Office 365

Office 365

Provisioning a New Office 365 User and Mailbox from Exchange Hybrid via PowerShell

Posted on September 18, 2017 by Office 365 PowerShell

Working with many Office365 clients, I receive queries on how to go about provisioning users and mailboxes for an Exchange hybrid deployment.

To begin with, let’s assume a couple things.

  1. We have a Windows 2012 R2 member server with Azure AD Connect (AAD Connect) version 1.1.105.00 (or newer) and the Azure AD Module for PowerShell installed; and
  2. We have an Exchange 2013 CU11 (or newer) server configured for hybrid with an active O365 tenant.

Now that we’ve established a baseline, there are a couple of options to perform the task of provisioning an AD user, creating a mailbox, and assigning an Office 365 license.

  1. The first option would be to create an AD user, create an on premise mailbox, migrate the mailbox to Office 365, and assign a license; or
  2. The second option would be to create an AD user, create a remote (or Office 365) mailbox, and assign a license.

In this post, I will cover the second option simply because it includes fewer steps and attempts to avoid confusion around where the mailbox should be created.

Do not create an AD user and then go to the Office 365 portal to create a new user and associated mailbox. This method will not properly create a synchronized O365 user and mailbox.

STEP 1: CREATE USER & MAILBOX

From the Exchange server, first create the AD user with remote mailbox using one command via Exchange Management Shell (EMS or Exchange PowerShell)…

In the command above, I created the AD user in an OU named “Office 365 Users”, set the password to “EnterPasswordHere”, and will require the user to change their password at next logon. However, I did not assign an SMTP address or remote routing address assuming that the email address policies are configured to be applied as new mailboxes are created.

STEP 2: SYNCHRONIZE USER

Once the AD user and mailbox are created, the AD object must to be synchronized to O365 in order to add the user with associated mailbox in the tenant. With the new version of AAD Connect, the scheduled sync time occurs every 30 minutes. In my case, I’m not that patient and will manually force a sync to O365.

From the server with AAD Connect installed, via an elevated PowerShell console, run the following command to perform the sync to O365…

This task will synchronize all changes made to AD since the user and mailbox were created.

STEP 3: ASSIGN LICENSE

In the final step, I assign an O365 license to the newly created and synchronized user. The following commands can be run from any machine that has both Microsoft Online Services Sign-in Assistant for IT Professionals RTW and Windows Azure Active Directory Module for Windows PowerShell installed. In my case, they are installed on each server, as well as my admin workstation.

Connect to O365 via PowerShell from an elevated PowerShell console; or using Azure AD Module for PowerShell console.

Confirm the new user does not have an O365 license assigned.

This command returns unlicensed O365 users in which the “isLicensed” parameter is “False”.

The next command returns the “AccountSkuId“, or subscription license(s), of my tenant that I will use to assign to the new user.

The AccountSkuId will look something similar to “tenantname:ENTERPRISEPACK“; where “ENTERPRISEPACK” represents my Office 365 Enterprise E3 subscription. Other subscriptions will have different representations.

Before I can assign any licenses to my new user, the user must be assigned a location (or country code). Since I’m am located in the United States, I use “US” as the two letter country code for the user, using this command…

Now that I’ve set a location for the new user, I can assign a license from my associated O365 subscription, using this command…

Finally, the user can access their assigned mailbox in Exchange Online.

Add Alternate Email Address or Recovery Email Address for Office365 Administrator

Posted on September 6, 2017 by Office 365 PowerShell

In Office365, depending on the admin role of an account you may want to add an alternate email address for password recovery. This is a basically a self-service password reset for Administrators of Office365.

Quick way to do this is with PowerShell:

If this setting is unset for an administrator, Office365 gives you a nice reminder about adding an alternate email address in case your primary account gets locked out.

You can add this information when first setting up the account:

It can also be added for an existing admin user by going to the Gear, Office 365 settings, and edit your settings in the ‘me’ section, you can enter your mobile phone number and alternate email there.

Guide to migrate FRS to DFSR

Posted on June 21, 2017 by Office 365

For most users this article only applies if you have Window 2003/ 2003 R2 Domain Controller in your enviornment that you are planning to get rid off. Pretty soon I hope! 😉

SYSVOL is a folder shared by domain controller to hold its logon scripts, group policies and other items related to AD. All the domain controllers in network will replicate the content of SYSVOL folder. The default path for SYSVOL folder is %SystemRoot%\SYSVOL. This folder path can define when you install the active directory.

Windows Server 2003 and 2003 R2 uses File Replication Service (FRS) to replicate SYSVOL folder content to other domain controllers. But Windows server 2008 and later uses Distributed File System (DFS) for the replication.  DFS is more efficient than FRS. Since windows server 2003 is going out of support, most people already done or still looking for migrate in to latest versions. However migrating FSMO roles WILL NOT migrate SYSVOL replication from FRS to DFS. Most of the engineers forget about this step when they migrate from windows 2003 to new versions.

For FRS to DFS migration we uses the Dfsrmig.exe utility. More info about it available on https://technet.microsoft.com/en-au/library/dd641227(v=ws.10).aspx

In my environment, I am using windows server 2012 R2 server and I migrated FSMO roles already from a windows server 2003 R2 server.

In order to proceed with the migration forest function level must set to windows server 2008 or later. So if your organization not done this yet first step is to get the forest and domain function level updated.

You can verify if the system uses the FRS using dfsrmig /getglobalstate , To do this

1)    Log in to domain controller as Domain admin or Enterprise Admin
2)    Launch powershell console and type dfsrmig /getglobalstate. Output explains it’s not initiated DFRS migration yet.

Before move in to the configurations we need to look into stages of the migration.

There are four stable states going along with the four migration phases.

1)    State 0 – Start
2)    State 1 – Prepared
3)    State 2 – Redirected
4)    State 3 – Eliminated

State 0 – Start

With initiating this state, FRS will replicate SYSVOL folder among the domain controllers. It is important to have up to date copy of SYSVOL before begins the migration process to avoid any conflicts.

