Getting Skype server-related info with only read access to Active Directory

BootlegSkypeTopology.ps1

# Using native AD module
$configurationContainer = 'CN=Configuration,'+ (((get-adforest).name.split('.') | foreach {"DC=$_"}) -join ',')

# All pools, whether Director, FrontEnd or SBA
$rawPools = get-adobject -LDAPFilter '(objectClass=msrtcsip-pool)' -SearchBase $configurationContainer -Properties 'name','dnshostname','msrtcsip-pooldata','msrtcsip-pooldisplayname','distinguishedname'

# An entry for each combination of pool or member server and several service types
$trustedServices = get-adobject -LDAPFilter '(objectclass=msrtcsip-trustedservice)' -SearchBase $configurationContainer -Properties 'msrtcsip-routingpooldn','msrtcsip-trustedServerFQDN','msrtcsip-trustedserviceport','msrtcsip-trustedservicetype'

# All pools and their member servers (if Enterprise)
$trustedServers = get-adobject -LDAPFilter '(objectClass=msrtcsip-trustedserver)' -SearchBase $configurationContainer -Properties 'msrtcsip-trustedserverfqdn'

# All Edge pools
$edgeProxys = get-adobject -LDAPFilter '(objectClass=msrtcsip-edgeproxy)' -SearchBase $configurationContainer -Properties 'msrtcsip-edgeproxyfqdn'

# All pools and member servers with web components (no SBAs)
$webComponentsServers = Get-ADObject -LDAPFilter '(objectClass=msrtcsip-TrustedWebComponentsServer)' -SearchBase $configurationContainer -Properties 'msrtcsip-trustedwebcomponentsserverfqdn'

# All Application Contacts (Reponse Groups, Dialin Access Numbers, etc.)
$appContacts = Get-ADObject -Filter * -SearchBase "cn=application contacts,cn=rtc service,cn=services,$configurationContainer" -Properties 'msrtcsip-applicationoptions','msrtcsip-line','msrtcsip-lineserver','msrtcsip-optionflags','msrtcsip-primaryhomeserver','msrtcsip-primaryuseraddress','msrtcsip-userextension','msrtcsip-userroutinggroupid','msrtcsip-applicationdestination','displayname','telephonenumber','proxyaddresses'

# Gets all Exchange servers and client access arrays
$exchangeServers = Get-ADObject -LDAPFilter '(&(objectclass=msexchexchangeserver)(!objectclass=msexchexchangetransportserver))' -SearchBase $configurationContainer -Properties networkAddress,msExchUMServerDialPlanLink,msExchServerSite,msExchVersion,msExchCurrentServerRoles,serialNumber
        

# Gets all the objects (users, contacts, etc) homed on the pool (named by DistinguishedName) - here, 1:1, the first pool at the first site
$users = get-adobject -LDAPFilter "(msrtcsip-primaryhomeserver=CN=Lc Services,CN=Microsoft,CN=1:1,CN=Pools,CN=RTC Service,CN=Services,$configurationContainer)"

# Using Quest AD Management Shell connected to ARS proxy

get-qadobject -type 'msrtcsip-trustedservice' -SizeLimit 0 -IncludedProperties 'msrtcsip-routingpooldn','msrtcsip-trustedServerFQDN','msrtcsip-trustedserviceport','msrtcsip-trustedservicetype' | select msrtcsip-* | export-csv c:\temp\BootlegTopology.csv -NoTypeInformation -delimiter ','
get-qadobject -type 'msrtcsip-Pool' -SizeLimit 0 -DontUseDefaultIncludedProperties -IncludedProperties 'name','dnshostname','msrtcsip-pooldata','msrtcsip-pooldisplayname','distinguishedname' | export-csv c:\temp\BootlegTopology-Pools.csv -NoTypeInformation -delimiter ','
get-qadobject -type 'msrtcsip-TrustedWebComponentsServer' -SizeLimit 0 -DontUseDefaultIncludedProperties -IncludedProperties 'msrtcsip-trustedwebcomponentsserverfqdn' | select 'msrtcsip-trustedwebcomponentsserverfqdn' | export-csv c:\temp\BootlegTopology-WebComponents.csv -NoTypeInformation -Delimiter ','
get-qadobject -type 'msrtcsip-TrustedServer' -SizeLimit 0 -DontUseDefaultIncludedProperties -IncludedProperties 'msrtcsip-trustedserverfqdn' | select 'msrtcsip-trustedserverfqdn' | export-csv c:\temp\BootlegTopology-Servers.csv -NoTypeInformation -Delimiter ','