Microsoft Exchange pour Tous V2 - Microsoft Exchange made simple https://docs.microsoft.com/archive/blogs/samdrey/feed.xml Nouveautés, principes, évolution, trucs et astuces - News, principles, evolution, tips and tricks Tue, 12 Feb 2019 02:19:31 GMT en-US hourly 1 How-To – Find how many connections Outlook makes to your Exchange infrastructure using Netstat.exe https://docs.microsoft.com/archive/blogs/samdrey/how-to-find-how-many-connections-outlook-makes-to-your-exchange-infrastructure-using-netstat-exe Mon, 11 Feb 2019 13:05:13 GMT https://blogs.technet.microsoft.com/samdrey/?p=5485 TaskList.exe command (default Windows command line utility) to get a specific process name and ID, and the Netstat.exe command (also a default Windows command line utility) to quickly find the opened connections from a specific application.   Note: you can use other tools to get these, like the Windows Task Manager for example to find the process names and IDs, and/or the excellent TCPView from sysinternals to graphically see the opened connections along with process names… or you can use any network analyzer tool (like Microsoft Message Analyzer, Network Monitor, Wireshark, …) or even the Windows Resource Monitor (Resmon.exe)  if you prefer.   When you launch an application like Outlook, it usually opens a process that has a specific ID. We are going to get the ID for the Outlook application, which associated process and then run Netstat to find out how many lines, in other words how many network connections and on which port do we have opened for Outlook.  

  • Step 1: Get your Outlook PID using Tasklist

  Run the below command: 
Tasklist | find /I “outlook.exe”
This command is leveraging MS-DOS TaskList.exe command, and we use the “Find” command after a pipe to just output the line of the whole output that include the “outlook.exe” process. The output will look like the below: Fig. 1 - Outlook PID = 4028  

  • Step 2 : Get the opened connections by this PID using Netstat:

  Run the below command: 
netstat-ano -p TCP | find /I “PID_Found_Above”
This command leverages Netstat with the -a -n -o options combined into one -ano parameter, and focussing on the TCP protocol. Then we use the “Find” command after a pipe to just output the line that include our process ID that we found on Step 1. Fig. 2 – 2 entries, one for Mailbox connection, one for Directory connection   Here I see 2 entries:   
TCP        192.168.2.56:50701               192.168.2.50:443            ESTABLISHED               4028
TCP        192.168.2.56:50702               192.168.2.50:443            ESTABLISHED               4028
  One is for Mailbox connection (download e-mail body and attachments, mark e-mail as read, move and/or delete e-mails, etc...), and the other one is for Directory connection (for address book resolution in Outlook, address book searches, etc…).  

Conclusion

When you see 2 entries like the above example that I paste below again: 
TCP        192.168.2.56:50701               192.168.2.50:443            ESTABLISHED               4028
TCP        192.168.2.56:50702               192.168.2.50:443            ESTABLISHED               4028
This means I have 2 network connections that Outlook is making to my Exchange server. Note that this is the case for MAPI over HTTP, AND when you don’t have any additional mailboxes (shared mailboxes or a mailbox where you have full mailbox access and brought to your profile using auto-mapped mailboxes). If you are using Outlook Anywhere aka RPC over HTTP (which is deprecated in Office 365’s Exchange Online), we will have an additional connection, as RPC over HTTP needs 2 connections as opposed to MAPI over HTTP: one RPC over HTTP connection for e-mail sending (RPC-OUT : uploading e-mail data from Outlook to Exchange), and one RPC over HTTP connection for e-mail receiving (RPC-IN : downloading e-mail data from Exchange to Outlook) – that way with the Exchange Directory connection, we will have at least 3 connections for an Outlook with a profile that just has one mailbox configured in Online mode).    On Outlook (in Online mode) Connection Status you will find 3 entries:
  • Exchange Directory which session type is Foreground
  • Exchange Mail which session type is Foreground as well
  • And another Exchange Directory which session type is “Background”
  Fig.3 – Outlook Connection Status view    The Exchange Directory “Background” is essentially there for the cached entries, but does not account for a network connection. As long as Netstat shows only 2 entries, I guess we can tell the network guys that Outlook / Exchange in MAPI over HTTP mode, without other Public Folder and without additional groups and shared mailboxes, only needs 2 network connections opened between Outlook and Exchange…  Note: the TCPView tool mentioned above enabled you to get the application name and its opened Network connections a bit faster, here’s an example here: Fig. 4 - TCPView graphical user friendly interface to achieve the same as the above 2 steps, in one tool  

Resources

 Remove Automapping for a shared mailbox in Office 365 https://support.microsoft.com/en-us/help/2646504/how-to-remove-automapping-for-a-shared-mailbox-in-office-365 Microsoft Message Analyzer: https://www.microsoft.com/en-us/download/details.aspx?id=44226 Network Monitor v3.4 (deprecated but still functional) https://www.microsoft.com/en-us/download/4865  ]]> Exchange 2013/2016/2019 & ExO - a sample Get-Mailbox GUI https://docs.microsoft.com/archive/blogs/samdrey/exchange-get-mailboxes-gui Mon, 19 Nov 2018 00:05:34 GMT https://blogs.technet.microsoft.com/samdrey/?p=5455 Download link is at the very end of this article.

Principle

For this GUI, I designed the interface using Windows Presentation Foundation, which is the next generation of Windows Forms, and which enables anyone to design Windows interfaces for underlying programs, to help users to get the most from computer programs. Here's the principle used to create this Powershell application using WPF:
  • First, I designed the Windows Presentation Foundation forms using Visual Studio 2017 Community Edition (which is free), and pasted the generated XAML code from Visual Studio 2007 into a PowerShell script - in this script I pasted directly the XAML code into a PowerShell "here-string", but you can load the XAML code from a separate file using Get-Content for example, that way if you want to change your Windows WPF form design, you just have to modify or paste the new code from Visual Studio directly into that separate file and leave your .ps1 script alone.
  • then with a PowerShell code snippet I parsed the XAML code to get the form objects that PowerShell understands - buttons, check boxes, datagrids, labels, text blocks used as inputs as well as outputs sometimes (to put the PowerShell commands corresponding to the users input for example), and the form object itself, which is the container of all the other objects (buttons, checkboxes, etc...)
  • and finally I wrote the functions behind the form that I want to run when the form loads, when we click the buttons, when we check or uncheck the checkboxes, when we change the text in text boxes, or when we select items from datagrids => for code to execute when the user interacts with Windows WPF forms, we must use the WPF form object's "events" (add_click, add_textChanged, add_loaded, add_closing, etc...) => you can retrieve Windows WPF form objects on the MSDN, or simply on Visual Studio 2017 when you design your form (switch from object properties to the object events to view all available events for a selected object)
 
    I tried to make a synoptic view of the process in the below schema with small sample screenshots of my Visual Studio 2007 / Vistual Studio Code parts - you'll find the WPF - to - PowerShell code snippet sample I'm referring to in the below schema in this GitHub repository... WPF from Visual Studio to PowerShell

    Important notes

    This PowerShell app requires PowerShell V3, and also requires to be run from a PowerShell console with Exchange tools loaded, which can be an Exchange Management Shell window or a PowerShell window from where you imported an Exchange session, see my TechNet blog post for a summary on how to do this (right-click => Open in a new tab otherwise below sites will load instead of this page):

    Screenshots - because a picture is worth 1000 words...