State 1 – Prepared

In this state while FRS continues replicating SYSVOL folder, DFSR will replicate a copy of SYSVOL folder. It will be located in %SystemRoot%\SYSVOL_DFRS by default. But this SYSVOL will not response for any other domain controller service requests.

State 2 – Redirected

In this state the DFSR copy of SYSVOL starts to response for SYSVOL service requests. FRS will continue the replication of its own SYSVOL copy but will not involve with production SYSVOL replication.

State 3 – Eliminated

In this state, DFS Replication will continue its replication and servicing SYSVOL requests. Windows will delete original SYSVOL folder users by FRS replication and stop the FRS replication.

In order to migrate from FRS to DFSR its must to go from State 1 to State 3. This step cannot be reversed.

Migration Steps:

Prepared State

1.    Log in to domain controller as Domain admin or Enterprise Admin
2.    Launch powershell console
3.    Type dfsrmig /setglobalstate 1 and press enter

4.    Type dfsrmig /getmigrationstate to confirm all domain controllers have reached prepared stat

Redirected State

1.    Log in to domain controller as Domain admin or Enterprise Admin
2.    Launch powershell console
3.    Type dfsrmig /setglobalstate 2 and press enter

4.    Type dfsrmig /getmigrationstate to confirm all domain controllers have reached redirected state

Eliminated State

1.    Log in to domain controller as Domain admin or Enterprise Admin
2.    Launch powershell console
3.    Type dfsrmig /setglobalstate 3 and press enter

4.    Type dfsrmig /getmigrationstate to confirm all domain controllers have reached eliminated state

This completes the migration process and to confirm the SYSVOL share, type net share command and enter.

Also make sure in each domain controller FRS service is stopped and disabled. This should happen automatically, but please verify.

Additional Info:

The steps listed above are pretty straightforward.  I’d advise to make sure DFSR binaries are current on all DCs for the respective OS versions, then forge ahead 😊

https://support.microsoft.com/en-us/help/2951262/list-of-currently-available-hotfixes-for-distributed-file-system-dfs-technologies-in-windows-server-2012-and-windows-server-2012-r2 (Note: the article has both 2k12 and 2k12R2 binaries by DFS-N and DFS-R, I’m including just the DFSR below)

DFS replication

Windows Server 2012 R2

Date added Knowledge Base article Title Why we recommend this hotfix Hotfix type and availability
Aug 05, 2016 3172614 July 2016 update rollup  for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 This hotfix contains the most current version of Dfsrs.exe for Windows Server 2012 R2. To apply this update rollup, you must be running Windows Server 2012 R2, April 2014 Update 2919355 and April 2015 Update 3021910.
NA This hotfix contains the most current version of Dfsrro.sys for Windows Server 2012 R2. To install this hotfix, you must have Windows Server 2012 R2 installed.
NA This hotfix contains the most current version of Dfsrclus.dll for Windows Server 2012 R2.
August 31, 2014, Install this Hotfix 2996883 DFSR stops replication after an unexpected shutdown in a Windows 8.1 or Windows Server 2012 R2 environment This hotfix contains the most current versions of Dfsrdiag.exe, Dfsrmig.exe and Dfsrwmiv2.dll for Windows Server 2012. To apply this hotfix, you must be running Windows Server 2012 R2 and April 2014 Update 2919355.

 

For any 2008/2008R2 DCs, the parallel article to the 2k12 version above, https://support.microsoft.com/en-us/help/968429/list-of-currently-available-hotfixes-for-distributed-file-system-dfs-technologies-in-windows-server-2008-and-in-windows-server-2008-r2 :

Windows Server 2008 R2

Date added Knowledge Base article Title Why we recommend
this hotfix		 Hotfix type and availability
 Oct/11/2014 3002288 DFSR service freezes when it calls a method on a Windows-based server

    Dfsrs.exe 6.1.7601.22842 or newer
This hotfix contains the most current version of Dfsrs.exe for Windows Server 2008 R2 SP1.

Note: For 2008 R2 (RTM) apply: 2725170

To install this hotfix, you must have Windows Server 2008 R2 Service Pack 1 (SP1) installed.
Jan/21/2012 2663685 Changes that are not replicated to a downstream server are lost on the upstream server after an automatic recovery process occurs in a DFS Replication environment in Windows Server 2008 R2 This hotfix adds the ability to enable or disable automatic recovery of DFSR databases via a registry value in Windows Server 2008 R2. (StopReplicationOnAutoRecovery )

 

Set regkey for autorecovery…….

 

On Windows 2012 R2 DFSR Autorecovery is enabled by default

 

To enable the DFS Replication service to automatically recover databases, modify the following registry key:

HKLM\System\CurrentControlSet\Services\DFSR\Parameters\StopReplicationOnAutoRecovery

Notes

·         If the value of the StopReplicationOnAutoRecovery registry subkey is set to 1, the DFS Replication automatic recovery is disabled.
When the error condition should occur you may note a DFS Replication warning event 2213 like the following:

Log Name: DFS Replication
Source: DFSR
Event ID: 2213
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: MyDFSRMember.contoso.com
Description:
The DFS Replication service stopped replication on volume F:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.

Additional Information:
Volume: F:
GUID: 4A5BAE4E-c19D-21E1-A4E7-007056B54182

·         If the value of the StopReplicationOnAutoRecovery registry subkey is set to 0 or if the StopReplicationOnAutoRecovery registry subkey does not exist, the DFS Replication automatic recovery is enabled.

 

 To install this hotfix, you must have Windows Server 2008 R2 or Windows Server 2008 R2 Service Pack 1 (SP1) installed.
Nov/18/2009 975763 DFS Replication does not use Remote Differential Compression (RDC) when replicating very large files on a computer that is running Windows Server 2008 R2 If you have a version of dfsrs.exe installed that is newer than 975763, you do not have to install this hotfix. However, you must still enable the registry change (RpcContextHandleTimeoutMs) that is specified in 975763 for the new behavior to take effect.

