[Exchange Online] Remove cancelled Outlook meetings using PowerShell and EWS!

Essay_Start

Actually it is 23:13 CEST, but still!

Some time ago I have published a script to remove cancelled calendar meetings from Exchange OnPremise (I have tested that on Exchange 2010).You can find this script here:

https://paweljarosz.wordpress.com/2016/05/04/remove-cancelled-meetings-using-powershell-and-ews/

I am currently at the end of the migration to Exchange Online from Exchange 2010 environment. Few days ago I had a call telling me that seems that the cancelled meetings are not being removed from room calendars as they supposed to be.

Yup, I forgot to rewrite the script…

TimeToPanic

Continue reading “[Exchange Online] Remove cancelled Outlook meetings using PowerShell and EWS!”

Advertisements

Match and Like shows that string has “$”,”*” and “?” while it doesn’t.

“Microsoft Office 365: Exchange Online Implementation and Migration” tells that we need to check following users’ attributes in regards to occurrence special characters:

    sAMAccountName: Invalid character examples are !, #, $, %, ^, &, {, }, \, /, `, ~, “, [, ], :, @, <, >, +, =, ;, ?, and *
    displayName: Invalid character examples are ?, @, and +
mail: Invalid character examples are [, !, #, $, %, &, *, +, \, /, =, ?, ^, `, {, }, and ]
    mailNickname: Invalid character examples are “, \, /, [, ], :, >, <, ;, and spaces
    proxyAddresses: Invalid character examples are [, !, #, $, %, &, *, +, \, /, =, ?, ^, `, {, }, and ]
userPrincipalName: Invalid character examples are }, {, #, ‘, *, +, ), (, >, <, \, /, =, ?, and `

Well, you agree that nothing easier. So I wrote a simple script that was checking for it, but to my surprise, I noticed that in 3 of the attributes I was getting “$”, “*” and “?” characters. But attributes definitely didn’t have that value, so I replaced “-match” with “-like” in the script.

Well, it was better but still not brill. I  was still getting $ and *. But the ? char was not being reported. I started to think what the hell is wrong felling a bit like:

ezgif.com-crop

I was using “-match” and “-like” all the time in scripts, I was shocked it was messing around with me. So I started to check if there are any other way to compare if char exist in a string. And there it was! Totally forgot about “contains” operator/method!

Changed all my “matches” and “likes” to “-contains” and taaaddaaam 🙂 All worked like a charm!

Answer to question why it might have not worked can be found for example under here:

http://www.tjrobinson.net/?p=109

Tom is telling there that:

-contains is designed to work on arrays, not strings (referred to as a containment operator)
-match looks for a match inside a string and supports regexes
–like looks for a match inside a string and supports wildcards

And here is the thing, my solution was about to check if string, ex. “mail” contains: one of [, !, #, $, %, &, *, +, \, /, =, ?, ^, `, {, }, ] . Syntax was:

$Characters_To_Check = @(“[“, “!”, “#”,”$”, “%”, “&”, “*”, “+”, “\”, “/”, “=”, “?”, “^”, “`”, “{“, “}”, “]”)

$String_To_Check = “$User.mail”

Foreach ($Character in $Characters_To_Check ) {

if ($String_To_Check -match $Character) {Do things}

}

because “match” and “like” operators support regex and wildcards, they were treating these special characters as these. Only contains was working properly in that particular case.

 

Repairing content index on database without DAG.

Repairing Content Index on DAG server can be easily done with Update-MailboxDatabaseCopy with switch -CatalogOnly.

But how to repair Content Index when there is no other DB copy?

Well, here is the great article:

https://theucguy.net/fix-corrupted-content-index-catalog-of-a-mailbox-database-with-single-copy/

On Exchange 2007 and Exchange 2010 there is ResetSearchIndex.ps1 script, which is placed in $exscript folder.

On Exchange 2013 there is no such script, so the only solution is to simply recreate the CI folder. To rename it/remove it, 2 services Microsoft Exchange Search and Microsoft Exchange Search Host Controller would need to be stopped.

IIS iisreset, recycle, refresh and restart – what are the differences?

Have you ever wondered what is the difference between iisreset, recycle, refresh and restart?

