Added Files
This commit is contained in:
DistractADD
@@ -0,0 +1,63 @@
|
||||
# Script to get details for a list of mailboxes and save that out to a CSV file
|
||||
#
|
||||
|
||||
# File containing the list of mailboxes
|
||||
$inputFile = 'C:\Temp\MailboxList.txt'
|
||||
|
||||
# File to save the results to
|
||||
$outputFile = 'C:\Temp\SharedMailboxes.csv'
|
||||
|
||||
# Establish a session to Exchange Online
|
||||
$credentials = Get-Credential -Message 'Enter your Exchange Online administrator credentials'
|
||||
$connectionParams = @{
|
||||
'ConfigurationName' = 'Microsoft.Exchange';
|
||||
'ConnectionUri' = 'https://outlook.office365.com/powershell-liveid/';
|
||||
'Credential' = $credentials;
|
||||
'Authentication' = 'Basic';
|
||||
'AllowRedirection' = $true
|
||||
}
|
||||
$exchangeSession = New-PSSession @connectionParams
|
||||
Import-PSSession -Session $exchangeSession
|
||||
|
||||
# Check output folder exists and create it if it doesn't
|
||||
$outputPath = (Split-Path -Path $outputFile)
|
||||
if (!(Test-Path -Path $outputPath)) {New-Item -Path $outputFolder -ItemType Directory}
|
||||
|
||||
# If output file already exists, delete it.
|
||||
if (Test-Path -Path $outputFile) {Remove-Item -Path $outputFile}
|
||||
|
||||
# Get the list of mailboxes from the file
|
||||
$mailboxes = Get-Content -Path $inputFile
|
||||
|
||||
# Initialise the results table
|
||||
$mailboxesTable = @()
|
||||
|
||||
# Iterate through the mailboxes from the file and show a progress bar as we go.
|
||||
foreach ($mailbox in $mailboxes) {
|
||||
Write-Progress -Activity 'Checking..' -status $mailbox -percentComplete ($mailboxes.IndexOf($mailbox) / $mailboxes.Count * 100)
|
||||
|
||||
# Get the statistics for the mailbox.
|
||||
$mailboxStats = ''
|
||||
$mailboxStats = Get-MailboxStatistics -Identity $mailbox -ErrorAction SilentlyContinue -
|
||||
|
||||
# If mailboxStats is blank then mailbox doesn't exist, so that entry can be skipped. For all others get the mailbox permissions and build the output table.
|
||||
if ($mailboxStats -ne $null) {
|
||||
# Get permit permissions for users where the username has an @ in it, this filters out all the system permissions.
|
||||
$usersWithAccess = (Get-MailboxPermission -Identity $mailbox | Where-Object -Property {($_.User -like '*@*') -and ($_.Deny -ne 'False')}).User -join '; '
|
||||
|
||||
$tableRow = New-Object System.Object
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'MailboxUPN' -Value $mailbox
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'MailboxType' -Value $mailboxStats.MailboxTypeDetail
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'ItemCount' -Value $mailboxStats.ItemCount
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'TotalItemSize' -Value $mailboxStats.TotalItemSize
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'LastLogonTime' -Value $mailboxStats.LastLogonTime
|
||||
$tableRow | Add-Member -MemberType NoteProperty -Name 'UsersWithAccess' -Value $usersWithAccess