    First window when launching the tool
    screenshot1
    After a sample Get-Mailbox which name includes "user" string
    screenshot2 Note that for cloud mailbox, the "Location" column will tell you that the mailbox is hosted in the cloud: screenshot2.1
    If you select "Unlimited" under the Resultsize (max number of mailboxes to search), or a number that is greater than 1000, you get a warning asking you if you want to continue
    screenshot3 screenshot3.1
    Selecting mailboxes in the grid, notice the "Action on selected" button that becomes active
    screenshot4
    Action : After selecting some mailboxes in the grid, calling the "List Mailbox Features" action in the drop-down list
    screenshot5
    Action: Anoter action possible, calling the Single Item Recovery and mailbox dumpster limits for the selected mailboxes
    screenshot6
    Action: List mailbox quotas, including database quota for each mailbox
    Note that mailbox quotas list include the Database info quota - that is useful when mailboxes are configure to use Mailbox Database Quotas screenshot7
    On most actions, you can copy the list in Windows clipboard (will be CSV Formatted) for further analyis, reporting or documentation about your mailboxes
    screenshot8

    More to come...

    Download link You can also retrieve this project on this page of my GitHub site...]]>         Exchange Server 2013/2016/2019 Components Checker https://docs.microsoft.com/archive/blogs/samdrey/exchange-server-components-checker Mon, 29 Oct 2018 22:15:37 GMT https://blogs.technet.microsoft.com/samdrey/?p=5425 tool download link at the end of this article) NOTE: this tool needs to be run from an Exchange Management Shell, or from a PowerShell host where you imported an Exchange PowerShell session These “Server Components” were introduced back in Exchange 2013, and are part of the Exchange Managed Availability features, and are there to ease server maintenance: inactive components are not targeted by the Client Access Services so that you can perform maintenance without having to affect the other Exchange services.
    • Choose your server version, Exchange 2013 or Exchange 2016 (Exchange 2019 coming soon), to check the components from
    • [ ] CheckOnly checkbox will just check and show each component from each of your organization’s servers: if checked, the tool will not attempt to start the inactive components
    • [ ] HybridServer checkbox will check two additional components that are used on Hybrid Exchange – O365 scenarios
    • [ ] Show Inactive Only : this checkbox will filter out all the Active components, so that you can check right away which servers and which components have Inactive services. You can check or uncheck it anytime, before or after the Server Components collection
    • Once you are happy with the chosen options, click the [Run] button to start gathering the information (at the bottom is the status bar along with a status label)
    screenshot1 NOTE: once the components are gathered and show up, you can select all (click on one of the result cell, then CTRL+ a followed by CTRL + v) and paste it in a report, in Excel: screenshot2 And finally, you're able to start the Exchange Server Components with the requester of your choice (Maintenance, SideLine, Functional, Deployment,...) - just uncheck the [ ] CheckOnly check box, choose your requester, and click [Run] screenshot3 More information on these Exchange Server Components: blogs.technet.microsoft.com/exchange/2013/09/26/server-component-states-in-exchange-2013   Download this tool here.   You can also retrieve this project on this page of my GitHub site...]]>         Dynamic Distribution Group creation tool (PowerShell command generator to create Distribution Groups) https://docs.microsoft.com/archive/blogs/samdrey/dynamic-distribution-group-creation-tool-powershell-command-generator-to-create-distribution-groups Fri, 08 Jun 2018 19:59:50 GMT https://blogs.technet.microsoft.com/samdrey/?p=5395 I. Introduction See the Download section below for the link to download the tool. In Exchange 2010/2013/2016 and Exchange Online (the messaging component of Office 365), we can create Dynamic Distribution Groups in two ways :
    1. Using the Exchange Administration Console (HTML based)
    2. Using the Exchange Management Shell (Command line based)
    More information about the ways to create and manage Dynamic Distribution Groups on this link… The Dynamic Distribution Groups are a type of group that base their memberships on a query on other mail-enabled objects such as User Mailboxes, Room Mailboxes, or any object stamped with an e-mail address and that Exchange Server can read.
    NOTE: When we use PowerShell to create a Dynamic Distribution Group, if we don’t specify the Scope of the query of a Dynamic Distribution Group, by default the scope will be the location where the Dynamic Distribution Group is created => and this is often something that takes hours until we found the cause of “non-working” Dynamic Distribution Groups, because everything else look very normal about these.
    The tool I am giving here is meant to generate the PowerShell (Exchange Management Shell actually because you need the Exchange Tools to make it work) command line to create a Dynamic Distribution Group, without forgetting to specify the “scope” of the Dynamic Distribution Group filter. Also, the other command line generated is meant to modify the scope and the filter of an exising Dynamic Distribution Group. This is an Excel based PowerShell command generator, next challenge is to do the same but with WPF ! That will be for another blog post !

    II. Tool description

    a. General overview

    clip_image002 The tool is composed of 2 main parts:
    1. The input part, where we define the Dynamic Distribution Group scope, its location (an Organizational Unit), its name, optionally its Alias (that is what is used to generate the Dynamic DG e-mail address) – if you don’t specify it, Exchange will automatically convert the name into an alias, replacing all spaces and special characters with an hyphen or a dash (“-“).
    2. The PowerShell command part, that you will copy and paste on an Exchange PowerShell window to create or modify your Dynamic Distribution Group. There are 2 command lines in that part :

    a. 

    New-DynamicDistributionGroup
    -> that is to create a new Dynamic Distribution Group with the parameters you chose on the part #1 – Input part. b. 
    Get-DynamicDistributionGroup
    -> that is to modify an existing Dynamic Distribution Group with the scope and filter parameters you chose on the part #2 – Input part.

    b. Input details

    See the below schema for the explanation of each input part. clip_image004

    c. Command part details

    See the below schema for the explanation of the two PowerShell command lines. clip_image006

    III- Using these to create a new Dynamic DG or modify an existing Dynamic DG

    NOTE: for this last part, you need the following skills : ability to copy and paste things Once you have your command line ready, that are generated by the tool based on the input parameters you chose, just copy one of the command lines, and paste it on a script, or directly on the Exchange Management Shell. Example, I want to create a new Dynamic Distribution Group with the sample options of the screenshots above : - Step #1 : Select the blue box and hit CTRL + C clip_image008 - Step #2 : Paste the command You can choose either to paste the command on a Notepad to save it later as a .PS1 script: clip_image010 Or you can paste it on a PowerShell ISE window on your remote connected server: clip_image012 Or you can directly paste it on an Exchange Management Shell window (WARNING: this will execute your command as well): clip_image014 And that applies for both of the blue boxes containing the New-DynamicDistributionGroup / Set-DynamicDistributionGroup commands.  