 

 To install this hotfix, you must have Windows Server 2008 R2 installed. This hotfix is available for individual download and is included in Windows Server 2008 R2 Service Pack 1.
May/21/2013 2851868 “0x0000003B” Stop error when you use the DFSR service on a Windows Server 2008 R2-based This hotfix contains the most current version of Dfsrro.sys for Windows Server 2008 R2 SP1.

 

Dfsrro.sys 6.1.7601.22335 or newer
To install this hotfix, you must have Windows Server 2008 R2 Service Pack 1 (SP1) installed.
Jan/19/2010 979564 The DFS Replication Management Pack shows alerts for cluster network names that are in the “healthy” status on a Windows Server 2008 R2 failover cluster This hotfix contains the most current version of Dfsrclus.dll for Windows Server 2008 R2 RTM. To install this hotfix, you must have Windows Server 2008 R2 installed. This hotfix is available for individual download and is included in Windows Server 2008 R2 Service Pack 1.
Nov/18/2012 2780453 Event ID 4114 and Event ID 4008 are logged in the DFS Replication log in Windows Server 2008 R2 This hotfix contains the most current version of Dfsmgmt.dll for Windows Server 2008 R2 and SP1.

 

Dfsmgmt.dll 6.1.7601.22167 or newer
To install this hotfix, you must have Windows Server 2008 R2 or Windows Server 2008 R2 Service Pack 1 (SP1) installed.

 

As a best practice, as there will be a parallel directory, SYSVOL_DFSR , created during the migration process, have the A-V admins ensure exclusions are set per https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-running-currently-supported-versions-of-windows

 

Q&A

Q: What are the Domain Controller availability requirements during my migration?

A: There are a couple.

The PDC Emulator must be online any time the DFSRMIG tool is being invoked for a read or write operation. If the PDC Emulator is offline or inaccessible for LDAP, the user of DFSRMIG will receive:

“Unable to connect to the Primary DC’s AD.

Please make sure that the PDC is reachable and try the command later.”

All DCs must remain online until they each complete their state steps. All DCs do not need to be accessible simultaneously. But the global state will never reach the Prepared, Redirected, or Eliminated state until all DCs have been able to complete their individual phases.

The PDC Emulator requirement is because by default, administrators always edit group policy on the PDCE, so in most environments it will have the most up to date knowledge of policy. That and we need to talk to someone unique, so it might as well be him.

It is recommended that a SYSVOL migration not be attempted unless all DCs are online and available. Change control blackouts should be scheduled to prevent modification to DCs that might impact their availability. This will minimize the window of time that the migration will take.

Q: Is there some super-secret way to return to using FRS after reaching the Eliminated phase of DFSR migration?

A: Microsoft does not support returning your domain to using FRS for SYSVOL replication after a completed DFSR migration (except to rebuild the domain). This is why the steps are done in a phased approach with two checkpoints where you can revert back to FRS without any consequences. Once you trigger the ELIMINATED phase to start, there is no going back, period.

Q: When does Robocopy run during the migration and what does it do?

A: The DFSR service uses robocopy at several stages to synchronize SYSVOL directories outside of normal replication when it detects a SYSVOL migration is underway; a set of ‘pre-seeding’ and ‘save the GP admins from themselves’ operations.

When Prepared state (DFSRMIG /SETGLOBALSTATE 1) is invoked, all DC’s robocopy their FRS SYSVOL data locally into the new DFSR content set. This is equivalent to ‘pre-seeding’ data and ensures that minimal file replication occurs to converge the content set. This is triggered by the DFSR service itself when:

  • AD replication has converged between a DC and the PDCE.
  • The DFSR service on that DC has polled (this runs every 5 minutes) and picks up the state change from CN=dfsr-LocalSettings
  • When entering the Redirected state, the PDC Emulator (only) robocopies the local differences of FRS SYSVOL data into the new local DFSR content set, on itself. The other servers receive new data via replication.

If you undo the Redirected state back to Prepared, the reverse happens. The PDC Emulator robocopies its local DFSR content set data into its local FRS content set. FRS replication synchronizes all other servers… eventually. Allow more time for this than entering Redirected, as FRS is not as fast to synchronize as DFSR.

For sharp-eyed readers: we won’t run into any of the old pre-seeding issues (the file hash being changed by robocopy) here because DFSR correctly creates the SYSVOL_DFSR folder ACL, so there are no inheritance issues when the contents are copied in and replicated.

Q: Event 8004 says something about RODC’s. I don’t have any RODC’s. What the frak?

A: The following event is incorrectly written in the DFSR event log(s) on servers that are not Read-only Domain Controllers when setting elimination state using DFSRMIG.EXE:

Log Name: DFS Replication
Source: DFSR
Date: 9/28/2007 11:53:46 AM
Event ID: 8004
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: <WRITABLE DC>
Description:
The NTFRS member object for the Read-only Domain Controller <WRITABLE DC> was deleted successfully.

The text in the event log is completely cosmetic and benign. It is supposed be fixed in a later version of the OS. Just ignore it.

Q: What are all the AD and Registry state values that will be set at a given point in the migration?

A: See below:

=============

Prepared Phase – DFSRMIG /SETGLOBALSTATE 1

  • DFSRMIG contacts the PDC Emulator directly.
  • Global objects are created under:

CN=DFSR-GlobalSettings,CN=SYSTEM,DC=<domain>
CN=DOMAIN SYSTEM VOLUME
CN=SYSVOL SHARE
CN=CONTENT
CN=TOPOLOGY

  • CN=DFSR-GlobalSettings now has msDFSR-Flags attribute set to 0.
  • As DC’s pick up the globalstate change via AD replication and DFSR service polling, they create and write to registry entry:

HKLMSystemCurrentControlSetServicesDFSRParametersSysvolsMigrating Sysvols
Local State = 4 [REG_DWORD]

  • The PDC Emulator creates the:

CN=dfsr-LocalSettings,CN=<servername>,DC=<domain>

objects for all DCs and sets this attribute to:

msDFSR-Flags = 80 (if RWDCs).
msDFSR-Flags = 64 (if RODCs – the RODC itself will set it to 80 later).

