I tried to run Read-ADRecoveryInformation but hit with this infamous error message.
I tried the following cmdlets to look for the module but I could not find it.
Get-command -Module TrustedPlatformModule
Get-Command -Module Bitlocker
Does anyone know what module I should import in order to allow me to run this cmdlet?
Any feedback would be highly appreciated!
In my Azure trial environment, I have successfully run HCW (Hybrid Config Wizard) and migrated a mailbox from On-Premise Exchange 2016 to Office 365.
I was able to use Outlook 365 to log onto the just migrated O365 mailbox and send emails out. However, I was not able to receive any emails in the O365 mailbox. I saw that the emails are all stuck in the queue viewer of my On-Premise Exchange Server.
Currently, the MX record is still pointing the On-Premise Exchange Server and so incoming emails to O365 mailbox will need to rely on the Send Connector called "Outbound to Office 365" in On-Premise Exchange Server.
Here is what I found in the "Outbound to Office 365" Send Connector. I saw that it was using the MX record option which I think is incorrect.
So, I chose the Smart Hosts option in the screenprint below.
However, it still did not fix the problem.
Any thoughts?
I have a scenario where 2x DCs have ADMX templates pointing to their local computer. However, I found out that 1 ADMX templates are really old like 2013 while the other ADMX templates are very new like 2017.
So, if I create a new GPO using the later ADMX templates (using a function which is only available in the new template), what will happen when the GPO syncs to the other DC with the older templates? Will the GPO run properly on the client PCs?
Thanks in advance.
We have company A AD forest (forest domain a.com) and company B AD forest (forest domain b.com) linked by inter-forest trusts and each with On-Premises Exchange 2010 SP3.
We plan to migrate both Exchange Server to a single Office 365 tenant in an hybrid environment using multi-forest Azure AD Connect to synchronise both AD into separate directories in Azure.
a.com is using [email protected] as its UPN.
b.com is using [email protected] as its UPN.
Now because the 2 organisation is sort of merging its operations, we are exploring the possibility that both a.com and b.com staff to log on using the same UPN c.com like [email protected] as their UPN instead.
I know I can add c.om in a.com and b.com forest as a new UPN no problem but when it comes to AADC, it is a different arena.
When running AADC, I am not sure if it can go past this screen?
Is this supported at all?
Thanks in advance.
I am planning and preparing to migrate 2x Active Directory forests (example.com and example.net) to Azure Active Directory.
I followed the Microsoft doc to use Idfix to clean up each of the AD forests. Initially, I thought I could use Idfix to clean up both forests at the same time, but it appears that Idfix cannot access 2x forests while it can handle 2x domains of the same forest.
Because example.com and example.net are in the process of merging, I have the following scenario of a user object John Doe.
In example.com,
There is also a contact of his account in example.net
In example.net
When I ran Idfix individually in example.com and example.net, it does not generate error for this account. However, when I synchronise example.com and example.net to AAD, will this work?
I know for this scenario:
There are 2x UPNs but the names are unique
There are 3x MailNickNames but they are unique too.
However, the email address will clash.
I think when we eventually merge and migrate to AAD, for this scenario, only 1x AD user object is needed and that is UPN [email protected]
How should I approach the cleanup in order to be ready for the eventual synchronisation?
In preparation for Office 365, I have downloaded Idfix to run against my Active Directory to clean up any duplicate or incorrect attributes.
Because I plan to migrate 2x AD forest (a.com and b.com with interforest trust and selective authentication NOT forest-wide authentication) into 1x single Azure tenant, I thought I will need to run Idfix against the 2x forest at the same time so that it could find out if there are any conflicts. However, I found out so far that Idfix cannot handle multi-forest (while I think multi-domain with the same forest can).
Can someone who have gone through multi-forest migration to Azure give me some feedback?
And if I really cannot use Idfix to clean up the objects before migration, is there a way to do it manually?
Much appreciated.
Thanks.
This is probably a dumb question to ask.
1) When we do the Azure Active Directory Connect to synchronise on-premises Active Directory, can we just select a particular OU which stores all active staff instead of the whole forest?
Apart from the user objects, I think other AD objects are synchronised as well.
Can we define which OUs to synchronise?
2) LIkewise, when we run Hybrid Config Wizard, can we just select to migrate a selected list of mailboxes but not all mailboxes?
Likewise for distribution groups, can we just select a certain number to migrate?
Thanks in advance.
I am planning to migrate our Exchange 2010 SP3 server to O365 using Hybrid environment. We also use Sophos Email Appliance which is a box sitting inhouse.