    IV- Download link

     Of course you can use it to create a base command line, and then add all the options you want to customize your Dynamic Distribution Groups, the tool just generates the basics of a Dynamic Distribution Group creation and only modifies the scope and filter … for example we don’t set any delivery restrictions, owners, etc…, just the basics. You can DOWNLOAD this Excel tool here. Have a good one ! Cheers Sam]]>         PowerShell command line generator for Exchange (2010,2013, 2016) Recovery Database creation and make it use existing database and log files https://docs.microsoft.com/archive/blogs/samdrey/powershell-command-line-generator-for-exchange-20102013-2016-recovery-database-creation-and-make-it-use-existing-database-and-log-files Tue, 05 Jun 2018 10:11:23 GMT https://blogs.technet.microsoft.com/samdrey/?p=5245 Description Download link at the very end of this article... This program is a Graphical User Interface that will help you generating Exchange Management Shell command lines to:
    1. Create a Recovery Database using temporary path for the database and its corresponding LOG files set
    2. Point that newly created Recovery Database to an existing database file and its corresponding LOG files set
    3. Display the newly created Recovery Database and its paths just modified
    4. Mount the Recovery Database using the existing database file and corresponding LOG files set
    5. (or 4bis) - Displaying the status and file paths of that database again (just to confirm)
    Fig.1

    Launching it

    Just type .\Launch-RecoveryDatabaseCreateGUI.ps1 or "Run with Powershell" from Windows Explorer: Fig.2 Once you have the desired values for your Server name, your EDB file and LOG paths, etc..., Clicking on the [Copy to Clipboard] button will copy the command list to the Clipboard. => that way, you will be able to paste your commands in a PowerShell script, or in a NOTEPAD, or directly in an Exchange Management Shell for immediate execution ! Fig.3
    Note: In order to see the "Run with Powershell" context menu on Windows Explorer, you need to set "Notepad" as the default "open with" program for .PS1 files -> see the "Miscellaneous" section below if you don't have your "Run with PowerShell" menu and if you with to get it back.
    Note2: if you reset the ".PS1" file association with NOTEPAD, you'll lose any previous association you made with ".PS1" files...

    Miscellaneous : How to retrieve your "Run with Powershell" menu from Windows Explorer

    If you don't find your "Run with PowerShell" menu anymore when right-clicking a PS1 file, you just have to reset the default program to open .PS1 to be the basic Windows "Notepad". Here's how to do it :
    1. Right-click to any .PS1 file, and click "Open with":
    Fig.3
    1. Choose Notepad, and ensure the [x] Always use this app to open .ps1 files is checked :
    Fig.4
    1. You're done ! From now on, and until you change the default editor for .ps1 files, you'll see the "Run with PowerShell" context menu when you right-click a .PS1 file:
    Fig.5

    Download

    Download it on TechNet Gallery Or get it on the tool's GitHub page]]>         Autodiscover test tool - (c) from Kip Ng https://docs.microsoft.com/archive/blogs/samdrey/autodiscover-test-tool-c-from-kip-ng Mon, 28 May 2018 11:58:49 GMT https://blogs.technet.microsoft.com/samdrey/?p=5215 Microsoft Remote Connectivity Analyzer would do, but standalone and more dedicated to Exchange or O365 (Exchange Online) Autodiscover process. And I found this very practical, simple to use, useful Autodiscover test tool that Mr Kip Ng created for us, thanks Kip ! (Disclaimer: Kip is now my manager, but it's not the reason I'm buttering him up or backslapping: I'm just mentionning his work on this tool because it helped me more than once. However, I also have to mention that he's a handsome guy and a great manager :-p ) As a reminder, Autodiscover process is the very first step that E-mail clients like Outlook perform when a user first launch it and/or tries to connect to his mailbox for the first time. See more information about Autodiscover here. The process has not changed much since Exchange 2007... This Autodiscover test tool works very well for Exchange 2010, 2013, 2016, as well as Exchange Online (O365) ! I won't write a lot about this tool as Mr. Kip Ng already describes it well on his blog post, but basically it will use the same process that Outlook (2010 -> 2016) is using to find a user's mailbox connection settings, querying Autodiscover just like an Outlook client would do, and showing the results (the discovered URLs for OWA, ECP, EWS, UM, ...) on the command line window. Here are the links on both his blog post and a direct download link for convenience:   Here's an execution sample on my E2010 environment
    Note: I tested on Exchange 2016 as well as on my corporate Exchange Online mailbox -> all work good
    C:\>AutodiscoverTest.exe -email:User1@E2010Domain.com -username:User1@E2010Domain.com

Autodiscover Testing Utility:

AutodiscoverTest.exe -email:<emailaddress> [-allowselfsigned:{true|false}] [-username:<username>] [-password:<password>] [-url:<autdiscover url>]

where:

emailAddress - smtp address to autodiscover
 true|false - allow self signed certificates, default - false
 username - user name for https: requests authentication, eg. <domain\user> or
UPN
 password - user password for https: requestsauthentication
 url - specify a specific url for autodiscover test

If username/password/domain are not specified, default credentials are used.

----------------------------

Password not defined!
Please enter your password: ********

..starting Autodiscover test for 'User1@E2010Domain.com'
..using the specified credentials for HTTPS
..username: User1@E2010Domain.com
..domain:
..verifying E-mail address.
..starting SCP Lookup for domainName=E2010Domain.com
..Scanning for SCP urls for the current computer Site=SITE2
..SCP Url with other Site keyword found 'https://mail.e2010domain.com/autodiscover/autodiscover.xml'
..trying 'User1@E2010Domain.com' at 'https://mail.e2010domain.com/autodiscover/autodiscover.xml'

