If You Experience Something Like ...

Searching for AD users with missing email address

In this case, I was searching for AD users with populated proxyaddresses property, but with missing email address from specific domain. For example: a user was having following email addresses: user@domain-a.com and user@domain-c.com, but was missing the user@domain-b.com. I wrote a singleliner PowerShell for listing those users:

Get-ADUser -LDAPFilter "(&(proxyAddresses=*)(!proxyAddresses=smtp:*domain-b.com))" -Properties * | ? {$_.enabled -eq $true } | ft name,proxyaddresses -AutoSize -Wrap

Also, there was one more condition that users with missing email address have to be enabled.

I hope that this singleliner Powershell will help you in a quest for missing email addresses.

Finding and removing emails from exchange mailboxes

In this case security office has sent notification, that potentially malicious email that bypassed antimalware protection has to be removed from user's mailboxes. In order to find out who has received the specified email (the sender of the malicious email was provided in the escalation information from the security office), in case of multirole exchange servers, I've checked the message tracking logs using following syntax:

Get-ExchangeServer | Get-MessageTrackingLog -start (Get-date).AddDays(-1) -End (Get-date) -ResultSize unlimited -eventid deliver -Sender "malicioussender@domain.some"

Fortunately, the number of users that have received the specified email message were few. Knowing the affected users, removing the email message from their mailbox can be done using Search-Mailbox cmdlet. For running the Search-Mailbox cmdlet, the user running this cmdlet must be a member of Discovery Management role group.
For example, to search the affected mailbox for the message with sender "malicioussender@domain.some" and send the results log to some auditor's mailbox (messages are not removed from the affected mailbox):

Search-Mailbox -Identity "user@affected.maibox" -SearchQuery 'From: "malicioussender@domain.some"' -TargetMailbox "auditor@mailbox.domain" -TargetFolder "SearchUsersLogs" -LogOnly -LogLevel Full

In order to delete the message from the affected mailbox, Search-Mailbox has DeleteContent parameter. For using the DeleteContent parameter, user running the search-mailbox cmdlet, also has to have the Mailbox Import Export management role assigned.
For assigning Mailbox Import Export Role to a Role Group, please follow the TechNet article https://technet.microsoft.com/en-us/library/ee633452(v=exchg.141).aspx .

Now, it's time to remove the messages from affected mailbox, and copy them auditor's mailbox:

Search-Mailbox -Identity "user@affected.maibox" -SearchQuery 'From: "malicioussender@domain.some"' -TargetMailbox "auditor@mailbox.domain" -TargetFolder "SearchUsersLogs" -DeleteContent

Messages were successfully deleted from affected mailbox, and copied to a auditor's mailbox.

Failed to run task sequence with following error 0x80070570

In this case, during operating system deployment using SCCM 2012 r2 task sequence, I have experienced error 0x80070570 on some machines:

From the MSDN, descriptive information for the error (0x570) 1392 is: "The file or directory is corrupt and unreadable."

This task sequence job was to deploy new operating system using wipe and load scenario. In order to fix this issue and allow the task sequence to finish it's job, I've entered into debug mode using F8 and used diskpart. Since, the operating system deployment scenario was wipe and load, I didn't care much about the data stored on disk. So, here is the syntax for disk cleaning:

diskpart -> list disk -> select disk 0 -> clean -> exit

After cleaning the disk, the task sequence has successfully installed the required operating system.

Finding scripts in GPOs

For this case I wrote a simple PowerShell easy to read script for finding GPOs with scripts and their links to OUs. The script requires domain administrator credential for enumerating GPOs machine startup folder. For populating $dc and $dom variables the script requires online domain controller and domain name. Then the script will start to enumerate policies folders searching for files with vbs,bat, and vbe extensions. It will also filter out with regex the gpo guid found between the curly brackets "{}"in the full file path. Using the gpo guid the script will resolve the gpo name and OUs where that gpo is linked. At the end the script will output the data.

$dc = Read-Host "Online DC (example:dc1)"
$dom = Read-Host "Domain name (example:domain.com)"

dir \\$dc\SYSVOL\$dom\Policies -Include *.vbs,*.bat,*.vbe -Recurse | select -ExpandProperty Fullname | Select-String -Pattern "(?<=\{).*?(?=\})" | % {

    $id=$_.matches[0].value
    $gpo=get-gpo -guid $id
    $ou =Get-ADOrganizationalUnit -LDAPFilter "(gPLink=*$id*)"

    Write-host $_
    Write-Host "GPOName=" -ForegroundColor Red -NoNewline
    Write-host $gpo.DisplayName -NoNewline
   Write-Host "`tStatus=" -ForegroundColor Yellow -NoNewline
    Write-host $gpo.GpoStatus
    Write-Host "OUlinks=" -ForegroundColor Green -NoNewline
    Write-host $ou.Name
    Write-Host " "

}

Feel free to customize or modify the script to satisfy your needs.

Exchange Powershell in Multi Domain Environment

This is quick one, if you're using Exchange PowerShell for managing environment where exchange recipients are located across multiple domains in forest, you might be wondering why by default you will not be able to manage recipient objects that are located in different domains. The reason for this behavior is that by default, you will be able to manage objects that are located in the domain where Exchange servers are located.
In order to change this behavior, for example to manage recipient objects located across forest Set-AdServerSettings cmdlet is your friend:

Set-AdServerSettings -ViewEntireForest $true

One thing to notice is that, the change of this view scope is only limited to current open session.