  • The DFSR service has now started and created the new local SYSVOL_DFSR structure. Robocopy has made a local copy of the FRS SYSVOL. All AD topology data has been written in to support the content set. Initial sync of the data has started (since robocopy has locally pre-seeded the data this should involve minimal replication data on the network). The registry on all DC’s is:

Local State = 5 [REG_DWORD]

  • Once initial sync is done on all DCs:

Local State = 1 [DWORD] ‘msDFSR-Flags’ (on CN=dfsr-LocalSettings) = 16

  • If DFSRMIG /GETGLOBALSTATE returns that all DCs are prepared, ‘msDFSR-Flags’ on CN=dfsr- GlobalSettings has changed to 16 because all DCs are prepared. All DCs are currently replicating DFSR and FRS content sets, with FRS being shared as SYSVOL.

=============

Redirected Phase – DFSRMIG /SETGLOBALSTATE 2

  • DFSRMIG contacts the PDC Emulator directly.
  • CN=DFSR-LocalSettings now has msDFSR-Flags attribute set to 96 on all DCs and this replicates out through AD.
  • As DCs pick up the attribute from AD replication, their DFSR service sets:

Local State = 6 [REG_DWORD]

  • On the PDC Emulator only, robocopy syncs any changes between the FRS and DFSR’s content sets, and this is replicated out through DFSR.
  • Once SYSVOL data is in sync, SYSVOL content set is set to be the active SYSVOL share on all servers. FRS and DFSR are both still replicating data.
  • When this is complete, for each DC:

Local State = 2 [DWORD] ‘msDFSR-Flags’ (on CN=dfsr-LocalSettings) = 32

  • If DFSRMIG /GETGLOBALSTATE returns that all DCs are redirected, ‘msDFSR-Flags’ on CN=dfsr- GlobalSettings has changed to 32 because all DCs are prepared. All DCs are currently replicating DFSR and FRS content sets, with DFSR being shared as SYSVOL.

==============

Eliminated Phase – DFSRMIG /SETGLOBALSTATE 3

  • DFSRMIG contacts the PDC Emulator directly. At this point it is not possible to undo the changes!
  • CN=DFSR-LocalSettings now has msDFSR-Flags attribute set to 112 on all DCs and this replicates throughout AD.
  • As DCs pick up the attribute from AD replication, their DFSR service sets:

Local State = 7 [REG_DWORD]

  • On the PDC, the FRS content set information is removed and this is replicated through AD. As each DC sees this change, their FRS service stops replicating the FRS content set. The FRS service is stopped (and restarted if custom FRS sets still exist on a given server).
  • When this is complete, for each DC:

Local State = 3 [DWORD] ‘msDFSR-Flags’ (on CN=dfsr-LocalSettings) = 48

  • If DFSRMIG /GETGLOBALSTATE returns that all DCs are eliminated, ‘msDFSR-Flags’ on CN=dfsr-GlobalSettings has changed to 48 because all DCs are prepared. All DCs are currently replicating DFSR only.
  • A final cleanup task on each DC will set their ‘msDFSR-Flags’ on CN=dfsr-LocalSettings to <NOT SET>. The same will happen from the PDC to CN=dfsr-GlobalSettings.

==============

If any ‘undo’ phases are entered (where an administrator has decided to go from redirected back to prepared, redirected back to start, or prepared back to start), the flow above happens in reverse, with the exception that the following two entries exist in the ‘Local State’ registry entries:

  • (Undo Redirecting)
  • (Undo Preparing)

Q: I’m not a huge fan of Ultrasound. Are there any other ways to validate the health of SYSVOL prior to and after migration?

A: Sure thing – already discussed in a TechNet blog post here (Verifying File Replication during the Windows Server 2008 DFSR SYSVOL Migration – Down and Dirty Style).

Q: Are there any migration KBs or bugs I need to worry about?

A: One KB, with a simple solution to domains that have non-standard (and frankly, not any safer than default) security configurations: http://support.microsoft.com/kb/2567421 (Manage Audit and Security Logs user rights required)

CAUSE: The default user rights assignment “Manage Auditing and Security Log” (SeSecurityPrivilege) has been removed from the built-in Administrators group. Removal of this user right from Administrators on domain controllers is not supported, and will cause DFSR SYSVOL migration to fail. DFSR migration and must be run by a user who is a member of the built-in Administrators group in that domain. All DCs are automatically members of the built in Administrators group.

Outlook 2016: Remove Duplicate entries in Room Finder

Posted on April 12, 2017 by Office 365

In Outlook 2016 some users may noticed dual entries in the Room List:

The room list behavior that we see  in Outlook is by design. When we  use a Room List  for a meeting, it is stored in the  Most Recently Used entries in the registry. When we create a new meeting, we will see this MRU entry in the top of the Room Lists . The same Room List will be seen again in the drop down which is accessed from the Exchange Server/ Online.

To prevent the duplicate entries seen in the Room List, create the below registry entry with blank data to disable the  Most Recently Used  Room List in Outlook.

Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Preferences

Key: RoomFinderRecentRooms
Key: RoomFinderRecentRoomList

If these entry already exist just empty the values.

After Outlook Restart:

 Only single instance of the rooms list now showing! 🙂

Office365: List Your Business Can’t Live Without

Posted on April 5, 2017 by Office 365

When you have a lot of conference rooms, equipment or special rooms mailboxes it is hard to list or find available free rooms during a particular time slot. Luckily, Office365 and Outlook 2013/2016 have a special feature called ‘Room Lists’, which enable you to find and schedule  a room quickly based on availability and offer suggestions during room reservation.

