According to my powershell code shown, it should delete all items between 90 days ago and yesterday. For example if I ran this now the date range would be 1/29/2014 - 4/28/2014.
$x = ((get-date).addDays(-90)).ToShortDateString()
$y = ((get-date).addDays(-1)).ToShortDateString()
$xy = "$($x)..$($y)"
Search-Mailbox bunnyb2 -SearchQuery "Received:$xy" -DeleteContent -Force
This is deleting most of the mail it is supposed to. However the mailbox still retains all deleted email up until ((get-date).addDays(-1)) at 7pm. The last 5 hours of email that should be deleted are not.
At first I thought it could be a time conversion issue however the machine I am running the command on is in Central Time USA, and the mailbox server is also Central Time USA.
Also, please do not tell me to do "Search-Mailbox whismj-SearchQuery "Received:<$y" -DeleteContent -Force". This is a whole other can of worms for me. While the code execute absolutely nothing is returned or deleted. However when I take off the < all email that was received yesterday is deleted.
I realize this is an older post, but maybe this will help someone searching.
In order to hit the whole date range, you need to provide multiple options to the -SearchQuery parameter (which is expecting a full AQS query). I've never had luck using the syntax you're using, even though it's listed in the documentation; adding the explicit time seems work when using two Received blocks instead of trying to combine them.
To get all mail in January 2015, try using the following:
-SearchQuery "Received: > $('01/01/2015 00:00:00') AND Received: < $('01/31/2015 23:59:59')
Related
Is there any way to get and list out all my conversations in teams chats for one day? When I'm logging time, I lose track of what I worked on when I'm helping others, and the find function just gives me 8 messages on a big screen, which means I have to scroll through dozens of screens to get the "oh, this is what we're doing". I'd rather have a list with the chat name, time, and what was said. Powershell, CLI, KQL, don't care how. Thanks.
John Doe Chat: Doe, John [10:35] what is this about
John Doe Chat: Me, Myself [10:36] trying to come up with an example
PeopleChatOne: Joe [10:37] what are we, chopped liver?
Okay, after digging for a bit... turns out the answer is, as #sayali-msft and #anothervictimofthemouse mentioned, is the Graph API - which has a module. Note that you DO have a certain amount of access to your own stuff without needing an admins help, but you will have to explicitly grant it to each "application" that will connect to it. And there's a good amount of playing you can do with the Graph Explorer.
The below code will grab all of your chats, then grab the most recent 200 messages, filtered for the past day, and then will return the pertinent info.
Still missing at this point:
time zones seem wonky, specifically people in other time zones.
piping to OGV gives you all lines, when I really only want the first.
Fortunately, format-table DOES limit to one line per message
stripping out HTML works but is not great.
members may not be working.
Install-Module Microsoft.Graph
Import-Module Microsoft.Graph.Teams
$RequiredScopes = #("Chat.ReadBasic", "Chat.ReadWrite")
Connect-MgGraph -Scopes $RequiredScopes
#at this point a browser window should appear - allow it.
#I had to find my user id in graph explorer UI by running GET V1.0 https://graph.microsoft.com/v1.0/me
#unsure how to get it otherwise - but you don't need it with get-mgchat
get-mgchat
#take one of those IDs
#let's look at this chat:
get-mgchat -ChatId 19:deadbeefb2d949d88d4455f5279e5d8b#thread.v2
get-mgchatmessage -ChatId 19:deadbeefb2d949d88d4455f5279e5d8b#thread.v2
#this nests and walks through properly, strips HTML, but lord this will be slow. And shows more than one line per message, even when I try now to.
#By default you can get all your chats by running get-mgchat. -all and -pagesize 50 is required for the module to paginate the request and get you everything. But in my case it grabbed all 2000 chats. The -first 5 is for testing.
$tzone = Get-TimeZone # conversion from GMT to local time. https://jdhitsolutions.com/blog/powershell/7962/convert-to-local-time-with-powershell/
$mychats = get-mgchat -all -PageSize 50 |select -first 5
$all_chat_info = #() #force-setting to an array
$all_chat_info = foreach ($chat in $mychats) {
$chatinfo = get-mgchat -ChatId $chat.id #get base details about the CHAT itself
#set some details about the chat itself for the later query
$chatname = $chat.Topic
$members = $chat.Members
$chattype = $chat.chattype
#now get every message from that chat since midnight yesterday. Note LastModifiedDateTime is GMT. The jdhit page says -($tzone...), but all I had to do was .tolocaltime() ... I think.