Currently, the mail flows like this.
Inbound from Internet
Internet --> Sophos Email Appliance --> Edge Server --> Mail Server
Outbound to Internet
Mail Server --> Edge Server --> Internet
I want to retain Sophos Email Appliance and at the same time don't want to break the Microsoft rule that I should not be putting anything between O365 and On-Premises Exchange and also referring to the following article: https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-on-office-365-and-on-prem
I come up with:
Inbound from Internet
Internet --> Sophos Email Appliance --> O365 --> Edge Server --> Mail Server
(I must admit the routing is a bit inefficient as incoming mail has to be sent back to the internet to reach O365)
Outbound to Internet (no change)
Mail Server --> Edge Server --> Internet
Will this work?
Thanks in advance.
I am not sure if this is the right place to ask this question.
I was trying to apply the latest KB4536989 patch to my Exchange 2010 SP3 server which has hub transport, mail server and edge transport in one place.
When I tried to apply it, it came back with the following error.
I reran it again by using "Run as Admin" but the same result.
Does anyone encounter the same error?
I have a normal domain user account called john1 in domain A.
Recently, our company merged with another company (domain B) and we set up a interforest trust between the 2x forest using selective authentication instead of forest-wide authentication.
At the same time, I was issued a domain user account john2 in domain B.
On a domain-joined machine in domain A, I logged on as john1 (my domain A account) and was able to run Get-ADUser against domain A users successfully.
On a domain-joined machine in domain B, I logged on as john2 (my domain B account) and was able to run Get-ADUser against domain B users successfully.
However, on a domain-joined machine in domain A, I opened up Powershell ISE (not Run as) and tried to run Get-ADUser command against domain B users but failed. Here is what I tried:
get-aduser -Server domainB-DC.company.com -Identity alex.hall -Credential "domainB\john2"
get-aduser : Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.
At line:1 char:1
+ get-aduser -Server domainB-DC.company.com -Identity alex.hall -Credent ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (alex.hall:ADUser) [Get-ADUser], ADServerDownException
+ FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADUser
The same error message happened when on a domain-joined machine in domain A, I ran Run-As Powershell ISE using "domainB\john2" and issued get-aduser -Server domainB-DC.company.com -Identity alex.hall
I confirm that domainB-DC.company.com is up and running and ADWS is running as well.
On the other hand, I was able to, on domain-joined machine in doman A, run ADUC (Active Directory Users and Computers) to view domain B Active Directory by means of command-prompt with the following command: C:\WINDOWS\system32\runas.exe /u:domainB\john2 /netonly "mmc %windir%\system32\dsa.msc /domain="domainB"
I asked the firewall guy to trace if there is any traffic from my domain-joined domain A machine to domainB-DC.company.com when running the Get-ADUser cmdlet and surprisingly he said he saw no traffic.
Does anyone encounter such problems?
We have the following scenario:
Company A
Forest = CompanyA.com
Domain = CompanyA
Email Domain CompanyAX.com
Users' UPN = CompanyAx.com
Company B
Forest = CompanyB.com
Domain = Corporate
Email Domain = CompanyB.com
Users' UPN = CompanyB.com
There is a inter-forest trust between the 2x forest already.
We plan to install 1x AAD Connect to link up the 2x Forest.
The 1x AAD Connect will link up to 1x O365 tenant.
Email domain of the O365 tenant will be CompanyC.com
I think the above is doable.
However, I couldn't understand once the 2x forest sync up to Azure AD, what will the users use to log on to O365?
Can they still use their original UPN like [email protected] and [email protected]?
Or all of them need to use [email protected]?
Hope someone can enlighten me. Thanks heap!
We have the following environment:
Company A Forest companya.com Exchange 2010 SP3 (SMTP domain companya.com)
Company B Forest companyx.com Exchange 2010 SP3 (SMTP domain companyb.com)
I am thinking of using multi-forest hybrid migration to 1x O365 tenant.
However, I saw somewhere on the Internet that Exchange 2010 does not seem to be supported in this scenario.
Can someone please confirm this for me?
Thanks in advance.
My company (@abc.com) is in the process of merging its operation with another one (@xyz.com) and both are Microsoft shops with Exchange 2010 SP3. The 2 networks are linked by an IPSEC tunnel.
We set up DNS conditional forwarding on each side. In @abc.com network, we conditionally forward all DNS @xyz.com hostname request to @xyz.com internal DNS Server In @xyz.com network, we conditionally forward all DNS @abc.com hostname request to @abc.com internal DNS Server
We then allow TCP/UDP 53 to flow through the IPSEC tunnel.
