FYI:<\/p>\n
- \n
- Mail-enabled contacts are derived from the\u00a0targetAddress, proxyAddresses, legacyExchangeDN,\u00a0and mailNickName attributes.<\/li>\n<\/ul>\n
<\/p>\n
Open the full CSV report in Excel and add a column filter and freeze the top row. This will help you to filter the data and move through the spreadsheet with ease.<\/p>\n
Contacts are typically used to represent external users for the purpose of e-mail. But before making this statement you need to ensure that either a 3rd party or in house application are not making use of them in other ways.<\/p>\n
Contacts can be ‘disabled’ by mail-disabling them.\u00a0Always clearly document situations where contacts have been disabled. i.e. Are they being kept for a reason, such as for their phone details, etc, or should they be deleted. Delete them if they are no longer valid.<\/p>\n
Contacts should not be left in the default Users container (ie. CN=Users). Move them to a more appropriate and meaningful location.<\/p>\n
Contacts\u00a0whose name contains CNF: means that it\u2019s a duplicate object\u00a0caused by conflicting\/duplicate objects. This typically occurs when objects are created on different Read Write Domain Controllers at nearly the same time. After replication kicks in and those conflicting\/duplicate objects replicate to other Read Write Domain Controllers, Active Directory replication applies a conflict resolution mechanism to ensure every object is and remains unique. Verify that there is a matching normal object, merge attributes and then the\u00a0conflicting\/duplicate object can be deleted.<\/p>\n
ADFS Farm objects under the certificate sharing container need to be managed by the ADFS team and not by this process. They are not a traditional contact object. I always found it bizarre that Microsoft chose to create these as Contact objects. I don’t have an issue with it, but just find it dangerous to think that some IT Pros may just blindly run a script to delete all old contact objects before understanding what they really are!<\/p>\n
From here you\u00a0can start to implement some good policies and processes around the management of contacts.<\/p>\n
At the end of the day a nice way to manage contacts is to set their expirationTime attribute. This will give us the ability to implement a nice life cycle management process. You can go one step further and add a user or mail-enabled security group to the manager attribute. This will give us the ability to implement some workflow when the contact is x days before expiring.<\/p>\n
The following screen shot is from a recent health check and audit I completed.<\/p>\n
There are 4 things here that stick out here like a sore thumb:<\/p>\n
- \n
- 9.35% of Contacts are mail-disabled. Are they serving any purpose?<\/li>\n
- None of the Contacts have an expiration time set<\/li>\n
- More or less none of the Contacts have a manager set<\/li>\n
- Contacts left in the default Users container<\/li>\n<\/ul>\n
![\"Contact](\"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-content\/uploads\/2015\/01\/ContactObjectOverview.png\" "\\"Contact")
<\/a><\/p>\nIt’s very clear to me just by looking at this that they have no life cycle management process in place for their Contact objects.<\/p>\n
The following screen shot is the full report from the same health check. Whilst I\u2019ve had to blur our some of the data you can get an idea from the column headings that it\u2019s fairly extensive. There are a further 8\u00a0columns that I was unable to capture in the screen shot due to screen resolution.<\/p>\n
![\"Contact](\"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-content\/uploads\/2015\/01\/ContactObjectFullReport.png\" "\\"Contact")
