Script to mass enable users for Exchange UM

During Lync deployments, I have often run into the need to mass enable multiple users for Unified Messaging. To do this, I altered an existing script (I cannot remember where I found it) to do this using a CSV file. Here is the script:

if ($args[0] -eq $null) 
{
$userNameFile = read-host "Please enter the full path of the .csv file with user aliases."
$usernamefile  = $usernamefile -replace '"',"" 
} else {
$usernamefile = $args[0]
}
if($userNameFile -ne "") 
{    
$csv=import-csv $userNameFile 
} else {
"Unable to find a valid CSV with user Aliases, extensions and UM policy name. Please try again later."
exit
}
foreach($c in $csv )
{
"Enabling  User " + $c.Alias + " using UM mailbox policy = " + $c.umpolicy
Enable-ummailbox -id $c.Alias -PinExpired $True -ummailboxpolicy $c.umpolicy -extensions $c.extension   
}

The CSV file for this script will look like this:

Alias	extensions	umpolicy
User1	1234	Policy Name
User2	1235	Policy Name
User3	1236	Policy Name

The Alias column can contain any of the following values for the Identity parameter:

• ADObjectID
• GUID
• Distinguished name (DN)
• Domain\Account 
• user principal name (UPN)
• LegacyExchangeDN
• SmtpAddress
• Alias

If you want the PIN to not prompt the user to change it on first log on, change the -PinExpired value to $False. You can also manually set the PIN if the need arises by adding '-Pin $c.pin' to the Enable-ummailbox line and add a column to the CSV file with the header of 'pin'.

Let me know if you have any questions or comments about this script. Hope this helps.

Lync PowerShell Script to Mass Enable Users

* Updated 1/22/15 - I added the option to add dial plan and voice policy as well to the script
* Updated 6/20/13 - I forgot to add the dash in set-csuser on the bottom script so the enable-csuser cmdlet would fail.

Of course there is always a need to mass enable users for Lync once you have Lync deployed in your environment. The easiest way to mass enable users for Lync is via a PowerShell script and a CSV file with the user information. 

To enable PC-to-PC users only
Here is a script I created to mass enable users:

if ($args[0] -eq $null)
    {
    $userNameFile = read-host "Enter the full path of the .csv file with the user information."
    $userNameFile  = $usernamefile -replace '"',""} 
else 
    {$usernamefile = $args[0]}
if ($userNameFile -ne "") 
    {$csv=import-csv $userNameFile} 
else 
    {"Could not find a valid .csv with the user information."
    exit}
foreach($c in $csv)
# enable for lync
{
"Enabling " + $c.Identity + " for Lync 2010"
Enable-csuser -identity $c.Identity -registrarpool $c.RegistrarPool –sipaddresstype $c.SipAddressType -sipdomain $c.SipDomain
}

This script will enable the users with basic PC-to-PC configuration. This script allows for organizations with multiple SIP domains and multiple pools with the columns in the .csv file for RegistrarPool and SipDomain. The .csv file will look like this:

Identity	RegistrarPool	SipAddressType	SipDomain
John Doe	PoolFQDN.Domain.com	EmailAddress	SIPDomain.com

To enable Enterprise Voice users
To enable the users for Enterprise Voice, we will make the following addition (highlighted in yellow and green) to the above script. The green highlighted section is optional if you have extensions set up in your LineURI’s like tel+12815551234;ext=1234. You can omit this section and remove the Extensions column from the .csv file if you are not using extensions in your LineURI’s:

if ($args[0] -eq $null)
    {
    $userNameFile = read-host "Enter the full path of the .csv file with the user information."
    $userNameFile  = $usernamefile -replace '"',""} 
else 
    {$usernamefile = $args[0]}
if ($userNameFile -ne "") 
    {$csv=import-csv $userNameFile} 
else 
    {"Could not find a valid .csv with the user information."
    exit}
foreach($c in $csv)
# enable for lync
{
"Enabling " + $c.Identity + " for Lync"
$lineuri = "tel:+1" + $c.PhoneNumber + ";ext=" + $c.Extension
Enable-csuser -identity $c.Identity -registrarpool $c.RegistrarPool -sipaddresstype $c.SipAddressType -sipdomain $c.SipDomain 

# Pause for 30 seconds for AD Replication
write-host -foregroundcolor Green "Pausing for 30 seconds for AD Replication"

Start-Sleep -s 30

Set-CsUser -Identity $c.Identity -enterprisevoiceenabled $True -lineuri $lineuri
Grant-CsDialPlan -Identity $c.Identity -PolicyName $c.DialPlan
Grant-CsVoicePolicy -Identity $c.Identity -PolicyName $c.VoicePolicy
}

As you can see, the script turns the 10 digit phone number into E.164 format and adds the extension (if needed) and then sets it as the LineURI for the user. The .csv file will have the following columns added for this script:

PhoneNumber	Extension	DialPlan	VoicePolicy
2815551234	1234	HoustonDialPlan	HoustonVoicePolicy

PowerShell Script to Create a User, Mailbox Enable the Account, and Enable the Account for Lync

I have created a handy script that will create a user account, mailbox enable the account, enable the account for Lync, enable the Lync account for Enterprise Voice, and finally UM enable the account from a local computer without having to log onto the Exchange or Lync servers. This script basically creates the user account creating the Display Name as FirstName Last Name, UPN as FirstInitialLastName@InternalDomain, Alias as FirstInitial.LastName, SIP URI as the same as the e-mail address, and sets the LineURI in the format of tel:+13335551234;ext=1234.