User/DisplayName=User1
User/LegacyDN=/o=E2010ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=User14a8User/DeploymentId=37c0a5c5-1928-4ce9-a03d-e0b0e66cf138
Account/AccountType=email
Account/Action=settings
Account/Protocol/Type=EXCH
Account/Protocol/ASUrl=https://mail.e2010domain2.com/ews/exchange.asmx
Account/Protocol/DirectoryPort=0
Account/Protocol/MdbDN=/o=E2010ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=Outlook.contoso.com/cn=Microsoft Private MDBAccount/Protocol/OABUrl=https://mail.e2010domain2.com/oab/ef0acab4-4923-499b-86ed-413979af4c74/
Account/Protocol/OOFUrl=https://mail.e2010domain2.com/ews/exchange.asmx
Account/Protocol/Port=0
Account/Protocol/ReferralPort=0
Account/Protocol/Server=Outlook.contoso.com
Account/Protocol/ServerDN=/o=E2010ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=Outlook.contoso.com
Account/Protocol/ServerVersion=7383807B
Account/Protocol/UMUrl=https://mail.e2010domain2.com/ews/UM2007Legacy.asmx
Account/Protocol/PublicFolderServer=E2010-NODE2.E2010Domain.com
Account/Protocol/AD=E2010ENV-GC1.E2010Domain.com
Account/Protocol/EwsUrl=https://mail.e2010domain2.com/ews/exchange.asmx
Account/Protocol/EcpUrl=https://mail.e2010domain2.com/ecp/
Account/Protocol/EcpUrl-um=?p=customize/voicemail.aspx&exsvurl=1
Account/Protocol/EcpUrl-aggr=?p=personalsettings/EmailSubscriptions.slab&exsvurl=1
Account/Protocol/EcpUrl-mt=PersonalSettings/DeliveryReport.aspx?exsvurl=1&IsOWA=<IsOWA>&MsgID=<MsgID>&Mbx=<Mbx>
Account/Protocol/EcpUrl-ret=?p=organize/retentionpolicytags.slab&exsvurl=1
Account/Protocol/EcpUrl-sms=?p=sms/textmessaging.slab&exsvurl=1
Account/Protocol/Type=EXPR
Account/Protocol/AuthPackage=Basic
Account/Protocol/DirectoryPort=0
Account/Protocol/OABUrl=https://mail.e2010domain2.com/oab/ef0acab4-4923-499b-86ed-413979af4c74/
Account/Protocol/Port=0
Account/Protocol/ReferralPort=0
Account/Protocol/Server=mail.e2010domain.com
Account/Protocol/SSL=On
Account/Protocol/Type=WEB
Account/Protocol/DirectoryPort=0
Account/Protocol/Port=0
Account/Protocol/ReferralPort=0
Account/Protocol/Internal/OWAUrl[@AuthenticationMethod="Basic, Ntlm, Fba, WindowsIntegrated"]=https://mail.e2010domain2.com/owa/
Account/Protocol/Internal/Protocol/Type=EXCH
Account/Protocol/Internal/Protocol/ASUrl=https://mail.e2010domain2.com/ews/exchange.asmx
    ]]>         Event Logs CSV Collector: Created a Graphical User Interface around the Get-EventsFromEventLogs.ps1 script https://docs.microsoft.com/archive/blogs/samdrey/event-logs-csv-collector-created-a-graphical-user-interface-around-the-get-eventsfromeventlogs-ps1-script Wed, 23 May 2018 11:26:56 GMT https://blogs.technet.microsoft.com/samdrey/?p=5175 Function IsPSV3 () - required) and exit if not *** Hi mates,   This is just a quick post to let you know that if you would prefer some mouse interaction and a more graphical input for the Get-EventsFromEventLogs script. Basically, this GUI will let you fill the Computers, the Event ID and/or the Event Sources, as well as the Event Log types you wish to search in (Application and/or System and/or Security - note that for the "Security" event logs, you need Local Admin permissions on whichever machine you want to collect these), and the Events Level you want to search or export. As you fill the boxes and check the options, you'll see the command line that will built itself as options are checked or unchecked, and as input boxes (Servers, Event ID(s), Event Sources) are filled or cleared:
    NOTE: the "auto-fill" part of the PowerShell script is not more than a function that is called each time a mouse "click" event is registered on the Graphical Interface, and each time the text inside a box is changed, and that function checks all the WPF form controls (a control is a check box, or an inputbox, or a button, etc... it's an element of the form a user can interact with) and update the text in the "Function Command Line" box each time a "click" or "text changed" event is detected on the WPF form.
    Here's the whole interface:
    NOTE: when the "[X] Save events to file" checkbox is checked, the program will automatically save your results on a file on the same directory where the script is located, and open up the file in NOTEPAD at the end of the execution. If you leave this unchecked, the results will just be printed in the underlying PowerShell window (that's great to have an overview of the events as well as a summary of the Errors / Warnings / Critical / Information events before saving these in to a file for further analysis - with PowerBI Template for example :-) )
     
    NOTE2: by default, if you don't specify a computers list, and if you don't check any log types (App / Sys), the program will check and display the 30 last events of the local machine where the script is executed, from the Application and System event logs.
     
    NOTE3: the "Speech" section is in alpha version for now, as 1) I didn't translate every messages into both French and English, and 2) PowerShell will wait until the computer finishes to speak before releasing the interface to you, and I made it speak each time you check a box ... 
      You can download the PowerShell Events Collector GUI here - note that I also include the PowerBI Template in the archive, it's optional to use, just in case you'll like to test using PowerBI with event logs analysis some time... Have a great one, Cheers Sam]]>         How To: Use a PowerBI template to analyze Event Logs exported as a CSV file https://docs.microsoft.com/archive/blogs/samdrey/how-to-use-powerbi-event-log-analysis-template-with-your-own-events-csv-file Fri, 04 May 2018 20:08:17 GMT https://blogs.technet.microsoft.com/samdrey/?p=4915 Prerequisites/Ingredients Before loading the PowerBI template I made for you, you must have a CSV collected with the Get-EventsFromEventLogs.ps1 script. See the following sections…

    Collect your events using the Get-EventsFromEventLogs script

    Collect the events from your servers using the Get-EventsFromEventLogs.ps1 script, preferably using the following parameters – just replace the Server01, Server02 with your computers, or the content of a Computers.txt file: 
    .\Get-EventsFromEventLogs.ps1 -Computers Server01,Server02 -EventLevel Warning,Error,Critical -NumberOfLastEventsToGet 200 –ExportToFile
    Note: to get the computers list from a text file use the following syntax just after the -Computers parameter : 
    -Computers $(Get-Content C:\temp\Computers.txt)
    The exported CSV file will be located on the same directory where you placed your Get-EventsFromEventLogs.ps1 script, and will be named like "GetEventsFromEventLogs_blabla-Date-Time.csv"

    Get the PowerBI template

    The template created to work with the file exported with the Get-EventsFromEventLogs.ps1 script is named : 
     Event_Dump_Analysis_Template.pbit
    See the prerequisites above for the download link - I'm placing here for convenience in case you forgot to go through the prerequisites.