|
||||
$mailboxesTable += $tableRow
|
||||
}
|
||||
}
|
||||
|
||||
# Output the final table of results to a file.
|
||||
$mailboxesTable | Export-Csv -Path $outputFile -NoTypeInformation
|
||||
|
||||
# End the Exchange Online session
|
||||
Remove-PSSession -Session $exchangeSession
|
||||
@@ -0,0 +1,20 @@
|
||||
# Find mailboxes where UPN domain doesn't match email domain
|
||||
#
|
||||
|
||||
# Establish a session to Exchange Online
|
||||
$credentials = Get-Credential -Message 'Enter your Exchange Online administrator credentials'
|
||||
$connectionParams = @{
|
||||
'ConfigurationName' = 'Microsoft.Exchange';
|
||||
'ConnectionUri' = 'https://outlook.office365.com/powershell-liveid/';
|
||||
'Credential' = $credentials;
|
||||
'Authentication' = 'Basic';
|
||||
'AllowRedirection' = $true
|
||||
}
|
||||
$exchangeSession = New-PSSession @connectionParams
|
||||
Import-PSSession -Session $exchangeSession
|
||||
|
||||
# Get list of mailboxes with a different mail domain to UPN domain
|
||||
Get-Mailbox -ResultSize Unlimited | Where-Object {$_.UserPrincipalName.Split('@')[1] -ne $_.PrimarySmtpAddress.Split('@')[1]} | Format-Table Name,UserPrincipalName,PrimarySmtpAddress,RecipientTypeDetails
|
||||
|
||||
# Disconnect from Exchange Online
|
||||
Remove-PSSession $exchangeSession
|
||||
@@ -0,0 +1,38 @@
|
||||
# Script to get all client forwarding rules, smtp forwarding rules and delegates on mailboxes
|
||||
#
|
||||
# This builds on top of a script from https://github.com/OfficeDev/O365-InvestigationTooling
|
||||
#
|
||||
|
||||
# Establish a session to Exchange Online
|
||||
$credentials = Get-Credential -Message 'Enter your Exchange Online administrator credentials'
|
||||
$connectionParams = @{
|
||||
'ConfigurationName' = 'Microsoft.Exchange';
|
||||
'ConnectionUri' = 'https://outlook.office365.com/powershell-liveid/';
|
||||
'Credential' = $credentials;
|
||||
'Authentication' = 'Basic';
|
||||
'AllowRedirection' = $true
|
||||
}
|
||||
$exchangeSession = New-PSSession @connectionParams
|
||||
Import-PSSession -Session $exchangeSession
|
||||
|
||||
$allUsers = @()
|
||||
$allUsers = Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName,UserPrincipalName,ForwardingAddress,ForwardingSMTPAddress,DeliverToMailboxandForward
|
||||
|
||||
$userInboxRules = @()
|
||||
$userDelegates = @()
|
||||
|
||||
foreach ($user in $allUsers) {
|
||||
Write-Progress -Activity "Checking inbox rules for..." -status $user.UserPrincipalName -percentComplete ($allUsers.IndexOf($user) / $allUsers.Count * 100)
|
||||
$userInboxRules += Get-InboxRule -Mailbox $user.UserPrincipalName | `
|
||||
Select-Object MailboxOwnerId,Name,Description,Enabled,Priority,ForwardTo,ForwardAsAttachmentTo,RedirectTo,DeleteMessage | `
|
||||
Where-Object {($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.RedirectsTo -ne $null)}
|
||||
$userDelegates += Get-MailboxPermission -Identity $user.UserPrincipalName | Where-Object {($_.IsInherited -ne "True") -and ($_.User -notlike "*SELF*")}
|
||||
}
|
||||
|
||||
$smtpForwarding = $allUsers | Select-Object DisplayName,ForwardingAddress,ForwardingSMTPAddress,DeliverToMailboxandForward | Where-Object {$_.ForwardingSMTPAddress -ne $null}
|
||||
|
||||
$userInboxRules | Export-Csv MailForwardingRulesToExternalDomains.csv -NoTypeInformation
|
||||
$smtpForwarding | Export-Csv Mailboxsmtpforwarding.csv -NoTypeInformation
|
||||
$userDelegates | Export-Csv MailboxDelegatePermissions.csv -NoTypeInformation
|
||||
|
||||
Remove-PSSession -Session $exchangeSession
|
||||
@@ -0,0 +1,41 @@
|
||||