In simple terms Room List work  as distribution groups for conference or other types of rooms.

Use PowerShell to login to Office365:

Create a room list:

Add rooms to a list:

Check what Room Lists you have:

Check what conference rooms are part of a particular room list:

Hack: Microsoft Outlook AutoComplete

Posted on March 6, 2017 by Office 365 Windows

Outlook maintains the AutoComplete list. The list is used by both the automatic name-checking feature and the automatic completion feature. The AutoComplete list, also known as the nickname cache, is generated automatically when you send email messages from Outlook. The list contains SMTP addresses, LegacyExchangeDN entries, and display names for people to whom you have sent mail previously.

Note The AutoComplete list for Outlook is specific to Outlook and is not shared by Outlook Web App (OWA). OWA maintains its own AutoComplete list.

The following sections provide information about the AutoComplete feature.

Limit to the number of entries

Outlook limits the number of entries that you can save in the AutoComplete list. After you reach this limit, Outlook uses an internal algorithm to determine the best names to remove from the list. It does this based on a usage weighting. Therefore, you may find some names unexpectedly removed from your nickname cache. There are two general approaches that you can use to avoid this situation:

  1. You can proactively remove AutoComplete list entries that you no longer need. This is the preferred approach. For more information about how to do this, see the section titled “How to remove AutoComplete list entries one at a time.”
  2. You can increase the limit for the nickname cache. If you have a larger nickname cache, you could also lose a larger number of cached entries if your nickname cache becomes unusable because of corruption.

The limits are as follows:

  • Outlook 2016: 1,000 entries
  • Outlook 2013: 1,000 entries
  • Outlook 2010: 1,000 entries
  • Outlook 2007: 2,000 entries
  • Outlook 2003: 1,000 entries

How to enable the AutoComplete feature

Outlook 2010, Outlook 2013, and Outlook 2016

To access the AutoComplete setting, follow these steps:

  • On the File menu, click Options.
  • Select the Mail tab.
  • Scroll approximately halfway down until you see Send messages. Make sure that the Use Auto-Complete List to suggest names when typing in the To, Cc, and Bcc lines box is checked. If you need to disable Auto-Complete uncheck the box.

How to import .nk2 files into Outlook 2010, Outlook 2013, and Outlook 2016

Microsoft Office Outlook 2007 and earlier versions store the AutoComplete list in an nickname (.nk2) file on the disk. Outlook 2010, Outlook 2013, and Outlook 2016 store the AutoComplete list as a hidden message in your primary message store. Outlook 2010, Outlook 2013, and Outlook 2016 let you import the older .nk2 files.

For more information about how to import .nk2 files in Outlook 2010, go to the following Microsoft website:

Import Auto-Complete List from another computer

 

How to import .nk2 files into Outlook 2013 or Outlook 2016

When you start Microsoft Outlook 2013 or Outlook 2016 for the first time, your nickname cache (stored in the  profilename.nk2 file) is imported into a hidden message in your default message store.

Note profilename is the name of your Outlook profile.

For example, if you are using a Microsoft Exchange account, the nickname cache is imported into a hidden message in the Exchange mailbox.

Note Outlook 2007 and earlier versions store the nickname cache .nk2 file in the following folder.

  • Windows XP
    Drive:\Documents and Settings\Username\Application Data\Microsoft\Outlook
  • Windows Vista and later versions
    Drive:\Users\Username\AppData\Roaming\Microsoft\Outlook

After the nickname cache is imported, the
profilename.nk2 file is renamed to
profilename.nk2.old. On the next start of Outlook, your nickname cache is not imported. Outlook 2013 and Outlook 2016 do not use the .nk2 file for maintaining your nickname cache. All updates to your nickname cache in Outlook 2013 and Outlook 2016 are made to the hidden message in your default message store.

Note If you have multiple Outlook profiles, the nickname cache from each profile is merged into your new Outlook 2013 or Outlook 2016 nickname cache on the first start of Outlook by using that profile. Therefore, you may find more than one .nk2 file renamed to .nk2.old.

However, there may be situations where you have to import a nickname cache file after this first-run nickname cache import process has finished. For example, a colleague wants to share their nickname cache with you and you want to update your existing nickname cache with your colleague’s data.

To import .nk2 files into Outlook 2013 or Outlook 2016, follow these steps:

  • Make sure that the .nk2 file is in the following folder:
    %appdata%\Microsoft\Outlook

    Note The .nk2 file must have the same name as your current Outlook 2013 or Outlook 2016 profile. By default, the profile name is “Outlook.” To check the profile name, follow these steps:

    1. Click Start, and then click
      Control Panel.
    2. Double-click Mail.
    3. In the Mail Setup dialog box, click
      Show Profiles.
  • Click Start, and then click
    Run.
  • In the Open box, type
    outlook.exe /importnk2 , and then click
    OK. This should import the .nk2 file into the Outlook profile.
Note After you import the .nk2 file, the contents of the file are merged into the existing nickname cache that is currently stored in your mailbox.
Note The .nk2 file is renamed with a .old file name extension on the first start of Outlook 2013 or Outlook 2016. Therefore, if you try to re-import the .nk2 file, remove the .old file name extension.

How to copy the AutoComplete list

The steps to export and import the AutoComplete list are different, depending on the version of Outlook that you are using.

Outlook 2010, Outlook 2013, and Outlook 2016

To copy the AutoComplete list in Outlook 2010, Outlook 2013, and Outlook 2016, follow these steps:

Note: Please make sure the you are using the appropriate MFCMAPI for x86 or x64.

Step 1

To export the AutoComplete mailbox message, follow these steps:

  1. Exit Outlook, and then close Outlook Web Access or Outlook Web App (OWA) on all workstations that are connected to your mailbox.
  2. Download and install MFCMAPI from http://mfcmapi.codeplex.com.
  3. Run mfcmapi.exe.
  4. On the Session menu, click Logon.