    Open the PowerBI Template (PBIT) and point it to your CSV Events file

    NOTE: you will need the CSV file that was generated by the Get-EventsFromEventLogs.ps1 script introduced on section 2 above… Open it -> you will have an error just after PowerBI Desktop loaded => it is expected because we didn't specify the GetEventsFromEventLogs-xxxx-xxxx-xxx.CSV file to analyze yet ! It's coming on next step. Here's the expected error you'll get because at this point we didn't load our correct CSV file (I had to put a dummy value on the "URI" field to create the template because PowerBI doesn't have the functionality to request a CSV file prior to load the template for now): Click "Close" -> you'll see the first page of the report with blank values (because you didn't load your CSV yet !): Click on "Edit Queries" button – I'm highlighting the button below so that you can't miss it : This will open the "Power Query Editor" window: See the "APPLIED STEPS" on the far right of the screen above? Here's a closeup of it: And a bit closer: There is an entry in the list called "Source" with a configuration gear beneath it -> click on the configuration gear of the "Source" entry, which will lead you there: Closeup of the field we'll need to change: See the value you see in "URL" (default is .\GetEventsFromEventLog.csv, which is purposely invalid) => Change it to the path to the CSV file generated by your Get-ExchangeFromEventLogs.ps1 script – here I'll take my CSV file located in my C:\TEMP\ directory, and which I renamed MyEvents.CSV – I'll then specify in the "URL" field "C:\TEMP\MyEvents.CSV" – This is an example, just put your actual full CSV path and file name : Click "OK" -> you should see the first elements of your CSV on the "Power Query Editor" window: And click on the "Close and Apply" button on the upper left corner of the "Home" ribbon menu: And Magic Happens ! Your PowerBI report will be filled with the stats from your collected CSV ! Navigate to the other tabs to see your events stats, click on the bars and/or on the servers to see the information filtered dynamically. 
    -------------------------- EXAMPLE 1 --------------------------
    The "Errors only for each server" tab: Click on the first bar (you'll see 1 bar per server – if you have 40 servers, you'll see 40 bars showing the number of Event Logs errors per server), and see the below table filtering dynamically to the error events that belong to that server only : Same principle if you click an event in the below table, for example the first line that has 356 errors for my MSExchangeRepl service, it will show on which server these are distributed : 
    -------------------------- EXAMPLE 2 --------------------------
    Let's see the "Errors/Warnings per provider name" tab : Here I have all the Errors and Warnings filtered in this page, shown by "Event Source" aka "Provider Name" (I should have renamed it). Same here, you can click either on one event on the below table to see the distribution per server or like the example below, on one of the category for which you'd like to see the errors and which server has this event – below I clicked on "Service control manager" 
    -------------------------- EXAMPLE 3 --------------------------
    Finally, you can dig a bit more and check for the details of event logs with the last tab "Fine analysis – All events" – you can select a "ProviderName" aka "Event Source", or a server (one of the two bars below), or an event, and see what it does – below is the table before clicking on a "ProviderName": And below the table after clicking on the "ESE" Provider Name aka Event Source: You see I have this event on only 1 of my servers (1 bar show up when I click on "ESE") … Have fun ! Cheers Sam]]>         PowerShell scripts to Migrate Exchange Mailbox and Distribution Group Send As, Full Access and Send On Behalf Permissions into a CSV file–Part I : Export Script https://docs.microsoft.com/archive/blogs/samdrey/powershell-script-to-migrate-exchange-mailbox-and-distribution-group-send-as-full-access-and-send-on-behalf-permissions-into-a-csv-file-part-i-export-script Sun, 29 Apr 2018 22:42:47 GMT https://blogs.technet.microsoft.com/samdrey/?p=4635
  • You wish to audit the permissions globally set to your mailboxes across the whole organization –> export the permissions, and analyze these within Excel with the power of “Format As Table”, filtering, pivot tables, … and why not, make executive reports of these permissions with our powerful PowerBI ! I'll also blog later on this one for a couple of examples...
  • You wish to migrate your mailboxes and your Distribution Groups to another forest, and you wish to keep the Send As, Full Access and Send On Behalf permissions. That’s in case you’re migrating your mailboxes cross forest not using the New-MoveRequest cmdlet cross forest, because these will keep those permissions (see this older but still accurate post from the Exchange Product Team for more information)
    • This is the Part I which introduces and gives you the script to export the Mailbox / Distribution Groups permissions, named Export-MailboxFASAPermissions.ps1 ("FASA" stands for Full Access and Send As - although the scripts include the export/import of the Send On Behalf permissions as well). I'll refer to that script as to EXPORT script in this articles quick series (Export/Import - a bit equivalent to Migrate). The Part II will come later and introduce the Import-MailboxFASAPermissions.ps1. I’ll refer to this Import-MailboxFASAPermissions.ps1 as to “IMPORT script”.
    NOTE 1: in the case of permissions "migration", which is nothing else than an Export of the permissions from an environment, to later import these to a target environment. The key used to match users between the source forest and the target forest will be the user SMTP address for the mailboxes to re-populate with permissions – because an SMTP address uniquely identifies a mailbox. NOTE 2: When exported with Get-ADPermission or Get-MailboxPermission, the Send As and Full Access permissions are referenced with DOMAIN\Alias of the users. When exported with Get-Mailbox, GrandSendOnBehalfTo permissions are referenced with the DOMAIN/OU1/SUB-OU/Alias type notation.
    The EXPORT script exports the Send As and Full Access permissions in the form DOMAIN\Alias. If you import in a different forest, the IMPORT script will let you specify a domain to populate these permissions in the form of TARGET_DOMAIN\Alias - easily achieved by splitting the SOURCE_DOMAIN\alias string using the "\" as a separator, and concatenating the "alias" with the "TARGET_DOMAIN" using PowerShell's "-Join" of "$MyArray.Join("\")" method (by default the IMPORT Script will import these permissions as they were on the source environment, using SOURCE_DOMAIN\Alias).
    NOTE 3: GrantSendOnBehalfTo can only be given to Mailbox-Enabled users, Mail-Enabled Users, or Mail-Enabled Security Groups. These are exported in the notation indicated in NOTE 2, but the script converts these to their SMTP Address – remember the GrantSendOnBehalfTo can only contain Mailbox-Enabled users, Mail-enabled users or mail-enabled security groups => that way, the Get-Recipient cmdlet resolves the DOMAIN/OU1/SUB-OU/…/Alias into an SMTP address => since an SMTP address uniquely identify a recipient, converting the DOMAIN/OU/…/Alias notation to an SMTP address in the CSV file simplifies the Import as well, as we will just use Set-Mailbox <MailboxSMTPAddress> –GrantSendOnBehalfTo “User1SMTPAddress”, “User2SMTPAddress”, “…” which will work provided the UserxSMTPAddress exist in the target environment.
      As an important usage note, you'll notice on the Get-Help dump below that the script has 3 syntaxes:
    • One that exports Shared and Resource mailboxes only
    .\Export-MailboxFASAPermissions.ps1 -SharedMailboxes -ResourceMailboxes
    • One that exports Distribution group with the option to Include or not the Dynamic Distribution groups
    .\Export-MailboxFASAPermissions.ps1 -DistributionGroupsOnly -IncludeDynamic $true/$false
    • One that checks the script version
    .\Export-MailboxFASAPermissions.ps1 -CheckVersion
    There is one other use which is just launching the script without options: 
    .\Export-MailboxFASAPermissions.ps1
    This will export all the Mailboxes permissions. Here’s the help of the EXPORT script – the download link is at the very end of the help dump: 
    PS>get-help .\Export-MailboxFASAPermissions.ps1 -full

NAME
     .\Export-MailboxFASAPermissions.ps1
     
SYNOPSIS
     Export Exchange Mailbox Send As, Full Access, and Send On Behalf permissions
     in a CSV file in order to later import them in another environment using the 
     output CSV file.
     
