Larold's questions

I commonly need to run a specific screen session with 9-10 windows, most of which need to run either an interactive command, or simply a setup-type of command.

I do this via screen -c <config-that-specifies-ttys-and-commands>

The pseudo-code for my tty / command management looks like this:

screen -t foo_title <interactive_cmd_to_start_automatically>
screen -t bar_title <a_different_cmd_to_launchh>
... etc ...

The problem I am having is that, periodically, I need to stop these interactive commands, DROPPING TO A SHELL IN THE SAME TTY, doing some troubleshooting, then manually re-starting the command. Screen will have no problems running these commands, but once they complete, screen kills off that window / tty. (To try it out, just specify something like 'top' as the command to run. When you exit top, list your screen windows with Ctrl-A ". You'll see your top tty has totally vanished)

So my questions, in order: - Does screen support a native way to get your normal shell prompt after the command finishes, in the same TTY? - If so, how? - If not (which I think is the case), what's the cleanest way to invoke a shell, from the screen config, after said command finishes so that you still get the TTY and a shell prompt?

Thanks!!!

[Note: These needs are external demands from the client and can/will not change. Please keep that in mind when answering]

We have a small overworked 2.5 man Windows admin team (2 vets, 1 junior). As an I.T. infrastructure group, we have been asked to implement the following:

• We must set up mailing lists (dist. groups) for use in Outlook.
• All mailing lists will include internal AD Users and external mail contacts
• For all dist. groups, Reply-All for both internal users and external contacts should always fail, no exceptions. (A bounce is acceptable)
• SECURITY: If a person is not allowed to send to a distribution group, then:
  • It must be 100.000% guaranteed they are NEVER, IN ANY CONCEIVABLE WAY, allowed to discover the existence of the group, even if they are an internal AD user.
  • It must be 100.000% guaranteed they are NEVER, IN ANY CONCEIVABLE WAY, able to dig and determine what individual members are in a group, even if they are an internal AD user.

• SECURITY: If a person IS allowed to send to a security-enabled dist. group, then:

  • They must be able to see that group in a specific address book (we've done that already)
  • They must easily be able to determine who is in the group

• IN NO WAY, SHAPE, OR FORM, IS "USER-TRAINING" ALLOWED. People sending to these lists are extremely non-tech-savvy, extremely powerful within the organization politically, and will not change their habits in any way. This means we can't suggest they use the 'Bcc:' field. It also means we can't suggest "Don't click the '+' button to expand the group or you lose security."

Reminder - you can't change the facts above.

On a scale of 1 to 10, with 1 being 'Trivial' and 10 being 'A factual impossibility', where does this project rate? We have a manager that is cracking the whip, not understanding that the requirements, as stated precisely above, are pretty conflicting. Even given a reasonable amount of time, I don't think this can be done without a substantial inconvenience and risk to the overall AD infrastructure. (Extreme security permissions so users can't go digging through objects.)

I'm not so concerned with the guts and tech. details of how you'd implement such a thing, but feel free to share them. I'm more curious the feasibility of the above and how long it would take, IF it's even doable.

As you consider your answer, please keep the strict requirements in mind. We have triple-confirmed they can not bend, by even one word. For example, "You could use a custom mail client." Wrong. Outlook is the required client. "You could just hide the groups". Wrong. Someone in AD can still go digging and find them. Etc. etc.

THANK YOU!!! I'm a Unix guy who's heavily involved because I've gotten pretty decent with Powershell and have about 1,000 lines of code to help build and maintain these (thousands of) contacts and groups.

EDIT: I know there are a lot of good answers on this topic, but please keep your thoughts coming. I need as much ammunition as possible to take back to the business. Five people saying this is next to impossible is great. Ten people saying it is even better. Thanks everyone.

I run a script to process a CSV file once an hour. At the beginning of the script, I need to exit out if the CSV file has not changed. Let's pretend that file timestamps aren't an option. (I'm asking this question for educational value)

I was considering slurping in the entire file and computing the hash on the contents, like so:

$fileData = get-content \path\to\file
$hashCode = $fileData.GetHashCode()

I would then save those contents from run to run, and if the hash is the same on subsequent runs, exit out of my script.

Is there a better way to do this, again, assuming file timestamps are not available?

Assume I have a distribution group in Exchange which currently exists, and holds about 20 members.

In Powershell 2, I have acquired a list of about seven hundred more individuals who need to be added to the group. The only way I have been able to do this is one user at a time:

Add-DistributionGroupMember -Idneity GROUP-NAME -Member Member1
Add-DistributionGroupMember -Idneity GROUP-NAME -Member Member2
....
Add-DistributionGroupMember -Idneity GROUP-NAME -Member MemberN

Is there a mechanism available that allows me to add all users with just one function call, as represented by the following pseudo-code?

SOME-CMDLET-TO-ADD-LOTS-AT-ONCE -Identity GROUP-NAME -Member COLLECTION-OF-PEOPLE

I'm not looking for loop constructs. I'm looking for a function or cmdlet that can add all members at once, ideally taking only one argument referencing the entire list. I'm scared to think what Powershell would do with 700+ command-line arguments...