  5. If you are prompted for a profile, select the desired profile name, and then click OK.

  6. In the top pane, locate the line that corresponds to your mailbox, and then double-click it.
  7. In the left-side navigation pane, expand Root Container, and then expand Top of Information Store or IPM_SUBTREE.
  8. Right-click the Inbox folder, and then click Open Associated Content Table. This action opens a new MFCMAPI window that contains various properties.

  9. Under the Subject column, right-click the item that has the subject IPM.Configuration.Autocomplete,


    and then click Export Message. This action opens the Save Message To File window.

  10. In the drop-down list, select MSG file (UNICODE), and then click OK.
  11. Select a folder location to which you want to save the message, and then click Save. Note this location.

Step 2

To import the AutoComplete mailbox message, follow these steps.

  1. Exit Outlook, and then close Outlook Web Access or Outlook Web App (OWA) on all workstations that are connected to your mailbox.
  2. Download and install MFCMAPI from http://mfcmapi.codeplex.com
  3. Run mfcmapi.exe.
  4. On the Session menu, click Logon.
  5. If you are prompted for a profile, select the desired profile name, and then click OK.
  6. In the top pane, locate the line that corresponds to your mailbox, and then double-click it.
  7. In the left-side navigation pane, expand Root – Mailbox, and then expand Top of Information Store or IPM_SUBTREE.
  8. Right-click the Inbox folder, and then click Open Associated Content Table. This action opens a new MFCMAPI window that contains various properties.
  9. To avoid duplicate entries, you must delete the existing AutoComplete message.
    Note: Before you delete the IPM.Configuration.Autocomplete message, you must export the message.

    To delete the existing AutoComplete message, follow these steps:

    1. In the Subject column, locate the item that has the subject IPM.Configuration.Autocomplete.
    2. Right-click the item, and then click Delete message. This opens the Delete Item window.
    3. In the drop-down list, select Permanent deletion (deletes to deleted item retention if supported), and then click OK.
    4. On the Folder menu, click Import, and then click From MSG.

    5. Locate the .msg file that you created in step 11 of the “How to Export the Auto-Complete List” section, and then click OK.
    6. In the Load MSG window that appears, select Load message into current folder in the Load style list, and then click OK.

The AutoComplete information is imported from the IPM.Configuration.Autocomplete_<hexadecimal code>.msg , where the placeholder <hexadecimal code>  represents a long string of numbers and letters.

How to remove AutoComplete list entries one at a time

To remove entries from the AutoComplete cache one entry at a time, follow these steps:

  1. Open a new email message.
  2. Type the first few characters of the AutoComplete entry that you want to remove.
  3. When the entry appears in the list of suggested names, move your mouse pointer over the name until it becomes highlighted, but do not click the name.
  4. When the “X” icon appears next to the highlighted name, click X to remove the name from the list, or press the Delete key on the keyboard.

How to clear the whole AutoComplete list

This section explains how to delete the AutoComplete list.

Outlook 2010, Outlook 2013, and Outlook 2016

Use one of the following two methods to delete the AutoComplete list in Outlook 2010, Outlook 2013, and Outlook 2016.

Method 1

  1. Open Outlook.
  2. On the File tab, click Options.
  3. Click the Mail tab.
  4. Under Send Messages, click Empty Auto-Complete List.

  5. Click Yes.

Method 2

Start Outlook by using the /CleanAutoCompleteCache switch. To do this, follow these steps:

  1. Click Start, and then click Run.
  2. Type Outlook.exe /CleanAutoCompleteCache .

    Note If Outlook is not installed in the default location, you must point to the path of Outlook.exe.

Filling the Auto-Complete list with Contact addresses

You can directly fill the list again by creating a new message addressed to all your contacts at once.

  1. Place Outlook in ‘Work Offline’ mode (see instructions below)
  2. Create a new message.
  3. Press the To… button.
  4. Select the contact list in the right top corner from which you would like to add the contacts from.
    Examples; Contacts folder, Global Address List (GAL) or a contacts folder in a Public folder.
  5. Select the first contact.
  6. Scroll all the way down to your last contact.
  7. Hold the SHIFT button on your keyboard while clicking on the last contact to select them all.
  8. Press the To –> button to add them all to the To… field.
  9. Repeat step 3 to 7 if you have contacts in additional lists that you would like to add.
  10. Press OK to close the dialog and to return to the newly created message.
  11. Now when you address a new message the AutoSuggest/Auto-Complete feature will pop-up again.

For Outlook 2010, Outlook 2013 and Outlook 2016, you must send the message to actually store these addresses in the AutoSuggest cache. However, by placing Outlook in Offline Mode first via the Send/Receive tab, you can easily prevent it from actually being sent by removing it from the Outbox and then place Outlook back online mode.

Working in Offline Mode

This is fairly simple for folks that dont know.

The main confusion is about Work Offline icon which is being displayed on the Send/Receive tab in the Ribbon in Outlook 2010 and Outlook 2013; you’ll find a globe with a red cross in front of it. This doesn’t mean you are in Offline Mode as the icon is always like this. The icon doesn’t change to for instance a globe without a red cross when you are Online

When you actually are in Offline Mode, the icon will show highlighted (as see below, when using a black color theme for Office 2016)  and your Status Bar will also show “Working Offline”. Clicking on the icon then will bring you back to Online Mode.

Status Bar:

POP3 Accounts:

When you are using a POP3 account, you can reuse your original pst-file on another computer or when reconfiguring the account without losing your AutoComplete cache. However, it is important that you do this in the correct way or the list will still be lost.

Cleaning up Office365 Groups Mess

Posted on February 23, 2017 by Azure Office 365 SharePoint

Office 365 Groups are a shared workspace for email, conversations, files, and events where group members can collectively get stuff done. It compliments the introduction of Microsoft Teams. The main thing to keep in mind is that this feature is still evolving.