     
SYNTAX
     .\Export-MailboxFASAPermissions.ps1 [[-SharedMailboxes]] [[-ResourceMailboxes]] [[-OutputFile] <String>] [<CommonParameters>]
     
     .\Export-MailboxFASAPermissions.ps1 [[-DistributionGroupsOnly]] [[-IncludeDynamic] <Boolean>] [<CommonParameters>]
     
     .\Export-MailboxFASAPermissions.ps1 [[-CheckVersion]] [<CommonParameters>]
     
     
DESCRIPTION
     This script requires the Exchange tools to run.
     
     It exports the following Exchange Mailbox permissions in a CSV file 
     - Send As
     - Full Access
     - Send On Behalf To
     in order to be able to import them later in another environment using 
     the output CSV file.
     
     The Output CSV file will contain the following information for each mailbox permissions
     information exported:
     
     Display Name, Primary SMTP Address, Full Access permissions, Send As permissions, Send On Behalf permissions
     
     The permissions can have one or more entries, which will be separated by semicolons (";")
     
     To import back the permissions if needed , you can use the associated Import-MailboxFASAPermissions.ps1 
     script.
     
     Since the Send As and Full Access permissions can be granted to non-mailbox or
     non-mail enabled users, these are stored in the CSV in the form of DOMAIN\Alias.
     
     On the other hand, the Send On Behalf permission can be granted only to mailbox-enabled users,
     mail-enabled users and/or mail-enabled security groups only. For some reason, it is stored in 
     the form of DOMAIN\OU1\Sub-OU1\...\Name - then, the script is designed to convert these - actually
     the script resolve these using Get-Mailbox -Identity DOMAIN\OU\...\Name to get and store the
     PrimarySMTPAddress of these users so that we have two advantages:
         > Not only we are sure that each SMTP address represents a unique user
         > Also it will be way easier for the IMPORT script to import these permissions back, wherever OU the
         target user will be located !
     
     This is because the IMPORT script uses Set-Mailbox with the -SendOnBehalfTo, where we can
     specify an SMTP address, which will be converted to the corresponding DOMAIN\OU\Name of the 
     corresponding user in the target environment.
     
     In other words, the SMTP address will be the KEY to match the SendOnBehalfTo permission to the
     right users and mailboxes on the target environments.
    

PARAMETERS
     -SharedMailboxes [<SwitchParameter>]
         This indicates the script to export the SharedMailboxes only
         
         When combined with the -ResourceMailboxes, the script will export
         the Shared Mailboxes, and the Room and Equipment Mailboxes as well !
         
         To export ALL mailboxes, just don't specify neither the SharedMailboxes
         nor the ResourceMailboxes parameter.
         
         Required?                    false
         Position?                    1
         Default value                False
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     -ResourceMailboxes [<SwitchParameter>]
         This indicates the script to export the ResourceMailboxes only which
         consist of the Room and the Equipment Mailboxes.
         
         When combined with the -SharedMailboxes, the script will export the
         Shared Mailboxes, the Room and the Equipment mailboxes as well !
         
         To export ALL mailboxes, just don't specify neither the SharedMailboxes
         nor the ResourceMailboxes parameter.
         
         Required?                    false
         Position?                    2
         Default value                False
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     -DistributionGroupsOnly [<SwitchParameter>]
         
         Required?                    false
         Position?                    4
         Default value                False
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     -IncludeDynamic <Boolean>
         
         Required?                    false
         Position?                    5
         Default value                True
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     -OutputFile <String>
         Sets the file to which we want to store the results.
         By default, the script will generate a CSV report with the name of the script, 
         with the date and time appended to it.
         
         Required?                    false
         Position?                    6
         Default value                
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     -CheckVersion [<SwitchParameter>]
         This parameter just dumps the script version.
         
         Required?                    false
         Position?                    7
         Default value                False
         Accept pipeline input?       false
         Accept wildcard characters?  false
         
     <CommonParameters>
         This cmdlet supports the common parameters: Verbose, Debug,
         ErrorAction, ErrorVariable, WarningAction, WarningVariable,
         OutBuffer, PipelineVariable, and OutVariable. For more information, see 
         about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216). 
     
INPUTS
     The script will scan all the mailboxes, but database by database to avoid to use
     all the RAM of the machine from which it's executed.
     
     
OUTPUTS
     A CSV file with either a name that you specify with the OutputFile parameter, or if not,
     the name of the script, containing the users Display Names, primary SMTP addresses,
     and the list of Send-As, Full Access and SendOnBehalfTo for each of these mailboxes.
     
     If the Send-As, Full Access and SendOnBehalfTo are multi-values, they are stored in the columns
     as semi-colon separated values, like Value1;value2;value3;...
     
     => when processing each permissions set, just use something like $ImportedCSV.SendAsPermissions -split ";" 
     or $ImportedCSV.SendAsPermissions.Split(";") ...
     
     
NOTES
     
     
         This script can be use alone to export a permissions map, but the output is designed so that it
         can be used with the Import-MailboxFASAPermissions.ps1 script to migrate permissions to another
         environment such as a LAB or a brand new one with the same users (Inter-Forest migration for example
         or move from an On-Prem to an outsourced environment such as Office 365)
         
         Some simple facts about the permissions exported on this script:
         
         "Sens As" permissions
             . Stored in the form of "DOMAIN\Alias"
             . Is set with Add-ADPermission
             . https://docs.microsoft.com/en-us/powershell/module/exchange/active-directory/Add-ADPermission?view=exchange-ps
         
         "Full Access" Permissions
             . Stored in the form of "DOMAIN\Alias" as well
             . Is set with Add-MailboxPermission
             . https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/Add-MailboxPermission?view=exchange-ps
         
         "Send On Behalf Of" permissions
             . Stored in the form of "Domain.com/OU_Name/Sub_OU/Name"
             . Is set with Set-Mailbox
             . https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/Set-Mailbox?view=exchange-ps
             . -GrantSendOnBehalfTo parameter accepts one or more values from the below :
                     Display name
                     Alias
                     Distinguished name (DN)
                     Canonical DN
                     <domain name>\<account name>
                     Email address
                     GUID
                     LegacyExchangeDN
                     SamAccountName
                     User ID or user principal name (UPN)
     
     -------------------------- EXAMPLE 1 --------------------------
     
     PS C:\>.\Export-MailboxFASAPermissions.ps1
     
     Will run the script and export the mailbox Display Names, primary SMTP Addresses, and all the
         Send As, Full Access and Send On Behalf To permissions on a CSV file.
     
