bill-long

# Tests the AuthzInitializeContextFromSid call which is restricted by the GPO discussed in this article:
# https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/authz-fails-access-denied-error-application-access-check

param([string]$sidString)

$authzInitializeResourceManagerSig = @'
[DllImport("authz.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern bool AuthzInitializeResourceManager(int flags, IntPtr pfnAccessCheck, IntPtr pfnComputeDynamicGroups,
    IntPtr pfnFreeDynamicGroups, string szResourceManagerName, out IntPtr phAuthzResourceManager);
'@

bill-long

#Requires -Modules Microsoft.Graph, Microsoft.Graph.Users.Actions

Connect-MgGraph -Scopes "User.Read.All", "Mail.ReadBasic", "Mail.Read", "Mail.ReadWrite" -DeviceAuth -ContextScope Process
$userId = (Invoke-MgGraphRequest -Uri "v1.0/me")["id"]

# Only returns 10 items by default
Get-MgUserMessage -UserId $userId | ft ReceivedDateTime,Subject

# You can filter for stuff older than a certain date
Get-MgUserMessage -UserId $userId -Filter "ReceivedDateTime lt 2023-01-25" | ft ReceivedDateTime,Subject

bill-long

param(
    [Parameter()]
    [ValidateSet("NameUnknown", "NameFullyQualifiedDN", "NameSamCompatible", "NameDisplay", "NameUniqueId", "NameCanonical", "NameUserPrincipal", "NameCanonicalEx", "NameServicePrincipal", "NameDnsDomain")]
    [string]
    $ExtendedNameFormat = "NameSamCompatible")

$extendedNameFormats = @{
    "NameUnknown"          = 0
    "NameFullyQualifiedDN" = 1
    "NameSamCompatible"    = 2

bill-long

$url = "https://officeclient.microsoft.com/getexchangemitigations"

$r = Invoke-WebRequest $url
$x = [xml]$r.Content
$signedXml = New-Object System.Security.Cryptography.Xml.SignedXml($x)
$sigNode = $x.GetElementsByTagName("Signature")
$signedXml.LoadXml([System.Xml.XmlElement] ($sigNode[0]))
$signedXml.Signature.KeyInfo.Certificates | Format-List

$signedXml.Signature.KeyInfo.Certificates | ForEach-Object {

bill-long

[CmdletBinding()]
param (
    [Parameter()]
    [string]
    $HostName,

    [Parameter()]
    [string]
    $EmailAddress
)

bill-long

[CmdletBinding()]
param (
    [Parameter()]
    [int]
    $PercentCPUThreshold = 80,

    [Parameter()]
    [int]
    $DurationMilliseconds = 10000
)

bill-long

[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string]
    $Mailbox,

    [Parameter(Mandatory = $true)]
    [string]
    $MID
)

bill-long

Get-ExchangeServer | Where-Object { $_.admindisplayversion -notlike "*14.*" -and $_.admindisplayversion -notlike "*15.0*" } | ForEach-Object {
    $server = $_
    [xml]$result = Get-ExchangeDiagnosticInfo $Server -Process EdgeTransport -Component ResourceThrottling
    $bp = $result.Diagnostics.Components.ResourceThrottling.ResourceTracker.ResourceMeter | Where-Object { $_.CurrentResourceUse -notlike "low" }
    $bp | ForEach-Object { Add-Member -InputObject $_ -MemberType NoteProperty -Name "Server" -Value $server }
    $bp
} | Format-Table Server, CurrentResourceUse, Resource

bill-long

function FindConnectionsWithoutSTARTTLS {
    param(
        $LocalEndpoint,

        [Parameter(ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
        [Alias('FullName')]
        [string[]]$LogFile,
        $Header = @('date-time', 'connector-id', 'session-id', 'sequence-number', 'local-endpoint', 'remote-endpoint', 'event', 'data', 'context')
    )

bill-long

# Show MapiExceptionRpcServerTooBusy count by file

Get-ChildItem *.log | Sort-Object LastWriteTime | % {
  $count = (sls "MapiExceptionRpcServerTooBusy" $_).Count
  [PSCustomObject]@{ File = $_.Name; LastWrite = $_.LastWriteTime; Count = $count }
} | ft

# Show MapiExceptionRpcServerTooBusy count by hour

sls "^(\S+?),.*MapiExceptionRpcServerTooBusy" *.log | % {