Change ActiveSync Policy Based on AD group

There has been a requirement that we need to change the policy of certain users & need to automate the process based on AD group.

We have written below script to do this job, this script uses QAD AD Shell & Exchange management shell.

It fetches group members from the AD group export them in csv (so that it can compare afterwards & only changes are processed)

When running the script for the first time it will generate a CSV file of group members (empty the whole file except one user that you can process manually)

After that you can just schedule the script it will run incrementally.

  • When ever new user is added to the group –> Active sync policy will be updated
  • When user is removed from the group –> Activesync policy will be changed to default
  • Recycle logs after 30 days
  • If error occurs than send alert.

Download & extract the script from below link

https://gallery.technet.microsoft.com/scriptcenter/Change-ActiveSync-Policy-10840be7

Update the below values as per customer’s environment:

———————————————————————–

$smtpServer = “smtpserver”

$fromadd = “DoNotReply@labtest.com”

$email1 = “VikasS@labtest.com”

 

$Asyncpol = “ActiveSync Policy”

$defAsyncpol = “Default ActiveSync Policy”

$group = “AD Group”

——————————————————————————

Thanks to “Lazy Admin” as incremental code has been taken from one of his blog post.

http://www.lazywinadmin.com/

 

###################################################################### 
#               Author: Vikas Sukhija(http://msexchange.me) 
#               Date:- 03/16/2016 
#        Reviewer:- 
#               Description:- Change activesync policy based on  
#               a particular AD group. 
###################################################################### 
 
$date1 = get-date -format d 
$date1 = $date1.ToString().Replace("/","-"$dir".\logs" 
$limit = (Get-Date).AddDays(-30) 
 
$logs = ".\Logs" + "\" + "Processed_" + $date1 + "_.log" 
 
$smtpServer = "smtpserver" 
$fromadd = "DoNotReply@labtest.com" 
$email1 = "VikasS@labtest.com" 
 
Start-Transcript -Path $logs 
 
######Add Quest Shell & define attrib/ group value############ 
 
If ((Get-PSSnapin | where {$_.Name -match "Quest.ActiveRoles.ADManagement"}) -eq $null) 
{ 
    Add-PSSnapin Quest.ActiveRoles.ADManagement 
} 
 
#######Add exchange Shell ############################## 
 
If ((Get-PSSnapin | where {$_.Name -match "Microsoft.Exchange.Management.PowerShell.E2010"}) -eq $null) 
{ 
    Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010 
} 
 
$Asyncpol = "ActiveSync Policy" 
$defAsyncpol = "Default ActiveSync Policy" 
 
$group = "AD Group" 
 
################################################################# 
 
$groupmem = Get-QADGroupMember $group -sizelimit 0 
 
$groupmem 
 
$Statefile = "$($group)-Name.csv" 
 
 
# If the file doesn't exist, create it 
 
   If (!(Test-Path $Statefile)){   
                $groupmem | select Name | Export-csv $Statefile -NoTypeInformation  
                } 
 
# Check Changes 
$Changes =  Compare-Object $groupmem $(Import-Csv $StateFile-Property Name |  
                Select-Object Name, 
                    @{n='State';e={ 
                        If ($_.SideIndicator -eq "=>"){ 
                            "Removed" } Else { "Added" } 
                        } 
                    } 
 
$Changes | foreach-object{ 
          
    if($_.state -eq "Added") { 
 
        Write-host "$Asyncpol will be updated to "$_.Name"" -foregroundcolor green 
           $checkasync = Get-CASMailbox -Identity $_.Name 
        if($checkasync.ActiveSyncEnabled -eq $true){ 
    Set-CASMailbox -Identity $_.Name -ActiveSyncMailboxPolicy $Asyncpol}} 
     
     
        if($_.state -eq "Removed") { 
        $userid = "$_.Name" 
        Write-host "$Asyncpol will be removed from "$_.Name"" -foregroundcolor Red 
    $checkasync = Get-CASMailbox -Identity $_.Name 
        if($checkasync.ActiveSyncEnabled -eq $true){ 
    Set-CASMailbox -Identity $_.Name -ActiveSyncMailboxPolicy $defAsyncpol}} 
     
      } 
 
$groupmem | select Name | Export-csv $StateFile -NoTypeInformation 
 
###########################Recycle########################################## 
 
$path = $dir  
  
Get-ChildItem -Path $path  | Where-Object {   
$_.CreationTime -lt $limit } | Remove-Item -recurse -Force  
 
#######################Report Error######################################### 
if ($error -ne $null) 
      { 
#SMTP Relay address 
$msg = new-object Net.Mail.MailMessage 
$smtp = new-object Net.Mail.SmtpClient($smtpServer) 
 
#Mail sender 
$msg.From = $fromadd 
#mail recipient 
$msg.To.Add($email1$msg.Subject = "Activesync Policy Script error" 
$msg.Body = $error 
$smtp.Send($msg$error.clear() 
       } 
  else 
 
      { 
    Write-host "no errors till now" 
      } 
 
$path = ".\logs\" 
$limit = (Get-Date).AddDays(-30) #for log recycling 
 
########################Recycle logs ###################################### 
 
Get-ChildItem -Path $path  | Where-Object {   
$_.CreationTime -lt $limit } | Remove-Item -recurse -Force  
stop-transcript 
 
##########################################################################

Regards

Sukhija Vikas

http://msexchange.me

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s