<\/a><\/p>\nHere is the \n\tGet-ContactReport.ps1\t(1316 downloads\t)\n<\/a>\n\u00a0script:<\/p>\n
\r\n<# This script will enumerate all contact objects in a Domain, providing both a summary overview and a full report based on the values of the following attributes: - name - distinguishedname - givenName - sn - initials - mail - telephoneNumber - mobile - displayName - description - title - company - physicalDeliveryOfficeName - manager - employeeID - employeeNumber - employeeType - msexchextensioncustomattribute1 - msexchextensioncustomattribute2 - msexchextensioncustomattribute3 - msexchextensioncustomattribute4 - msexchextensioncustomattribute5 - isCriticalSystemObject - expirationtime - info - whencreated - whenchanged - memberOf - targetAddress - proxyAddresses - legacyExchangeDN - mailNickName - msRTCSIP-Line - otherIpPhone We further derive: - The Parent OU from the distinguishedname attribute. - MailEnabled from targetAddress, proxyAddresses, legacyExchangeDN, and mailNickName. - http:\/\/pmoreland.blogspot.com.au\/2013\/03\/creating-mail-contacts-and-distribution.html - UMIntegrationObject from msRTCSIP-Line and otherIpPhone We check to see if the Surname (sn) contains a non-alpha character. This is to ensure that a consistent standard\/pattern has been used for hyphenated namnes, some Asian names, and tussenvoegsels. Syntax examples: - To execute the script in the current Domain: Get-ContactReport.ps1 - To execute the script against a trusted Domain: Get-ContactReport.ps1 -TrustedDomain mydemosthatrock.com Script Name: Get-ContactReport.ps1 Release 2.3 Written by Jeremy@jhouseconsulting.com 27\/12\/2013 Modified by Jeremy@jhouseconsulting.com 14\/12\/2015 #>\r\n#-------------------------------------------------------------\r\nparam([String]$TrustedDomain,[switch]$verbose)\r\n\r\nif ($verbose.IsPresent) { \r\n $VerbosePreference = 'Continue' \r\n Write-Verbose "Verbose Mode Enabled" \r\n} \r\nElse { \r\n $VerbosePreference = 'SilentlyContinue' \r\n}\r\n\r\n#-------------------------------------------------------------\r\n\r\n# Set this to the OU structure where the you want to search to\r\n# start from. Do not add the Domain DN. If you leave it blank,\r\n# the script will start from the root of the domain.\r\n$OUStructureToProcess = ""\r\n\r\n# Set this to true to include the employeeID, employeeNumber and\r\n# employeeType attributes.\r\n$IncludeEmployeeAttributes = $True\r\n\r\n# Set this to true to include the first 3 msexchextensioncustomattribute\r\n# attributes. Really handy for Office365 license management with DirSync.\r\n$IncludeExchExtensionCustomAttributes = $False\r\n\r\n# Set this to true to include extra contact attributes such as\r\n# displayName, description, telephoneNumber, mobile, title,\r\n# company, physicalDeliveryOfficeName\r\n$IncludeExtendedDetails = $True\r\n\r\n# Set this to true to include the user's direct group membership\r\n$IncludeMemberOf = $True\r\n\r\n# Set the name of the attribute you want to populate for objects\r\n# to be evaluated as a stale or non-stale object.\r\n$ExcludeAttribute = "comment"\r\n\r\n# Set the text within the $ExcludeAttribute that you want to use\r\n# to evaluate if the object should be excluded from the stale\r\n# object collection.\r\n$ExcludeText = "Decommission=False"\r\n\r\n# Set this to the delimiter for the CSV output\r\n$Delimiter = ","\r\n\r\n# Set this to remove the double quotes from each value within the\r\n# CSV.\r\n$RemoveQuotesFromCSV = $False\r\n\r\n# Set this value to true if you want to see the progress bar.