This script is pieced together from other scripts I had so it may not be the most efficient. I will do some more testing and update the script once I get it optimized as well as creating one that will allow you to use a .csv file to mass enable users.

# Static Entries

$ExchangeServer = "ExchangeServer.domain.com"

$LyncServer = "LyncServer.domain.com"

$Registrar = "LyncServer.domain.com"

$dialplan = "Registrar:LyncServer.domain.com"

$intdomain = "domain.com"

$sipdomain = "SIPDomain.com"

$company = "Company Name"

$mbdb = "Mailbox Database Name"

$umpolicy = "Unified Messaging Policy Name"

# Import session information

$user = Get-Credential

$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionURI http://$ExchangeServer/powershell -Credential $user

Import-PSSession $ExchSession

$LyncSession = New-PSSession -ConnectionURI https://$LyncServer/ocspowershell -Credential $user

Import-PSSession $LyncSession

# Data Entry section

$fname = Read-Host "First Name"

$finit = Read-Host "First Initial"

$lname = Read-Host "Last Name"

$password = Read-Host "Password"

$ou = Read-Host "AD OU account will be created in. In the format of OU=OUname,DC=Domain,DC=com"

$desc = Read-Host "Description"

$dept = Read-Host "Department"

$title = Read-Host "Title"

$manager = Read-Host "Manager"

$phone = Read-Host "Phone Number"

$ext = Read-Host "4 Digit Extension"

# Create user and enable mailbox

"Creating and enabling " + $fname + " " + $lname + " for AD and Exchange 2010"

$pwd = convertto-securestring $password -asplaintext -force

$name = $fname + " " + $lname

$upn = $finit + $lname + "@" + $intdomain

$alias = $finit + "." + $lname

$sam = $finit + $lname

New-Mailbox -name $name -userprincipalname $upn -Alias $alias -OrganizationalUnit $ou -SamAccountName $sam -FirstName $fname -Initials '' -LastName $lname -Password $pwd -ResetPasswordOnNextLogon $true -Database $mbdb 

# Pause for 30 seconds for AD 

write-host "Pausing for 30 seconds for AD Changes"

Start-Sleep -s 30 

# Set user properties

"Configuring AD settings for " + $fname + " " + $lname

Get-Mailbox -identity $name | Set-User -Company $company -Department $dept -Title $title -Manager $manager -Phone $phone 

# Pause 10 for AD changes

write-host "Pausing 10 Seconds for AD Changes"

Start-Sleep -s 10

# Enable for lync and configure settings
"Enabling " + $fname + " " + $lname + " for Lync 2010"
$lineuri = "tel:+1" + $phone + ";ext=" + $ext
Get-mailbox -identity $name | Enable-csuser -registrarpool $Registrar -sipaddresstype EmailAddress -sipdomain $sipdomain -enterprisevoiceenabled $True -lineuri $lineuri

# Pause 10 for Lync changes

write-host "Pausing 10 Seconds for Lync Changes"

Start-Sleep -s 10

# Enable For Unified Messaging

"Configuring " + $fname + " " + $lname + " for Unified Messaging"

$sipuri = $fname + "." + $lname + "@" + $sipdomain

Get-Mailbox -identity $name | Enable-UMMailbox -PinExpired $true -UMMailboxPolicy $umpolicy -Extensions $ext -SIPResourceIdentifier $sipuri

I will walk you thru what this script does...

The first commented area (# Static Entries) will be the entries that will be consistent thru the account creation and configuration process. The $ExchangeServer and $LyncServer variables are the servers that you are going to be connecting to via the PowerShell remote connections. The $intdomain and $sipdomain variables are in case your internal domain is different than your SIP domain.

The second commented area (# Import session information) is where it allows you to run this script from your computer instead of logging into the Exchange or Lync servers.

The third commented area (# Data Entry section) is where you will manually type in the requested information. Be careful with your entries because you will have to go back and manually fix anything that may be misspelled after the script has run.

The fourth commented area (# Create user and enable mailbox) is where it will create the user account and enable the mailbox.

The pauses in the script are to allow ample time for AD to replicate prior to making the additional changes. Depending on how large your AD environment is, you may need to add more time to the pauses to allow for AD replication to occur.

If you have any questions or need the script customized, let me know.

I will update the post later with a script that will use a .csv file to mass enable users and allow you to assign them to different MBX databases, Lync pools, Policies, etc.

Use the script at your own risk. There might be typos in the script so test first before running it in production.

Disabling SSLv2 on Lync Edge Server is OK

On a recent Lync deployment at a client site, it was brought to my attention from the security team that SSLv2 was enabled on the Edge Server. I have never heard of this being a vulnerability but then again I am not a security expert. So looking into it and knowing that the Lync 2010 Edge server does not use SSL for any communications (it uses TLS and MTLS), we disabled SSLv2 following the instructions on this link. Then ran this cool online tool to test if the server has SSLv2 enabled by entering in the FQDN of the Access Edge server showing in green letters that the test passed and SSLv2 was disabled on the Access Edge server. The security expert also ran his tests on the server and verified that SSLv2 was disabled. We performed a full battery of Lync functionality testing involving the Edge server and it still worked without any issues.