     
     
     
     -------------------------- EXAMPLE 2 --------------------------
     
     PS C:\>.\Export-MailboxFASAPermissions.ps1 -OutputFile C:\temp\EnvironmentPermissions.csv
     
     Will run the script and export permissions for all mailboxes, in the file specified on the 
         OutputFile parameter : C:\temp\EnvironmentPermissions.csv
     
     
     
     
     -------------------------- EXAMPLE 3 --------------------------
     
     PS C:\>.\Export-MailboxFASA.ps1 -SharedMailboxes
     
     Will run the script and export the Shared Mailboxes permissions as well as the Room and
         Equipment Mailboxes permissions, and store the result on the default CSV file named after
         the script, appended with the date and time of the execution, on the script directory
     
     
     
     
     -------------------------- EXAMPLE 4 --------------------------
     
     PS C:\>.\Export-MailboxFASA.ps1 -ResourceMailboxes c:\temp\ResourceMailboxPermissions.csv
     
     Will run the script and export only the Room and Equipment Mailboxes permissions, and store
         the results in a CSV file c:\temp\ResourceMailboxPermissions.csv
     
     
     
     
     -------------------------- EXAMPLE 5 --------------------------
     
     PS C:\>.\Export-MailboxFASA.ps1 -DistributionGroupsOnly
     
     Will run the script and export only the Distribugion Group permissions (Send As, GrantSendOnBehalfTo) in 
         the default Output file format (Script_Name_Date_time.csv). This includes the Dynamic Distribution 
         Groups.
     
     
     
     
     -------------------------- EXAMPLE 6 --------------------------
     
     PS C:\>.\Export-MailboxFASA.ps1 -DistributionGroupsOnly -IncludeDynamic $false
     
     Will run the script to export permissions of Distribution Groups, excluding the Dynamic Distribugion
         Groups.
     
     
     
     
     
RELATED LINKS
     https://technet.microsoft.com/en-ca/library/jj919240(v=exchg.150).aspx
     https://docs.microsoft.com/en-us/powershell/module/exchange/active-directory/add-adpermission?view=exchange-ps
     https://technet.microsoft.com/en-us/library/jj919240(v=exchg.150).aspx
     https://github.com/SammyKrosoft
      CLICK HERE TO GO TO THE TECHNET GALLERY TO DOWNLOAD THIS SCRIPT...]]>         PowerShell–Script to export events to screen and/or to a CSV file from one or multiple machines https://docs.microsoft.com/archive/blogs/samdrey/powershell-script-to-export-events-to-screen-andor-to-file-from-one-or-multiple-machines Fri, 13 Apr 2018 09:55:52 GMT https://blogs.technet.microsoft.com/samdrey/?p=4205 *** UPDATE *** Added a GUI wrapped around this script - you can check it out here ... Type the following to see the latest examples: 
    Get-Help .\Get-EventsFromEventLogs.ps1 –Examples
    Type the following to see the full help: 
    Get-Help .\Get-EventsFromEventLogs.ps1 –Full
      Hi all ! Today I’ll give you a script that exports the events of your choice (you chose one or more Event IDs you want to export or one or more Event Sources), from one or multiple computers or servers. In this script I am also fixing events which description has carriage returns to ease up the Excel processing as I noticed when exporting Event logs as CSV from the Windows Event Viewer, events which descriptions had carriage returns were spanned across several Excel rows. By default, the script will only output the events found on screen. You must specify the –ExportToFile switch to export the events found on a CSV file. This CSV file will be located in the same directory where the script is located, and will be formatted like the below - it will have the name or number of the first event D or source that you are searching the logs for: 
    GetEventsFromEventLogs_EventIDorEventSource_Year-MONTH-DAY-Hour-Minute-Second.csv
    - Example:
    Launching 
    .\Get-EventsFromEventLogs.ps1 -Computers Server01,Server02 -EventLevel Error,Critical –ExportToFile
    got me the below file - with before the date the first event ID I was looking for: 
    GetEventsFromEventLogs_916_2018-04-13-09-52-08.csv
    Located on the same directory where my script is …
    - Other Example of the script’s full execution: 
    .\Get-EventsFromEventLogs.ps1 -Computers $(Get-ExchangeServer) –EventLogName Application -EventSource "MSExchange ADAccess","MSExchangeADTopology" -NumberOfLastEventsToGet 30 -EventLevel Warning,Error -ExportToFile
    Note here that I am passing in the –Computers parameter all my Exchange Mailbox servers by using $(Get-MailboxServer) to check all my Exchange servers => in order for this to work, you must execute the script from an Exchange Management Shell-enabled PowerShell session – otherwise, you can specify a list of computers (-Computers EX01,EX02) or get a list of computer from a file (-Computer $(Get-Content C:\temp\MyServers.txt)) First, I will get the confirmation of the options of the script and I am asked to validate to continue:
    Then it will run and show me what it’s doing:
    Note that it searches on all computers I specified, displays warnings and errors (30 last events for each machine, as I specified in the script's –NumberOfLastEventsToGet parameter) from the 2 servers I have in my environment… Also Note the summary of all the events found globally at the end of the script. And finally note how quick it is to search and dump our events ! About half a second !
    And as it finishes, it opens me the file in a NOTEPAD because I specified the –ExportToFile switch on the script launch:
    You can also open the file (or copy/paste the Notepad content) with Excel for filtering, analyzing, correlating, reporting, etc…
        Here are the switches you can use: 
    -Computers < Object>
    => where <Object> default = local computer, you can specify list of computers, strings separated by commas like -Computers “Server1”, “Server2”,”Server3” or get the computers from a list like -Computers $(Get-Content C:\temp\myservers.txt) or get the computers from a variable that contains a list of Exchange servers, etc… I tried the below on my Exchange 2013 environment : 
    .\Get-EventsFrom.ps1 -Computers $(Get-MailboxServer) -EventIDToCheck 2142 -EventLogName Application -ExportToFile
    And it got my last 30 events with Event ID 2142 from all my Exchange servers of my environment ! 
     -EventLogName < Object>
    => where <Object> default = Application and System logs, you can specify the Application LOG only (-EventLogName Application) or specify several event log types separated by commas (-EventLogName Application,  System, Security)  There is a defined set of Event Log Names that you can use, you can cycle through the valid values for this parameter by hitting <TAB> after you specify the –EventLogName parameter, and event hitting <TAB> for multiple values will cycle through each possible Event Log Name value. I love that PowerShell parameter validation functionality ! <3 
    -EventLevel <Level>
    Level must be Information, Warning, Error, and/or Critical. You can specify multiple events type, by separating with commas, like: 
    .\Get-EventsFromEventLogs -EventLevel Warning,Error -ComputerName Computer01,Computer02
    If you don't specify anything, all event types will be gathered (by default the first 30 events from each computer) -EventSource <String> This can be any source which Event you wish to dump. Example if you are looking for potential warnings and/or errors in Outlook from the local workstation you would use the below : 
    .\Get-EventsFromEventLogs -EventLevel Warning,Error -EventSource Outlook
      