\r\n$ProgressBar = $True\r\n\r\n#-------------------------------------------------------------\r\n\r\n$invalidChars = [io.path]::GetInvalidFileNamechars() \r\n$datestampforfilename = ((Get-Date -format s).ToString() -replace "[$invalidChars]","-")\r\n\r\n# Get the script path\r\n$ScriptPath = {Split-Path $MyInvocation.ScriptName}\r\n$ReferenceFileFull = $(&$ScriptPath) + "\\ContactReport-$($datestampforfilename).csv"\r\n$ReferenceFileSummaryTotals = $(&$ScriptPath) + "\\ContactReport-Summary-Totals-$($datestampforfilename).csv"\r\n\r\nif (Test-Path -path $ReferenceFileFull) {\r\n remove-item $ReferenceFileFull -force -confirm:$false\r\n}\r\nif (Test-Path -path $ReferenceFileSummaryTotals) {\r\n remove-item $ReferenceFileSummaryTotals -force -confirm:$false\r\n}\r\n\r\nif ([String]::IsNullOrEmpty($TrustedDomain)) {\r\n # Get the Current Domain Information\r\n $domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n} else {\r\n $context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("domain",$TrustedDomain)\r\n Try {\r\n $domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($context)\r\n }\r\n Catch [exception] {\r\n write-host -ForegroundColor red $_.Exception.Message\r\n Exit\r\n }\r\n}\r\n\r\n# Get AD Distinguished Name\r\n$DomainDistinguishedName = $Domain.GetDirectoryEntry() | select -ExpandProperty DistinguishedName \r\n\r\nIf ($OUStructureToProcess -eq "") {\r\n $ADSearchBase = $DomainDistinguishedName\r\n} else {\r\n $ADSearchBase = $OUStructureToProcess + "," + $DomainDistinguishedName\r\n}\r\n\r\n$TotalcontactsProcessed = 0\r\n$contactCount = 0\r\n$TotalMailEnabledObjects = 0\r\n$TotalMailDisabledObjects = 0\r\n$TotalDefaultUsersContainer = 0\r\n$TotalUMIntegrationObjects = 0\r\n$TotalADFSFarmObjects = 0\r\n$TotalConflictingObjects = 0\r\n$TotalManagerNotSet = 0\r\n$TotalExpirationTimeNotSet = 0\r\n$TotalExcludedObjects = 0\r\n\r\n# Create an LDAP search for all contacts\r\n$ADFilter = "(&(objectClass=contact)(objectcategory=person))"\r\n\r\n# There is a known bug in PowerShell requiring the DirectorySearcher\r\n# properties to be in lower case for reliability.\r\n$ADPropertyList = @("name","distinguishedname","givenname","sn","initials","mail", `\r\n "telephonenumber","mobile","displayname","description","title", `\r\n "company","physicaldeliveryofficename","manager","employeeid", `\r\n "employeenumber","employeetype","info","iscriticalsystemobject", `\r\n "whencreated","whenchanged","expirationtime","memberof", `\r\n $ExcludeAttribute,"msexchextensioncustomattribute1", `\r\n "msexchextensioncustomattribute2","msexchextensioncustomattribute3", `\r\n "msexchextensioncustomattribute4","msexchextensioncustomattribute5", `\r\n "targetaddress","proxyaddresses","legacyexchangedn","mailnickname", `\r\n "msrtcsip-line","otheripphone")\r\n\r\n$ADScope = "SUBTREE"\r\n$ADPageSize = 1000\r\n$ADSearchRoot = New-Object System.DirectoryServices.DirectoryEntry("LDAP:\/\/$($ADSearchBase)") \r\n$ADSearcher = New-Object System.DirectoryServices.DirectorySearcher\r\n$ADSearcher.SearchRoot = $ADSearchRoot\r\n$ADSearcher.PageSize = $ADPageSize \r\n$ADSearcher.Filter = $ADFilter \r\n$ADSearcher.SearchScope = $ADScope\r\nif ($ADPropertyList) {\r\n foreach ($ADProperty in $ADPropertyList) {\r\n [Void]$ADSearcher.PropertiesToLoad.Add($ADProperty)\r\n }\r\n}\r\nTry {\r\n write-host -ForegroundColor Green "`nPlease be patient whilst the script retrieves all contact objects and specified attributes..."\r\n $colResults = $ADSearcher.Findall()\r\n # Dispose of the search and results properly to avoid a memory leak\r\n $ADSearcher.Dispose()\r\n $contactCount = $colResults.Count\r\n}\r\nCatch {\r\n $contactCount = 0\r\n Write-Host -ForegroundColor red "The $ADSearchBase structure cannot be found!"\r\n}\r\n\r\nif ($contactCount -ne 0) {\r\n write-host -ForegroundColor Green "`nProcessing $contactCount contact objects in the $domain Domain..."