Why is it important to control Office 365 Group creation?

This feature is enabled by default. So its better to put restrictions in place or later clean up sites, groups, permissions set by organization users.

Which Group?

SharePoint frequently reuses terms, which often makes conversations and forum posts a lot of fun. There’s at least three “Groups” in Office 365:

  • Active Directory Groups: Groups at the AD level. Outside of SharePoint. Useable across all site collections, and other applications. A “Sales Managers” AD group can be created once, updated in one place and used across all site collections in the tenant.
  • SharePoint Groups: Collections of users (people) and AD groups. Scoped to a single site collection. A “Sales Managers” SharePoint group would need to be created in each of the site collections and all updates repeated across all of the site collections.
  • Office 365 Groups: A new collaboration option! A combination of a mailbox and a site collection. Not a group useable for managing access to SharePoint sites.

Office 365 Groups

Office 365 Groups are a combination of an Exchange email account with the group’s name that is used to store conversations, and a “OneDrive – like” site collection to store files.

A collection of Office 365 Groups facts:

  • Internally, to distinguish traditional groups from the new Office 365 Groups, Groups are called “Unified Groups”. Externally they should be called “Office 365 Groups”, not “SharePoint Groups”.
  • Creating a Group creates an AD Distribution group, an email address and a “hidden” SharePoint Site Collection. The site collection is not visible in the tenant admin pages. The AD group is not manageable from Azure AD, only from the tenant admin Groups pages. (You can see members in Azure AD, but cannot edit them.)
  • Groups can be created from:
    • Outlook (OWA).
    • A user’s OneDrive.
    • The “GROUPS” page in the tenant Admin site. Here you can create both “Office 365 Groups” and “security groups”.
  • Conversations are stored in Exchange inboxes and files are stored in SharePoint Site Collections.
  • Groups are defined and managed in Azure AD. (Which explains why the PowerShell cmdlets for Groups are not in the SharePoint Online cmdlet library.)
  • Each user may create up to 250 Groups and can be a member of up to 1,024 Groups. There’s no limit for number of Groups per tenant.
  • Emails can be sent in the name of the group by members. (Requires a PowerShell based change.)
  • Groups will not be deleted if the Group’s owner is deleted.
  • Groups use a OneDrive for Business site under the covers. (Template: GROUP#0)
  • URL for the files site collection looks like a normal team site instead of a OneDrive site:  https://yourdomain/sites/groupsitename
  • If there is a URL conflict, a number is appended to the name: https://yourdomain/sites/groupsitename51
  • URL for the mailbox is “guessable”: https://outlook.office365.com/owa/#path=/group/yourGroupName@yourDomain.onmicrosoft.com/people
  • Groups site collections are not (currently) displayed in the admin Site Collections page. You may discover their existence when you create a new site collection that has the same name as a group site. “The site collection already exists. Please enter a different address.”
  • PowerShell:
    • Get-SPOSite does not return Groups site collections, but you can access a Groups site by URL.
    • Get-SPOUser does not return users for Groups sites.
  • Groups file storage is counted against the tenant quota. It’s not considered to be a personal OneDrive. There is no “user” for the Group OneDrive. The mailbox can store up to 50GB of messages, posts and calendar entries. The SharePoint Site Collection has a max of 1TB.
  • Search: There is a search box, but it opens the Search Center in a new window/tab and searches all of SharePoint, not just the Groups file site.
  • The document library in the Group site is very much like a OneDrive for Business library. No ribbon, no custom columns, no metadata and no Content Types. The Groups library is very limited:
    • Only one library, and it’s not customizable.
    • Can’t check out/in. (I saw this listed as a feature, but it’s not in my tenants.)
    • Versioning is enabled (Major only)
    • Cannot add/delete columns (i.e. use any custom metadata that might be useful to search or eDiscovery.)
    • Cannot use workflows.
    • Cannot audit security from the browser.
    • No branding. Cannot be opened by SharePoint Designer.
  • The Site Collection is VERY limited.
    • Almost all of the links for site or list maintenance are redirected to the home page.
    • There is no Settings page.
    • There is no Site Permissions page, so there’s no Site Permissions page or 2nd tier recycle bin.
    • You cannot create new lists or libraries.
  • Library Sync: The Sync button works with the new OneDrive for Business sync client. So, keep in mind that group members of easily offline all of the content.
  • Recycle Bin:
    • There is a recycle bin, but you can only access the user level.
    • If you share a file with a non-member with “Edit”, they can delete the file, but get “Sorry, you don’t have access to this page” when they click the Recycle Bin link.
    • There is no Site Collection recycle bin page available. The Groups “owner” can’t recover files deleted by members.
  • Can be administered and reported on from PowerShell as part of the Exchange Online cmdlets.
    https://technet.microsoft.com/en-us/library/jj200780(v=exchg.160).aspx
    cmdlets: Get/Set/New/Remove-UnifedGroup and Get/Add/Remove-UnifiedGroupLinks
    https://support.office.com/en-us/article/Use-PowerShell-to-manage-Office-365-Groups-aeb669aa-1770-4537-9de2-a82ac11b0540
  • Groups can be disabled for all users. (PowerShell)
  • Groups can be disabled for a subset of users. (Requires PowerShell.)
  • Security:
    • New groups default to “Public”. Everyone has access. You must remember to choose Private when you create the group.
    • I can’t find a place to change Public/Private status after the group has been created.
    • The names of groups are not private. They will be seen in “Send to”, “Share” and other places where user names can be seen. All groups, public and private, are listed in the “Browse Groups” screens. (Train your users not to use group names that reveal confidential data. You know, names like “IT Layoff Planning Group”. 🙂 )
    • Files can be shared with the “group”. They will be listed in the “Shared with us” tab.
    • Files that are shared with the “group” will be visible to all users even for Private groups! (I think this is a bug!) (The user must know the URL to the Files site.)
    • Files can be “reshared”. Sam has a site named “My Private Group”, which is Private, He shares a file with Robert (with Edit or View). Robert can only see that one file in the group site. Robert shares with Susan. Susan can then share with………
    • Users who guess the URL to the file site can see the site, but no files, or only files shared with them. They can see the list of “members” and who the owner is.

