplete 25  -Status "Searching.."
            if (-not ((Get-PSSnapin).Name -contains "Quest.ActiveRoles.ADManagement")){
 
                try  {Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction Stop}
                catch{
                      #Write-host "[ERROR]" -ForegroundColor Red
                      Write-Warning "This tool depends on the Quest Active Roles tools to operate"
                      $DL = Read-Host "Download? Y/N"
                      IF ($DL -eq "Y"){
                        Start 'http://www.quest.com/quest_download_assets/individual_components/Quest_ActiveRolesManagementShellforActiveDirectoryx86_151.msi'
                        "Exiting..."
                        }
                        ELSE{"Exiting...";break}
 
                      BREAK
                      }
               finally{Write-Progress -Activity ("Checking for Quest Active Roles PSSnapIn...") -PercentComplete 100  -Status "Detected"
                       Start-Sleep -Milliseconds 150
                      }
            }
        ELSE{Write-Progress -Activity ("Checking for Quest Active Roles PSSnapIn...") -PercentComplete 100   -Status "Detected"
             start-sleep -Milliseconds 150
            }
            if (-not($SourceCredential)){
                if (-not($credential)){
                    $credential= Get-Credential -Message "Enter credentials which can browse AD in Source and Target"}
                ELSE{Write-Progress -Activity ("Connecting to source...") -PercentComplete 25  -Status "Cached credential detected, continuing..."
                    }
                }
                ELSE{
                $credential = $SourceCredential
                }
        Write-host ("Detected: " + $UserNames.Count + " objects")
 
           #Connect to source
        start-sleep -Milliseconds 150
 
        Write-Progress -Activity ("Connecting to source...") -PercentComplete 50  -Status "Connecting..."
        try  {Connect-QADService $service -Credential $credential -ErrorAction Stop  | Out-Null}
        Catch{
              Write-warning "Error ocurred connecting to AMATLDC01 to pull source OU paths, check credentials..."
              BREAK
              }
 
      finally{Write-Progress -Activity ("Connecting to source...") -PercentComplete 100  -Status "Connected!"
              Start-Sleep -Milliseconds 150
              }
 
    forEach ($CurrentObject in $UserNames){
        Try  {start-sleep -Milliseconds 100
              Write-Progress -Activity ("Looking up $CurrentObject on $service") -PercentComplete 75 -Status "Gathering Info..."
              $user = get-qaduser $CurrentObject -DontUseDefaultIncludedProperties `
                -IncludedProperties targetAddress `
                -Service $service `
                -ConnectionAccount $credential.UserName `
                -ConnectionPassword $credential.Password `
                -ErrorAction Stop
              Write-Debug "Troubleshoot `$user"}
 
       catch {Write-Warning ("Unable to perform Get-QADUser for object $CurrentObject from service: $service `n check `$CurrentObject")
             }
             Write-Debug "Troubleshoot `$user"
 
        if ($user){
            if (-not($user.targetAddress)){
                if ($WriteWarning){
                    Write-Warning ("Unable to find targetAddress: $CurrentObject has NOT Switched")
                    }
 
                  }
            }
 
        if ($user.targetAddress -like "*@target.qmm"){
            $obj += [pscustomobject]@{UserName=$user;Status="Switched"}
            Write-Progress -Activity ("Looking up $CurrentObject on $service") -PercentComplete 100 -Status "Gathered!"
            Start-Sleep -Milliseconds 150
 
            CONTINUE
            }
        if ($user.Email){
            $obj += [pscustomobject]@{UserName=$user;Status="Not Switched"}
            Write-Progress -Activity ("Looking up $CurrentObject on $service") -PercentComplete 100 -Status "Gathered!"
            Start-Sleep -Milliseconds 150
            }
        ELSE{
            $obj += [pscustomobject]@{UserName=$user;Status="No E-mail"}
            Write-Progress -Activity ("Looking up $CurrentObject on $service") -PercentComplete 100 -Status "Gathered!"
            Start-Sleep -Milliseconds 150
            }
 
        }
 
        $obj | ft
}

Function Fix-MailboxPerms { $ServiceQMMAccount = "foxdeploy\\\_svcQMM"

param(\[Alias("SamAccountName","DisplayName")\]\[Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)\]$UserName)

#if $UserName came from MailboxStatistics, give us the size if ($username.TotalitemSize){Write-Host (($UserName.TotalItemSize).Value.ToMB() ) "MB Mbx" } $username| get-mailbox | % { $user = $\_; "Setting AD Rights for object...$ServiceQMMAccount" $user | Add-ADPermission -User $ServiceQMMAccount -AccessRights GenericAll -ExtendedRights Receive-As,Send-As

"Setting Mailbox Permissions...$ServiceQMMAccount" $user | Add-MailboxPermission -User $ServiceQMMAccount -AccessRights FullAccess