 

Here is great post that answers all the questions:

http://serverfault.com/questions/247425/what-is-the-difference-between-iisreset-recycle-refresh-and-restart

 

Vlad Mucescu explains that:

“As pointed out, iisreset will stop and start the World Wide Web Publishing Service. This, of course, applies to all of your application pools. I’m sure you noticed a process being created for each application pool. This process will handle requests for all websites associated with it. When you recycle an application pool, IIS will create a new process (keeping the old one) to serve requests. Then it tries to move all requests on the new process. After a timeout the old process will be killed automaticaly. You usualy recycle your application pool to get rid of leaked memory (you might have a problem in your application if this needs to be a regular operation, even though it is recommended to have a scheduled recycle). As for restarting a website, it just stops and restarts serving requests for that particular website. It will continue to serve other websites on the same app pool with no interruptions.

If you have a session oriented application, all of the above will cause loss of session objects.

Refreshing a websites has no effect on the service/process/website and is meerly a UI command to refresh the treeview (maybe you added a directory you don’t see in the management console).”

Exchange Message Tracking – finding out if message was recalled properly.

That kind of situations really tend to happen when you need them at least.

Friday evening, you are about to go home from the late shift you have just covered, you have maintained your infrastructure today having in mind that there will be FINALLY a free weekend without any work and…

BAM!

surprise2

One user is urgently asking for urgent favour, he sent urgent email to urgent people about urgent things, but it was so fu*king urgent he made a mistake and urgently recalled it and now you urgently need to find if that recall was successful.

First thing you think. Remember – you were just about to leave the office:

kill_madafakaLater you try the easiest solution, you ask him to check his fu*king mailbox for an recalling email and he says: “Do not know how to do it, maybe deleted it, it was so quick, all that technology! Can you help urgently?!”

So after that kind of dialogue on the phone:

59495275

Normally when user is recalling a message he/she is getting en email saying that message was recalled successfully or not.

For SUCCESS:

recall_success

For FAILURE:

recall_failed

But what happens when user for example sends an email as a Distribution List? The recall confirmation will not  come to any mailbox. And here Message Tracking comes with help!

When user recalls the message there are two messages in the Message Tracking logs: NOTIFYMAPI and SUBMIT:

Only the following columns were included: “timestamp, eventid, sender, messagesubject, recip*,sourcecontext”

Timestamp       : 10/2/2015 3:14:25 PM
EventId         : NOTIFYMAPI
Sender          :
MessageSubject  :
Recipients      : {}
RecipientStatus : {}
RecipientCount  :
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51849, MessageClass:IPM.Outlook.Recall,
CreationTime:2015-10-02T22:14:24.561Z, ClientType:MOMT

Timestamp       : 10/2/2015 3:14:26 PM
EventId         : SUBMIT
Sender          : testuser1@zaic12.local
MessageSubject  : Recall: recall myself 22
Recipients      : {testuser1@zaic12.local}
RecipientStatus : {}
RecipientCount  : 1
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51849, MessageClass:IPM.Outlook.Recall,
CreationTime:2015-10-02T22:14:24.561Z, ClientType:MOMT

Please note the message class of the entry, which is IPM.Outlook.Recall.

recall_tryWe also see that it has been send to one recipient, and we have address of that recipient.

You would tell that we might as well can look on the subject of the message to find the right one. Thing is that is nome companies subjects are hidden and all you would see in the MessageSubject attribute would be “[undisclosed]“.

Later, if we have successful recall we will see following entry:

Timestamp       : 10/2/2015 3:14:36 PM
EventId         : NOTIFYMAPI
Sender          :
MessageSubject  :
Recipients      : {}
RecipientStatus : {}
RecipientCount  :
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51868, MessageClass:IPM.Recall.Report.Success,
                  CreationTime:2015-10-02T22:14:35.815Z, ClientType:MOMT

Timestamp       : 10/2/2015 3:14:37 PM
EventId         : SUBMIT
Sender          : testuser1@zaic12.local
MessageSubject  : Message Recall Success: recall myself 22
Recipients      : {testuser1@zaic12.local}
RecipientStatus : {}
RecipientCount  : 1
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51868, MessageClass:IPM.Recall.Report.Success,
                  CreationTime:2015-10-02T22:14:35.815Z, ClientType:MOMT