Groups vs. Team Sites

Groups Team Sites
Can add lists/libraries No Yes
Can add pages No Yes
Can add columns/metadata No Yes
Can use Content Types No Yes
Can hide membership No Yes
Can brand No Yes
Can be fully managed with PowerShell No Yes

Cleaning up the mess

So since this feature is enabled by default. Users in your organization may have already started creating groups and hidden SharePoint site.

So first we need to disable this option right away.

Prerequisites:

Check your Company-level configuration settings

Now need to check your company-wide configuration settings through the Get-MsolCompanyInfo Windows PowerShell cmdlet. This cmdlet will display your current company-wide configuration settings that affect all users. You specifically need to verify that the UserPermissionToCreateGroupsEnabled parameter is set to False.

To check your Company-level configuration settings

You will first need to connect to your Office 365 service. In the Windows Azure Active Directory Module for Windows PowerShell, type and enter the following:

In the Sign in to your Account screen, enter your credentials to connect you to your service, and click Sign in.

You will be returned to a prompt in the Windows Azure Active Directory Module.

You will need to display your company-wide configuration settings. To do this, type and enter:

This will display a listing of the current configuration settings that apply to all users in your company.

As you can see the value for the UsersPermissiontoCreateGroupsEnabled setting is True. We need to change this to False.

To change the UsersPermissionToCreateGroupsEnabled setting value

You will first need to use the Set-MsolCompanySettings cmdlet to change the UsersPermissionToCreateGroupsEnabled parameter to False. In the Windows Azure Active Directory Module for Windows PowerShell, type and enter the following:

You will be returned to a prompt in the Windows Azure Active Directory Module.

After changing the setting, you then need to run the Get-MsolCompanyInfo cmdlet to verify that the value has changed to True.

After running the cmdlet, check the displayed information to verify that the UsersPermissionToCreateGroupsEnabled setting value has changed to False.

Identifying the site collections in PowerShell

Connect to SharePoint

Get a list of Site Collections
More than likely the Group SharePoint Site is restricted to the user that may have created it. You may get this error when trying to remove it:

To remove it you need to take ownership as the CollectionOwner

Now if you want to do this for all the site collections:

Once this is applied the admin will be able to remove the hidden Sharepoint collection. Remove the site collections that are no longer needed.

Deleting the Groups

Now to delete the groups that the users created. Head over to the Office365 Admin Portal.

Click the “Office 365 group” from the selection to show all groups (These should be all cloud based)

Once the groups are displayed remove them as necessary.

Groups are no longer in your environment.

Planning for the future: Migration of Distribution Groups to Groups

If you are in Hybrid mode you cannot user Groups in a clean fashion. It will get messy. Sooner or later you will need to plan for migration of your distribution groups to Groups. Know your current limitations and hold.

Migrate distribution lists to Office 365 Groups – Admin help

Distribution list eligibility for migration

The following table lists which distribution lists are eligible or not eligible for migration

Property Eligibility
On-premise managed distribution list. Not eligible
Nested distribution lists. Distribution list either has child groups or is a member of another group. Not eligible
Moderated distribution list Not eligible
Distribution lists with send on behalf settings Not eligible
Distribution lists hidden from address lists Not eligible
Distribution lists with member RecipientTypeDetails other than UserMailbox, SharedMailbox, TeamMailbox, MailUser Not eligible
Distribution lists with member join or depart restriction as Closed Eligible. Converted to a private Office 365 Group.
Distribution lists with custom delivery status notifications. ReportToManager = true, ReportToOriginator = false ReportToManager = false, ReportToOriginator = false Eligible. Office 365 groups don’t understand these properties, and delivery status notifications are always sent to the person that sent the email.

Set password never to expire for users in a particular domain (Bulk mode)

Posted on January 3, 2017 by Office 365

Let me start by saying that I don’t recommend doing this at all.

Password Never Expires is bad security practice, but there are situations that might require it.

I had a similar request on how this could be done.

Setting it for multiple users:

Setting it for a single user:

 

Get PasswordAge for users in a particular domain

Posted on January 3, 2017 by Office 365

In Office365 if you have more than one domain in a subscription, there are times where you may want to get the password age for users of that domain.

In my case to check which users are covered and meeting policy and get the users addressed.

The output will be similar to:

How to force update GlobalAddressList in Office 365?

Posted on December 7, 2016 by Office 365

This post explains how to manually force and update the global address list in Office 365.

Updating the global address list requires to have the Address List Management role. By default, nobody has this role.

1. Assign the AddressList Management role

    • Login with your administrator account to the Office 365 portal.
    • Go to Exchange Admin center, Permissions and admin roles.
    • Create a new role group and assign the AddressList role.addresslistrole

2. Update the AddressList

Once you have the AddressList role assigned, you can use the powershell commands to update the address list. You will have to wait for sometime until the new cmdlets are available.

  • First thing, logon to Exchange online using PowerShell.
  • Run the command Get-AddressList and verify that it’s working. (This may take some to work after creating the role)
  • Run Set-AddressList -Identity “All users”
  • Your address book is now updated
Mo Wasay
My name is Mo Wasay. I work with a variety of technologies and engage with the community and customers around the world. I am located in Dallas, Texas, U.S.A. I like to share my knowledge and experiences and help others who come across similar situations. My current focus is Microsoft Azure, Azure Stack and Windows Server.
View Mo Wasay, MSCS, MCITP, MCSE, VCP, ISM, CIS's profile on LinkedIn