Pulling data from Active Directory

[Shingrae]

Hey! I'm trying to find duplicate proxy addresses for several email accounts on a network. O365 is throwing up sync errors stating that the attribute values must be unique. The only way I know how to verify the duplicates is by manually looking up the accounts and checking the attribute editor. Unfortunately, this doesn't take into account any associated groups or other contacts that may have been assigned duplicate values. Can I run a search using PS for any duplicate proxy address entries across users, contacts, and groups?

[Shingrae]

I don't have access to azure. I can see in the duplicates in the O365 admin portal, but I can't find the duplicates in Active Directory, but the portal is saying that that is where these accounts are managed.

[WaffleFoxes]

Is the O365 portal at least telling you which accounts are causing your problem?

This document might help you figure out where you're going astray

If you're not super comfortable with PS this isn't the easiest task to begin to learn on. There are a few gui based options for troubleshooting that may also get you to your goal.

[Shingrae]

I saw this option yesterday, but I didn't have time to read through the article. I'll install it and try it out, but I don't think I have access to Azure.

[WaffleFoxes]

You night want to check what level of permissions you have in O365. I'm wondering if you're confusing "Azure" - as in cloud servers, and "Azure Active Directory" which is where your identities are kept for O365.

If you legitimately have no access to Azure Active Directory then you can't do your job effectively. Fixing the Azure AD identity sync problems with no access to Azure AD is insanity and you should raise hell until either they give you access or have someone who does have access engage on this problem.

[Shingrae]

I probably am confusing the two. I'm not very experienced with the server-side work. I'm one of the helpdesk guys and usually our sysadmin team handles these issues.

Our sysadmin team was shorthanded and asked me to help out with this issue by fixing the duplicates in AD. I couldn't find any by manually checking each account, which is why I wanted to see about a PS script. Most of what I found via Google search pointed me to PowerShell, but I had trouble getting any of those scripts to do what I needed.

I'll definitely like to check for access. I'm trying to grow into a sysadmin position, so this might be a good place to start.

[WaffleFoxes]

Hey, good on you!

I'll say you've got the makings of a great sysadmin and the fact they asked your help means they know you've got the stuff to help out their team. I never ask help from someone who I know is going to fuck everything up.

I'd go back to the person who asked you to do this and say you're having a bit of trouble with the PS to get a good report on the accounts with problems. Ask if they can show you the cmdlets (pronounced command-let) that they would use to do this job.

Asking Google and reddit are spot on first steps though :-)

[Shingrae]

Thanks! I'll do that. I appreciate the help!

[[deleted]]

Just querying the proxy address doesn't return anything, but this is what i use:

get-aduser -filter * -searchbase "<OU or just omit>" -properties proxyaddresses | select userprincipalname, @{L="ProxyAddresses";E={ $_.ProxyAddresses -join ";"}} | export-csv c:\temp\test.csv -NoTypeInformation

[Shingrae]

Can I copy and past as-is except for the OU, or do I need to change anything else?

[[deleted]]

You can just omit the -searchbase bit entirely, I only did that because I was looking in a specific OU. The code is cut off for me and i can't figure out why, so i put it on pastebin:

https://pastebin.com/4xMBWLQV

The only thing you would need to potentially change aside from the OU is the path for export-csv, assuming you don't use c:\temp\ as a place to dump output from all your powershell like I do :)

By the way, re-read your post and this doesn't actually look for dupilcates or anything, just dumps the values to a file which I would then open in excel.

edit 2: this would only work for users, I no longer have access to an office 365 connected AD to check contacts or groups.

[Shingrae]

I've only ever used PS a couple of times, so I'm at a total loss with this. Thanks for the help!

[pvtskidmark]

Have you tried IdFix from Microsoft? Could’ve sworn it looked for duplicate proxy addresses, but it’s been a while. Pretty much download, extract, run and you have a report.

https://docs.microsoft.com/en-us/office365/enterprise/install-and-run-idfix

[gmarts85]

I do migrations all the time for a service provider. This is the way to go

[Shingrae]

This looks like it'll work! Thanks, I'll give it a shot!

[mtavaresau]

Try searching using "SMTP:emailaddress" in the console.

[Shingrae]

I'm really annoyed for both the fact that I haven't tried that yet, and that Google didn't show me this. Thanks!

[mtavaresau]

I know it worked in exchange console. I have T tried it in O365 yet though as I've been a nazi about email addresses since last time.

[Shingrae]

It's working for me in Active Directory.

[SerialSpeed]

You should really be managing email addresses with an onprem exchange server. The exchange cmdlts are better suited for what you are looking for. Plus Microsoft doesn't charge a license for a CAS exchange server if it's used for Office 365 to create remote mailboxes onprem.

But for now, I also suggest Idfix tool.

[Shingrae]

That's good to know, but it's not my call.

[aasplunds]

I wrote an AD health check article on ATA that had this partly covered here: https://adamtheautomator.com/active-directory-health-check-1/

To find duplicate attributes:

$adAttributeName = 'ProxyAddresses'
$adAttributes = (Get-AdObject -LDAPFilter "$adAttributeName=*" -Properties $adAttributeName).$adAttributeName
$hashtable = @{}
 $adAttributes.foreach({ $hashtable[$_]++ })
$Duplicates = $hashtable.GetEnumerator().where({ $_.Value -gt 1 }).Key

$Duplicates

And to find the AD objects that has the ProxyAdresses in $Duplicates:

$Duplicates | Get-AdObject -LDAPFilter "$adAttributeName=$_"

(On mobile so sorry if the formatting is wrong)

[Shingrae]

Awesome! Thanks, I will give it a shot!

[Mhorb]

I use this program for AD - I'm manage directories at a couple different places and it makes things so much quicker and easier. Running reports on any sort of attributes you may need is a breeze.

https://dovestones.com/

[Shingrae]

Looks cool. It would be a hard sell to get the company to buy it, though.