Also please note the class name IPM.Recall.Report.Success.

recall_suc

Of course in case if someone saw the message already opening it on some active sync device for example, we might get failure in the log:

Timestamp       : 10/2/2015 3:06:02 PM
EventId         : NOTIFYMAPI
Sender          :
MessageSubject  :
Recipients      : {}
RecipientStatus : {}
RecipientCount  :
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51731, MessageClass:IPM.Recall.Report.Failure,
                  CreationTime:2015-10-02T22:06:02.786Z, ClientType:MOMT

Timestamp       : 10/2/2015 3:06:03 PM
EventId         : SUBMIT
Sender          : testuser1@zaic12.local
MessageSubject  : Message Recall Failure: test recall for myself
Recipients      : {testuser1@zaic12.local}
RecipientStatus : {}
RecipientCount  : 1
SourceContext   : MDB:1ac8faa2-280e-47a3-ae55-1b4cb0205c91, Mailbox:891984d2-0598-4e25-9d92-55058ec2daf2, Event:51731, MessageClass:IPM.Recall.Report.Failure,
                  CreationTime:2015-10-02T22:06:02.786Z, ClientType:MOMT

Message class here would be: IPM.Recall.Report.Failure

recall_fail

So we have all needed information in logs including most important if recall was successful, but also info about recipients, number of them, subject, etc. in other words, all we need to help poor user in establishing if his email was properly recalled.

There is just one more situation that might happen – the sender won’t get any information about recall at all. That might be caused by two situations:

  1. recipient (or his delegate – see the link at the end for nice MS KB about that) most probably has unchecked the “Automatically process meetings and responses to meetings requests and pools” option in his Outlook.

recall2

2. Recipient closed his Outlook when leaving home and haven’t turned it on yet.

Important to add is – because message recall feature is an Outlook feature it fully relies in Outlook sniffer mechanism.

To check if recipient indeed has some recall messages in his inbox Search-Mailbox cmdlet comes with help:

Search-Mailbox testuser1 -TargetMailbox administrator -TargetFolder Search -LogOnly -LogLevel full -SearchQuery {subject:”recall” AND received:today}

That will result in an CVS file in which we can see:

recall3

Well and indeed, when we log in to the mailbox via OWA, we see there are 3 recall messages pending:

recall1

If user indeed had unchecked the “Automatically process meetings and responses to meetings requests and pools” option, and we opened those messages in recipients Outlook – by clicking on the small arrow just expanding the thread or by clicking on the thread itself – we will see magic happening as message would be immediately removed on our eyes.

On above example we are looking at the message from OWA – hence recall function will not work. And here is the thing –  although we send a recall for a message recipient, he will be able to see it using ActiveSync, Good For Enterprise, BlackBerry or OWA anyway.

And here is a nice link with message classes (might be useful):

https://msdn.microsoft.com/en-us/library/office/ff861573.aspx

And few interesting words about Outlook sniffer:

https://support.microsoft.com/en-us/kb/2699725

https://support.microsoft.com/en-us/kb/2699728

Testing ActiveSync (EAS) using emulation on AVD Manager.

Recently I was reading about ActiveSync and policies for Exchange 2013, and I was wondering how to test it in my lab environment. Just one search away I found that great post:

http://exchangeserverpro.com/exchange-activesync-virtual-android-device/

After installing JDK and AVD Manager I was able to emulate Android device in my lab.

I just would like to highlight some things over here, when going to that website:

http://developer.android.com/sdk/index.html

DO NOT CLICK on the “Download Android Studio” button:

avd_1

That will download around 1,1GB on data, and installation would take another 3 GB. Later it will need some additional space for creating emulated android device. So  overall it took  around 4GB of space and was still telling me about too less space 🙂

So the link you would need to click is a bit further:

avd_2Firstly, we need to install Java SDK (but different from the version we would need to install full version of Android Studio), here is the link I used:

http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

Names of downloaded files should be similar to those:

avd_3After successful installation of AVD Manager we need to go with other steps that Paul described (first link in this post). And here is the final effect:

avd_4

A test message that has been send out using my private Sony Xperia L, and was received by other test user on a emulated Android device!

Isn’t that cool!!! 😀

avd_5

Now we can test all of the EAS policies not harming our private device.