(I'm hoping that if this IS possible, that I can pass an array or collection of objects to be added.)

Any suggestions? I don't see a command called 'set-distributiongroupmember', and I also don't see anything promising in 'set-distributiongroup'.

I am new to powershell and Exchange so go easy on me if this comes out sounding confusing.

I need to generate a list of every possible email address in our environment (tens of thousands) that will cause the following code to error out due to an object that already exists with that email address as one of its key properties:

New-MailContact -Name $email                                  `
                -ExternalEmailAddress $email                  > $null

I have tried iterating through all entries returned from get-mailcontact, storing every email address from the 'EmailAddresses' collection, but now I believe I also need to extract all possible email addresses from User objects. I've gotten to the point where I'm thinking there's an easier, possibly one-shot way, to do this.

What is the easiest way in PS 2 to accomplish this? Is there a way to guarantee that if an email address IS in the list, New-MailContact will fail with a duplicate error, and if the email address is NOT in the list, then we are guaranteed that New-MailContact will not produce an error due to duplicates. (It may produce other errors, but not because an object already is associated with this address.)

Thanks!

I am 3-to-4 weeks new to powershell and using it to interact with Active Directory / Exchange. (Both of which I'm also very new to.)

I've tried reading this page: http://technet.microsoft.com/en-us/library/ff730967.aspx but I'm a bit overwhelmed by all of the information, probably because I'm exhausted.

Here's what I'm trying to do. Within my code, I want to take an email address as an input string, and create a mail contact (New-MailContact) with the -ExternalEmailAddress parameter set to this string. This is trivially easy. BUT, if an object in AD already exists with this address, it won't let me create the mail contact. So, before the creation attempt, I need to determine if the call to create-mailcontact will produce an error. (The reason I need to detect this is because if this condition is occurring, I need to run a whole bunch of other commands and logic.)

What I have been trying to do is collect all 'WindowsEmailAddress' properties from the objects returned by these calls:

get-user -resultSize unlimited
get-mailcontact -resultSize unlimited

I then look in these results (I convert them to a nice in-memory hash table where the keys are the lowercase email address strings) to see if the email address I'm going to set up a contact for already exists. For most email addresses that are users in our AD domain, this works great.

Unfortunately, there are a few that don't appear in either of these lists, but I still can't create the mail contact because it says the address already exists:

The proxy address "SMTP:[email protected]" is already being used by
"our.domain.org/Exchange Contacts/Some User Name". Please choose another proxy
address.
  + CategoryInfo          : NotSpecified: ([email protected]:ADObjectId) [New-MailContact], ProxyAddressExistsException
  + FullyQualifiedErrorId : 6580586A,Microsoft.Exchange.Management.Recipient Tasks.NewMailContact

I am a bit afraid to iterate through the list returned by get-recipient... is that what I need to do? I was thinking there is probably an easy way to accomplish this I haven't figured out yet.

Important note: There are about 20-30 addresses, all returning this type of error. HOWEVER, when you look above and see 'Exchange Contacts' in the error, well, that portion of the string is completely different from one faulty email address to the next. Not sure if that's relevant. Please feel free to set me straight on anything I'm not understanding. Thanks!

I am trying to strip odd characters from strings using PowerShell. I used the following output to attempt to learn on my own:

get-help about_regular_expressions

I am trying to take a string that is mostly ASCII, but that has one anomalous character that needs to be removed. (The registered trademark symbol; the R with a circle around it.) I'd like to strip any occurrence of that character out of a string, leaving everything else intact. What is the cleanest expression to accomplish this using PowerShell 2.0?

[EDIT]

I have done a little further digging, and I believe the problem is stemming from the Import-CSV call I'm using.

When I cut-and-paste this symbol from within notepad into the PS prompt, and assign it to a string, I match just fine:

# This code yields 'True'
$string -match "\u00ae"

However, when I use Import-CSV on a CSV file where one of the fields contains the special symbol, I believe somehow the raw bytes are getting converted, because doing something like this doesn't work:

# This code yields 'False'
$source = Import-CSV -path testing.csv
# The following extracts the entry / line containing the special symbol that was
# copy-and-pasted above
$culprit = $source[5].COMMITTEE_NAME
$culprit -match "\u00ae"

However, the following DOES work:

# This yields True
$filedata = get-content testing.csv
$filedata[6] -match "\u00ae"

So I think my followup question to all of this is:

How can I keep the strings intact through the import-csv call so that calls to -match for the individual fields will still work?

I am frequently making calls such as:

get-help <some-command>

in Powershell 2. For many, but not all, of these commands, I am not shown the contents of the help entry. Instead, I get duplicates, and only the help object itself is displayed:

[PS2]> get-help remove-distributiongroup | more

Name                              Category  Synopsis
----                              --------  --------
Remove-DistributionGroup          Cmdlet    Use the Remove-DistributionGroup...
Remove-DistributionGroup          Cmdlet    Use the Remove-DistributionGroup...