     -EventID < Object>
    => where <Object> default = “All” , if you don’t specify it, the script will search for all Event IDs, and if you want you can specify a list of IDs to search for or to check : just enter each Event ID separated by commas (like -EventID 1220,2020,605) 
     -EventSource <Object>
    => where <Object> default = “All”, if you don't specify this parameter, the script will search for all Event Sources, and you can also specify a source name like -EventSource Outlook (no need for the quotes) or several source names like -EventSource Outlook, Disk …   
    -EventLevel <Object>
    => where <Object> default = “All”, if you don't specify this parameter, the script will search all Levels (Info, Warning, Errors, Critical, …) You can specify an event level like -EventLevel Error or several levels like -EventLevel Warning, Error …  There is a defined set of event level you can use, you can cycle through the valid values for this parameter by hitting “TAB” after you specify the –EventLevel parameter. Possible values are: "All" (default),"Information","Warning","Error","Critical", "Verbose"… 
     -NumberOfLastEventsToGet <Int32>
    => where <Int32> default = 30, and this will dump the 30 or less (if the event log has less, it will dump all of these) 
     -ExportToFile [<SwitchParameter>]
    => if you don’t specify -ExportToFile the script will just dump the events into screen. If you specify it, it will dump the event into a CSV file for easy parsing in Excel ! To check the full help of the script, type 
    get-help .\Get-EventsFromEventLogs.ps1 -Full
    To check the examples only type: 
    get-help .\Get-EventsFromEventLogs.ps1 -Examples
      Click here to get to the Download Link on TechNet Gallery   Here is the dump of the Examples:   
    NAME
 C:\Users\SammyKrosoft\documents\Github\Powershell\Get-EventsFromEventLog\Get-EventsFromEventLogs.ps1
 
SYNOPSIS
 Searches and Get specific events from any computer, local or remote, or from a computer list.
 
 
 -------------------------- EXAMPLE 1 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1
 
 Launching the script without options will :
 - Ask you which event(s) you wish to search for (separated by commas if you want multiple event IDs to search)
 - Search the local computer
 - Search the Application and System logs
 - Get 30 events of the type specified
 
  
 
 -------------------------- EXAMPLE 2 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -Computers MyServers -EventLevel Error
 
 This will collect the Error events (the last 30 errors by default) from the computer named MyServers. 
 It won't store it into a file as we didn't call the "-ExportToFile" parameter, just dump into the screen
 to have an idea if your server is okay or if it's full of errors
 
  
 
 -------------------------- EXAMPLE 3 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -Computers SRV-EX-01,SRV-EX-02,SRV-EX-03 -EventLevel Error -ExportToFile
 
 This will collect the Warning, Error, Critical events on computers SRV-EX-01, 02 and 03. The results
 will be dumped into a file labelled GetEventsFromEventLogs-Date-time.csv as we specified the
 ExportToFile parameter.
 Note that the computers list can come from a txt file as well (see next example)
 
  
 
 -------------------------- EXAMPLE 4 --------------------------
 
 PS C:\>.\Get-EventsFromEventsLogs.ps1 -Computers $(Get-Content .\ServersList.txt) -EventLevel Error,Critical -ExportToFile
 
 This will collect Error and Critical events on computers list defined in the "ServersList.txt" file on the current 
 directory from where you launched the script (.\ refers to the current user directory, NOT the directory where the
 script is) and store it into a file.
  
 
 
 -------------------------- EXAMPLE 5 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -NumberOfLastEventsToGet 10 -EventID 916,105 -ExportToFile
 
 - Search for the 10 last events (-NumberOfLastEventsToGet 10) 
 - Search for event IDs 916 and 105
 - As no Event Log name (Application, System, Security, etc...) were specified, 
 the script will look inside the Application AND System logs by default.
 - We asked the script to look for Event IDs 916 and 105 (-EventID 916, 105)
 
 The exported file will be named GetEventsFromEventLogs_916-105_2018-04-13-10-01-55.csv
 as I ran the script on 13th April 2018 at 10h01 and 55 seconds in the morning.
  
 
 
 -------------------------- EXAMPLE 6 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -NumberOfLastEventsToGet 30 -EventID 26 -EventLogName Application
 
 - Search for the last 30 events (-NumberOfLastEventsToGet 30)
 - Search for Event ID 26 only
 - Search in the Application Log only
 - We don't output any file, just print the results on the screen
 
  
 
 -------------------------- EXAMPLE 7 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -EventSource "Outlook"
 
 - Search all events generated by the "Outlook" application (all Event IDs, all Level (Info, Warning, etc...))
 - Search in Application and System (because I didn't specify which event log)
 - Search the last 30 events of type "Outlook" - if there are less, it will just print less
 - We don't output any file because I didn't specify the -ExportToFile parameter
 
 MachineName LogName TimeCreated LevelDisplayName Id Message
 ----------- ------- ----------- ---------------- -- -------
 12345678901 Application 4/13/2018 11:57:06 AM Information 63 La demande de service web Exchange GetAppManifestssuccède à.</0w>
 12345678901 Application 4/13/2018 7:57:00 AM Information 63 La demande de service web Exchange GetAppManifestssuccède à.</0w>
 12345678901 Application 4/13/2018 7:56:59 AM Information 63 Outlook a détecté une notification de modification pour vos applications et va t...
 12345678901 Application 4/13/2018 7:56:55 AM Information 45 Outlook a chargé le(s) complément(s) suivant(s) :...
  
 
 
 -------------------------- EXAMPLE 8 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -EventSource "disk","Outlook" -EventLevel Warning -NumberOfLastEventsToGet 1000
 
 - Search all events which source are "Disk" and "Outlook"
 - Search only "Warning" events of the above defined sources
 - All Event IDs of these (because I didn't specify any ID to filter)
 - Get the 1000 last events of the above criteria
 - didn't specify the -ExportToFile so will just display to screen
  
 
 
 -------------------------- EXAMPLE 9 --------------------------
 
 PS C:\>.\Get-EventsFromEventLogs.ps1 -EventSource "disk" -NumberOfLastEventsToGet 1000 -EventLevel Critical,Warning,Error -ExportToFile
 
 - Search all events about the "disk"
 - Search only Critical, Warning and Error events
 - Search the 1000 last events about the above criteria
 - Export into a file (like GetEventsFromEventLogs_None_2018-04-14-04-34-27.csv)
        Download link (same as above) Try it and let me know your thoughts ! Cheers Sam]]>