After that, we found out that in @abc.com, when we try to send email to [email protected], the emails are all stuck in the queue viewer of the Edge server with no error code.
1) In @abc.com, I went to the Edge server, in EMC / Edge Transport / Properties / External DNS Lookups, the DNS servers are all valid external DNS servers. I did NSLOOKUP on the Edge server and was able to resolve external @xyz.com nicely.
2) I turned on verbose for Protocol Logging of the Send Connectors but the SMTPSend file does not record anything stuck in the queue.
3) I have a feeling that the Edge Server disregards the External DNS lookups and go straight to the conditional forwarder to get this the internal MX record of @xyz.com instead. Because internally @xyz does not have any MX record and so it was therefore stuck in the queue.
Any thoughts?
I am confused as to how many TXT records I require for Exchange 2010 Federation.
If my organisation uses @abc.com as the primary SMTP address and @xyz.com as an alias, do I create the following TXT records using individual proof values?
1) exchangedelegation.abc.com
2) abc.com
3) xyz.com
Do I need the exchangedelegation.abc.com TXT record at all? The newer Microsoft documentation does not seem to mention this.
Any thoughts?
We are merging 2x companies @abc.com and @xyz.com. The networks are not interconnected at this stage. We want to achieve all staff seeing one single GAL and be able to book meetings between the 2x office.
Both companies plan to migrate to O365 as separate tenants. Does O365 federation allow us to achieve what I want (i.e. combined GAL)?
Before moving to O365, can forming inter-forest trust between the 2x active directory allow us to have a combined GAL?
Any suggestion will be greatly appreciated!
My present environment is such that the AD domain name is abc.com while the Exchange 2010 email address domain names are @abc.com with @xyz.com as the reply to address. We want to use xyz.com and @xyz.com in the long term.
We want to migrate to O365 using hybrid deployment, should we first migrate AD domain to xyz.com first or is there a shortcut?
Any suggestions will be much appreciated!
On the remote machine, I copied the .exe file (from my source machine using Copy-Item command) to the temp folder first which was successful. After that, I ran the following Powershell script on my machine, it ran quite fast but no message was displayed and the software was not installed on the remote machine.
$computerName = "LAPTOP"
Invoke-Command -ComputerName $computerName -ScriptBlock { C:\Temp\Cyberduck-Installer-6.9.4.30164.exe /silent}
On the remote machine, winRM services was started. What did I do wrong?
I understand GPO can be used to disable or enable "Enable Javascript" option in Acrobat Reader. However, is there a way we can grey it out so that user cannot fiddle with it? Thanks in advance.
Recently, I found a new job which uses O365 in a hybrid environment. Just to explain a bit, the new environment has On-premises Active Directory plus an instance of On-premises Exchange Server (which actually has no user mailboxes inside). The On-premises Active Directory is synced to an Azure AD in the cloud and all user mailboxes are in Exchange Online in O365.
Currently, for day-to-day administration like updating security groups and distribution groups, I basically update the On-premises AD which will synchronize to O365. If I attempt to update them in Office 365 portal, it will display an error saying that I should go to update it on On-premises AD. The security groups are used by local File Server as well as distribution list in sending emails. However, my manager suddenly announced today he planned to make changes so that we have to go to Office 365 Portal to do the update instead of On-premises AD.
My questions are: 1) What config changes do we need to do in Office 365 in order to achieve what he wants? 2) What advantage do we get by updating in Office 365 portal instead of On-premises AD?
I have been happily using Powershell to automate a lot of admin task in an Exchange 2010 On-premises environment.
Recently, I found a new job which uses O365 in a hybrid environment. Just to explain a bit, the new environment has On-premises Active Directory plus an instance of On-premises Exchange Server (which actually has no user mailboxes inside). The On-premises Active Directory is synced to an Azure AD in the cloud and all user mailboxes are in Exchange Online in O365.
I tried to modify my Powershell script (based on On-premises Exchange 2010) to run in this new environment. I added commands to establish a MFA Powershell session to Exchange Online. Then, except replacing some On-premises Powershell commands with new cloud Powershell commands, I was able to "get-" most of the information I want.
However, when I tried to run the same Powershell commmands to update mailbox (for example to hide a mailbox), I encountered an error message saying that you cannot do so and must update via the On-premise instance. The funny thing is when I run the same old script to "add-mailboxfolderpermission" or "remove-mailboxfolderpermission", I was able to so.
Does anyone know why it is like that? If I cannot use "set-mailbox" to hide the mailbox, what commands should I use to hide the mailbox?