Being a complete PS novice, I hack around this by doing something similar to the following:

[PS2]> $var = get-help remove-distributiongroup
[PS2]> $var[0] | get-member
... Output ...
[PS2]> $var[0].Parameters |more
... Part of the documentation ...
[PS2]> $var[0].Synopsis |more
... Another part of the documentation ...

Couple of questions.

• Will my Windows admin co-workers know how to remove the duplicate entries? I'm just a Unix guy.
• If not, is there an easier method to get what I need instead of the convoluted hack I came up with above?

Thanks!

[UPDATE[:

Tried pk's suggestion, but sadly that didn't work. Here's the output when piped through select -unique:

Name                              Category  Synopsis
----                              --------  --------
Get-DistributionGroup             Cmdlet    Use the Get-DistributionGroup cm...

We have some Nagios checks that connects to a Windows server and runs a script. This script is not signed, and our admin had set the script exeuction policy for the server, about a year ago, to... unrestricted I believe. Whatever policy is the least secure.

What's happening now (this is an Exchange server FYI) is that at least once a day, the execution policy is being changed such that our Nagios check breaks. Our Windows admin goes to manually force the policy back to unrestricted, but the same thing happens.

Now, I don't really care of have the knowledge to get into a debate about whether this is or isn't good for security. But what our admin was wondering, and I am too, is how we can identify what is changing the policy "out from under us", and put an end to it?

After all, who's to say we don't change our minds to go with a more secure policy, only to have THAT one yanked out from under us.

Any insight is greatly appreciated. Let me know if I can track down any other helpful details.

This is another question in a short series regarding a challenging Exchange project my co-workers have been asked to implement. (I'm helping even though I'm primarily a Unix guy because I volunteered to learn powershell and implement as much of the project in code as I could.)

Background:

We have been asked to create many distribution groups, say about 500+. These groups will contain two types of members. (Apologies if I get these terms wrong.) One type will be internal AD users, and the other type will be external users that I create Mail Contact entries for.

We have been asked to make it so that a "Reply All" is not possible to any messages sent to these groups. I don't believe that is 100% possible to enforce for the following reasons. My question is - is my following reasoning sound? If not, please feel free to educate me on if / how things can properly be implemeneted. Thanks!

My reasoning on why it's impossible to prevent 100% of potential reply-all actions:

1. An interal AD user could put the DL in their To: field. They then click the '+' to expand the group. The group contains two external mail contacts. The message is sent to everyone, including those external contacts. External user #1 decides to reply-all, and his mail goes to, at least, external user #2, which wouldn't even involve our Exchange mail relays.

2. An internal AD user could place the DL in their Outlook To: field, then click the '+' button to expand the DL. They then fire off an email to everyone that was in the group. (But the individual addresses are listed in the 'To:' field.) Because we now have a message sent to multiple recipients in the To: field, the addresses have been "exposed", and anyone is free to reply-all, and the messages just get sent to everyone in the To: field. Even if we try to set a Reply-To: field for all of these DLs, external mail clients are not obligated to abide by it, or force users to abide by it.

Are my two points above valid? (I admit, they are somewhat similar.) Am I correct to tell our leadership "It is not possible to prevent 100% of the cases where someone will want to Reply-All to these groups UNLESS we train the users sending emails to these groups that the Bcc: field is to be used at all times."

I am dying for any insight or parts of the equation I'm not seeing clearly. Thank you!!!

I am a Unix guy who recently picked up powershell to help my Exchange admin coworkers implement a challenging project in Exchange 2010. (The requirements we've been given are challenging if not impossible to meet.)

I'll try to keep this simple. Here's my first question.

We have been given the requirement that certain DLs must be restricted so that only certain internal AD users can send to the DL. Additionally, these DLs must remain visible in the address book. Setting the 'HiddenFromAddressBookEnabled' property to $true is unacceptable. Leadership has stated that "The only people who should be allowed to see who's in the group are the people that can send to the group. Furthermore, the only people who should even be able to SEE the DL entries in the address book are the people who are allowed to send to the DL." I don't think that's doable, because:

• I can get around sender-security restrictions by calling up the (visible) entry in the address book, plopping it in the To: field, and then clicking the '+' in Outlook to expand it to individual people, which then bypasses group security. (I've confirmed this.)
• I do not believe it's possible to selectively hide address book entries only from certain users, but not others.

So here are my questions:

• Does my understanding seem mostly correct? If not, feel free to offer corrections
• Is there any way to hide DLs in address books from only a specific set of users?
• Is there a way to prevent users from clicking the '+' sign in Outlook to get around security restrictions that limit who can send to a group? Technically, you're not sending to a group anymore - just the exact set of individuals that are in that group.

Please - any additional enlightenment or comments encouraged. I think we have to go back to the business and tell them their requirements are not achievable. (And I have two other nasty requirements that I'll start separate questions for.)

Thanks everyone!