#the -top 200 -pagesize 50 is to get the most recent 200 messages, and again you have to paginate.
$recentchatmessages = get-mgchatmessage -ChatId $chat.id -top 200 -pagesize 50 |where {$_.LastModifiedDateTime.tolocaltime() -gt (get-date).date.AddDays(-1)} # all from after midnight yesterday |select -first 5
#and now use select expression to add the above fields and parse the below fields, stripping out HTML (but I can't seem to only get the first line in OGV)
$recentchatmessages | select #{Label='LastModified';Expression={($_.LastModifiedDateTime.tolocaltime())}}, #{Label='ChatName';Expression={($chatname)}}, #{Label='members';Expression={($members)}}, #{Label='ChatType';Expression={($chattype)}},
#{Label='From';Expression={($_.from.user.displayname)}}, #{Label='Body';Expression={ ($_.Body.content -split '\n')[0] -replace '<[^>]+>',''}}
##{Label='From';Expression={($_.from.user.displayname)}}, #{Label='Body';Expression={( ($_.Body.content -replace '<[^>]+>','').split([Environment]::NewLine)|select -first 1)}}
}
$all_chat_info|format-table
#and now close/disconnect
Disconnect-MgGraph
Several problems present themselves:
All and PageSize appear broken (update: use "-all -pagesize 50")
Expanding the fields. Probably trivial for others, but a pain for me.
currently comes back like
Microsoft.Graph.PowerShell.Models.MicrosoftGraphItemBody
Microsoft.Graph.PowerShell.Models.MicrosoftGraphChatMessageFromIdentitySet
Some references I found while getting it working.
https://practical365.com/connect-microsoft-graph-powershell-sdk/ - getting the scope set
graph explorer
https://www.powershellgallery.com/packages/Microsoft.Graph/1.9.2
https://github.com/microsoftgraph/msgraph-sdk-powershell - the github for the actual modules. the readme is gold specifically https://github.com/microsoftgraph/msgraph-sdk-powershell/blob/dev/samples/5-Teams.ps1
I am looking to create a rule in Office 365 applied to all of the members in our org.
I would like this rule to append a warning on all incoming email from outside the organization with the same Display Names as our users.
When I attempt to apply it to all of the users in our org I get an error stating that the rule is too long.
In order to solve that I pulled a group, but I am still about 1000 characters over the limit.
I would like to make two variables, that each hold one half of the list, created by this command:
(Get-DistibutionGroupMember -Identity email#contoso.com -ResultSize Unlimited).DisplayName
I have attempted to modify the ResultSize parameter, but what I would need is result 1-100 and then 100-200 from the same list.
Another caveat to this problem is that the list cannot be static. It is something that the script will have to update every time it is run.
There is a sub-string command that you can use on a particular username that I have utilized when I made something for AD, but I am not aware of any way to break up a list like this.
If anyone has any other ways to solve this issue I would be more than open to any suggestion.
Thanks for taking the time to read this!
There are many ways of doing it. I found it very readable.
My favorite one is this one:
$ObjectList = 1..1000
$Step = 100
$counter = [pscustomobject] #{ Value = 0 }
$ObjectListSplitted = $ObjectList | Group-Object -Property { math]::Floor($counter.Value++ / $step) }
Then if you want to show the third subset just use this format :
$ObjectListSplitted[3].Group
Have a look to this solution already explained.
As a note other languages are capable of slicing an array of object with a start, stop and a step, have a look here if you're curious.
i´ve a quick question regarding a zabbix trigger expression. Our script finds out the certification lifetime while returning a number into a file. I already created some triggers for specific time spans (like 10 days or 44 days).
For example:
{Certificate Lifetime:vfs.file.contents[C:\Zabbix_scripts\cert.txt].prev()}<=30 and {Certificate Lifetime:vfs.file.contents[C:\Zabbix_scripts\cert.txt].prev()}>10
I now want to have a trigger which will cause an "Disaster" when the value in the .txt file is unavailable, like the txt file is empty.
I´ve tried
{Certificate Lifetime:vfs.file.contents[C:\Zabbix_scripts\cert.txt].prev()}=0
But this was not the right sulution. Any ideas?