}

} 

####################################################################
#     ----Name : FoxDeploy ACL Fixing tool
#     ---Author: Stephen Owen, $company, 7.16.2014
#     Function : Post User-Migration, use this tool to add users back to a share with their own name
#     ---Notes : This tool can be used to restore appropriate Read-level of the $company account to a users share
#                 needed after a particularly overzealous application of permissions stripped Source Perms from certain shares
Function Fix-ACLs{
<#
    .Synopsis
       Use this tool Post User-Migration, to give a user permission to a share, where the user's name matches the folder
    .DESCRIPTION
       This tool receives a file share, then enumerates one level for directory objects. As the directories expected should be in the format of “userfirstname.userlastname”,
       it is trivial to determine the account which should have ownership of this share.
    .PARAMETER FileServers
       The path to the fileserver to process
    .PARAMETER ADServer
       The AD Server to use to obtain the user object for permissions application
    .PARAMETER DomainA
        The Short Name of the original Domain
    .EXAMPLE
       Fix-ACLs -FileServers "\\aumjfp01\users" -ADServer "localserver"
       > This will return all of the directories under \\aumjfp01\users.  The rest of the example will assume the current user in question is OLDDOMAIN\Jimmy.John.
       > A Quest AD lookup is  performed to verify a valid user exists for the name of the folder (\\aumjfp01\“jimmy.john”).
       >  In this case an AD lookup is performed for OLDDomain\jimmy.john
       > If valid, give this user permission to the folder, if not, add user name to $badUsers, which is reported at the end of the function
    .NOTES
      Sources: http://blog.netnerds.net/2007/07/powershell-set-acl-does-not-appear-to-work/
               http://chrisfederico.wordpress.com/2008/02/01/setting-acl-on-a-file-or-directory-in-powershell/
 
#>
[CmdletBinding()]
 Param(
    [Parameter(Mandatory=$true,Position=0,HelpMessage="Please specify the file shares to be processed, in the format \\server\share")]
            [string[]]$FileServers,
            [string]$ADServer = "amatldc01",
            [string]$DomainA = "OldDomain"
 
            )
 
    if (-not($credential)){
                $credential= Get-Credential -Message "Enter credentials which can be used to lookup a user account in AD on $ADServer"
                }
                ELSE{"Cached credential detected, continuing..."
                }
 
    Write-host "Checking for Quest Active Roles PSSnapIn..." -ForegroundColor White -NoNewline
 
        try  {Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction Stop}
        catch{
                Write-host "[ERROR]" -ForegroundColor Red
                Write-Warning "This tool depends on the Quest Active Roles tools to operate"
                $DL = Read-Host "Download? Y/N"
                IF ($DL -eq "Y"){
                Start 'http://www.quest.com/quest_download_assets/individual_components/Quest_ActiveRolesManagementShellforActiveDirectoryx64_151.msi'
                "Exiting..."
                }
                ELSE{"Exiting...";break}
 
                BREAK
                }
 
    Write-host "[OKAY]" -ForegroundColor Green 
 
    #Connect to source
    Write-host "Connecting to Source..." -NoNewline
        try  {Connect-QADService $ADServer -Credential $credential -ErrorAction Stop | Out-Null}
        Catch{
                Write-warning "Error ocurred connecting to $ADServer to pull source OU paths, check credentials..."
                BREAK
                }
        Write-host "[OKAY]" -ForegroundColor Green 
 
    $badUsers = @()
    ForEach ($FileServer in $FileServers){
 
        try  {$UserDirs = Get-ChildItem $FileServer -ErrorAction Stop | Where-Object PSIsContainer -eq $true}
        catch{Write-Warning "Error occurred connecting to $FileServer, check spelling and if valid path"
              BREAK
              }
        $i = 0 
 
        ForEach ($userDir in $UserDirs){
            Write-Progress -Activity ("Setting permission for $userDir of $FileServer") -PercentComplete (($i/($UserDirs.count)*100 ))
            #$userDir
            $acl = Get-Acl $userDir.FullName
            $DomainA_ADAccount = ($DomainA + "\" + $userDir.Name)
            "Verifying $DomainA_ADAccount is valid user"
 
            if (Get-QADUser $DomainA_ADAccount){
                Write-Host "User good, setting permissions..." -NoNewline
                    $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"
                    $propagation = [system.security.accesscontrol.PropagationFlags]"None"
                    $permission = "$DomainA_ADAccount","FullControl",$inherit,$propagation,"Allow"
                    #$permission
                    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
                    $acl.SetAccessRule($accessRule) | Out-Null
 
                    Write-Verbose  "About to set $acl"
                    try   {#In a future version, this should create a job and then check for status while writing out progress
                           Set-Acl -path $userDir.FullName -AclObject $acl}
                    catch {
                           }
 
                Write-Host "[OKAY]" -ForegroundColor GREEN
 
                }
                ELSE
                {
                write-error "Not a valid user account"
                $badUsers += $DomainA_ADAccount
                }
 
            "User Completed"
            $i++
            #End of this userDir
            }
    #End of this FileServer
    }
#End of function
"The following user accounts were not found during an AD lookup, please investigate"
return $badUsers}

Write-Host "Ok output" import-csv .\\Desktop\\Ampcs.csv | select -expand Name | ForEach-Object { $name = $\_ Get-WmiObject -Class Win32\_ComputerSystem -ComputerName $name | select @{Name="RUMName";Expression={$name} },@{Name="ReplyName";Expression={$\_.Name} },@{Name="Domain";Expression={$\_.Domain} } }

Write-Host "Better output" import-csv .\\Desktop\\Ampcs.csv | select -expand Name | ForEach-Object { $name = $\_ try {$a=Get-WmiObject -Class Win32\_ComputerSystem -ErrorAction Stop -ComputerName $name} catch{$a= \[pscustomobject\]@{Name=$name;Domain="Access Denied"}} \[pscustomobject\]@{RUM\_Name=$name;ReplyName=$a.Name;Domain=$a.Domain} }