# Script to grant access rights on mailboxes
|
||||
#
|
||||
|
||||
# Mailboxes to grant rights on
|
||||
$grantRightsOnMailboxes = @('','')
|
||||
|
||||
# Users to grant rights to
|
||||
$grantRightsToUsers = @('','')
|
||||
|
||||
# Rights to grant
|
||||
$accessRights = 'Editor'
|
||||
|
||||
# Establish a session to Exchange Online
|
||||
$credentials = Get-Credential -Message 'Enter your Exchange Online administrator credentials'
|
||||
$connectionParams = @{
|
||||
'ConfigurationName' = 'Microsoft.Exchange';
|
||||
'ConnectionUri' = 'https://outlook.office365.com/powershell-liveid/';
|
||||
'Credential' = $credentials;
|
||||
'Authentication' = 'Basic';
|
||||
'AllowRedirection' = $true
|
||||
}
|
||||
$exchangeSession = New-PSSession @connectionParams
|
||||
Import-PSSession -Session $exchangeSession
|
||||
|
||||
# Apply the permissions
|
||||
foreach ($grantRightsToUser in $grantRightsToUsers ) {
|
||||
foreach ($grantRightsOnMailbox in $grantRightsOnMailboxes) {
|
||||
$calendarIdentity = $grantRightsOnMailbox + ':\Calendar'
|
||||
$existingPermissions = Get-MailboxFolderPermission -Identity $calendarIdentity -User $grantRightsToUser -ErrorAction SilentlyContinue
|
||||
if (!($existingPermissions)) {
|
||||
Add-MailboxFolderPermission -Identity $calendarIdentity -User $grantRightsToUser -AccessRights $accessRights
|
||||
}
|
||||
else {
|
||||
Set-MailboxFolderPermission -Identity $calendarIdentity -User $grantRightsToUser -AccessRights $accessRights
|
||||
}
|
||||
Set-Mailbox -Identity $upn –GrantSendOnBehalfTo @{add=$editor}
|
||||
}
|
||||
}
|
||||
|
||||
# End the PowerShell session
|
||||
Remove-PSSession -Session $exchangeSession
|
||||
@@ -0,0 +1,45 @@
|
||||
# Enable mailbox auditing and disable PowerShell remoting on individual mailboxes
|
||||
#
|
||||
# Working on this as a one stop for hardening Exchange Online accounts
|
||||
#
|
||||
|
||||
# UPN of New User
|
||||
$newUPN = ''
|
||||
|
||||
# Is the user an administrator?
|
||||
$isAnAdmin = $false
|
||||
|
||||
# Establish a session to Exchange Online
|
||||
$credentials = Get-Credential -Message 'Enter your Exchange Online administrator credentials'
|
||||
$connectionParams = @{
|
||||
'ConfigurationName' = 'Microsoft.Exchange';
|
||||
'ConnectionUri' = 'https://outlook.office365.com/powershell-liveid/';
|
||||
'Credential' = $credentials;
|
||||
'Authentication' = 'Basic';
|
||||
'AllowRedirection' = $true
|
||||
}
|
||||
$exchangeSession = New-PSSession @connectionParams
|
||||
Import-PSSession -Session $exchangeSession
|
||||
|
||||
# Set Auditing parameters
|
||||
$params = @{
|
||||
'AuditEnabled' = $true
|
||||
'AuditLogAgeLimit' = '180'
|
||||
'AuditAdmin' = @('Update','MoveToDeletedItems','SoftDelete','HardDelete','SendAs','SendOnBehalf','Create','UpdateFolderPermission')
|
||||
'AuditDelegate' = @('Update','SoftDelete','HardDelete','SendAs','Create','UpdateFolderPermissions','MoveToDeletedItems','SendOnBehalf')
|
||||
'AuditOwner' = @('UpdateFolderPermission','MailboxLogin','Create','SoftDelete','HardDelete','Update','MoveToDeletedItems')
|
||||
}
|
||||
|
||||
# Enable Auditing
|
||||
Get-Mailbox -Identity $newUPN | Set-Mailbox @params
|
||||
|
||||
# Disable PowerShell Remoting for non-Admin staff
|
||||
if ($isAnAdmin) {
|
||||
Set-User -Identity $newUPN -RemotePowerShellEnabled $true
|
||||
}
|
||||
else {
|
||||
Set-User -Identity $newUPN -RemotePowerShellEnabled $false
|
||||
}
|
||||
|
||||
# Disconnect from Exchange Online
|
||||
Remove-PSSession $exchangeSession
|
||||
Reference in New Issue
Block a user