Moreover we have some machines which are equal to others but doesn´t show any value. Any ideas at this point?
Regards
You should be able to detect empty item value with something like this:
strlen()=0
I'm writing a Powershell runbook that will scale up a VM ScaleSet until an Application Insights alert is resolved.
To do this, I need to query the status of the alert in my Powershell script, ie no if an alert has been triggered or resolved.
I have tried to use Get-AzureRmAlertRule and Get-AzureRmAlertHistory, but this only gives me respectively the disabled/enabled state of the alert rule, or the actions that were perform on the rule itself (ie updating the rule, or deleting the alert, etc).
Is there any way to simply know if an alert is currently being triggered or resolved?
So I'm actively working through this issue too and thought I would share what I found.
The following was pulled from Microsoft documentation:
The Get-AzureRmAlertHistory cmdlet gets the history of alerts as they are enabled, disabled, fired, resolved, and so on.
While messing around with this command, I found that if you don't give it any parameters, it will only return history for the current day; however, when you use the -StartTime and -EndTime parameters you can obtain details of alerts from further in the past.
While this doesn't give you the current status of an alert in a single command, can throw together some logic that will grab the latest alert within a given time range and check the status there.
For my purposes, this code with check the status of a sibling alert from within a runbook that was called from the alert webhook. So I can gather the time ranges based on the data provided in the webhook. I know this isn't a perfect solution for all cases, but at least it could be used as a starting point.
Note: The version of the AzureRM.Insights module I'm working with is 3.2.1 behavior may differ depending on the version of this module you're using.
Update:
As I continued to work on the code, I found that there are some issues with filtering with the -ResourceId parameter. When you provide the ResourceId for the alert that you want to find history on, it won't return any result. From what I can tell, the ResourceId isn't populated when the alert objects are returned when using the Get-AzureRmAlertHistory cmdlet with just the -ResourceId parameter. I did manage to find two ways to get this to work though.
Pass the -DetailedOutput parameter in before the -ResourceId parameter. It turns out that the ResourceId is populated in the DetailedOutput and can be matched there; however, if you pass the -ResourceId in first, the cmdlet acts as though it evaluates that first prior to bringing back the detailed output.
Get-AzureRmAlertHistory -StartTime 2018-01-16 -EndTime 2018-01-17 -DetailedOutput -ResourceId $AlertResourceID
The property CorrelationId contains within it the ResourceId. Using the Where-Object syntax, you can match on your ResourceId using Regex.
Get-AzureRmAlertHistory -StartTime 2018-01-16 -EndTime 2018-01-17 | Where-Object {$_.CorrelationId -Match "$AlertResourceID/incidents/.*"}
Now that you have the records you want, you can use a simple Sort-Object on the -EventTimestamp property and assign the results to a variable. Then if you reference the -1 index of the variable you assigned your results to, it should give you the latest alert instance along with the alert Status.
$AlertHistory = Get-AzureRmAlertHistory -StartTime 2018-01-16 -EndTime 2018-01-17 | Where-Object {$_.CorrelationId -Match "$AlertResourceID/incidents/.*"} | Sort-Object -Property EventTimestamp;
$AlertHistory[-1];
For our website, we set up the account activation email with the following tutorial (in cakephp):
http://www.jonnyreeves.co.uk/2008/06/cakephp-activating-user-account-via-email/
On our live site, it seems that the activation works for the most part, however some people are receiving the following error when clicking on the activation email link to activate their account:
Error: The requested address '/users/activate/36/10a1a794' was not found on this server.
This is odd to me because the link looks fine: "users" controller, "activate" action, user_id = 36, and hash code = 0a1a794. Not sure why this error is happening. One thing I read is to clear the files in the cache folder and that didn't seem to change anything. Please help thanks!
The activation hash has limited validity(same day).
So if send the activation email on 1st of any month, it will be valid till 11:59pm of 1st. The link wont work after 12:00am(technically 2nd of the month).
Hope that helps.
Yes, that's what Josh R said, the hash is computed for the same day and this is a VERY bad idea.
You should either stop hashing the date or validate against two values: one for today's date, one for yesterday's date.
Also, a recommendation: don't just go there and copy the files, try to learn something from it and please, do it your way. You'll learn a lot more.