\r\n $colResults | ForEach-Object {\r\n $contactDN = $_.Properties.distinguishedname[0]\r\n $ParentOU = $contactDN -split '(?<![\\\\]),'\r\n $ParentOU = $ParentOU[1..$($ParentOU.Count-1)] -join ','\r\n $Name = $_.Properties.name[0]\r\n If (($_.Properties.givenname | Measure-Object).Count -gt 0) {\r\n $Firstname = $_.Properties.givenname[0]\r\n } else {\r\n $Firstname = ""\r\n }\r\n If (($_.Properties.sn | Measure-Object).Count -gt 0) {\r\n $Surname = $_.Properties.sn[0]\r\n $nonalphacharsinsurname = $Surname -match '[^a-zA-Z]'\r\n } else {\r\n $Surname = ""\r\n $nonalphacharsinsurname = $False\r\n }\r\n If (($_.Properties.initials | Measure-Object).Count -gt 0) {\r\n $Initials = $_.Properties.initials[0]\r\n } else {\r\n $Initials = ""\r\n }\r\n If (($_.Properties.employeeid | Measure-Object).Count -gt 0) {\r\n $EmployeeID = $_.Properties.employeeid[0]\r\n } else {\r\n $EmployeeID = ""\r\n }\r\n If (($_.Properties.employeenumber | Measure-Object).Count -gt 0) {\r\n $EmployeeNumber = $_.Properties.employeenumber[0]\r\n } else {\r\n $EmployeeNumber = ""\r\n }\r\n If (($_.Properties.employeetype | Measure-Object).Count -gt 0) {\r\n $EmployeeType = $_.Properties.employeetype[0]\r\n } else {\r\n $EmployeeType = ""\r\n }\r\n If (($_.Properties.mail | Measure-Object).Count -gt 0) {\r\n $EMail = $_.Properties.mail[0]\r\n } else {\r\n $EMail = ""\r\n }\r\n\r\n $MailEnabled = $False\r\n If (($_.Properties.targetaddress | Measure-Object).Count -gt 0 -AND\r\n ($_.Properties.proxyaddresses | Measure-Object).Count -gt 0 -AND\r\n ($_.Properties.legacyexchangedn | Measure-Object).Count -gt 0 -AND\r\n ($_.Properties.mailnickname | Measure-Object).Count -gt 0 ) {\r\n $MailEnabled = $True\r\n $TotalMailEnabledObjects = $TotalMailEnabledObjects + 1\r\n } Else {\r\n $TotalMailDisabledObjects = $TotalMailDisabledObjects + 1\r\n }\r\n\r\n If ($IncludeExtendedDetails) {\r\n If (($_.Properties.displayname | Measure-Object).Count -gt 0) {\r\n $DisplayName = $_.Properties.displayname[0]\r\n } else {\r\n $DisplayName = ""\r\n }\r\n If (($_.Properties.description | Measure-Object).Count -gt 0) {\r\n $Description = $_.Properties.description[0]\r\n } else {\r\n $Description = ""\r\n }\r\n If (($_.Properties.telephonenumber | Measure-Object).Count -gt 0) {\r\n $TelephoneNumber = $_.Properties.telephonenumber[0].Replace(";","|")\r\n } else {\r\n $TelephoneNumber = ""\r\n }\r\n If (($_.Properties.mobile | Measure-Object).Count -gt 0) {\r\n $Mobile = $_.Properties.mobile[0].Replace(";","|")\r\n } else {\r\n $Mobile = ""\r\n }\r\n If (($_.Properties.title | Measure-Object).Count -gt 0) {\r\n $Title = $_.Properties.title[0]\r\n } else {\r\n $Title = ""\r\n }\r\n If (($_.Properties.company | Measure-Object).Count -gt 0) {\r\n $Company = $_.Properties.company[0]\r\n } else {\r\n $Company = ""\r\n }\r\n If (($_.Properties.physicaldeliveryofficename | Measure-Object).Count -gt 0) {\r\n $Office = $_.Properties.physicaldeliveryofficename[0]\r\n } else {\r\n $Office = ""\r\n }\r\n }\r\n\r\n If (($_.Properties.manager | Measure-Object).Count -gt 0) {\r\n $Manager = $_.Properties.manager[0]\r\n } else {\r\n $Manager = ""\r\n $TotalManagerNotSet = $TotalManagerNotSet + 1\r\n }\r\n\r\n If (($_.Properties.msexchextensioncustomattribute1 | Measure-Object).Count -gt 0) {\r\n $msExchExtensionCustomAttribute1 = $_.Properties.msexchextensioncustomattribute1[0]\r\n } else {\r\n $msExchExtensionCustomAttribute1 = ""\r\n }\r\n If (($_.Properties.msexchextensioncustomattribute2 | Measure-Object).Count -gt 0) {\r\n $msExchExtensionCustomAttribute2 = $_.Properties.msexchextensioncustomattribute2[0]\r\n } else {\r\n $msExchExtensionCustomAttribute2 = ""\r\n }\r\n If (($_.Properties.msexchextensioncustomattribute3 | Measure-Object).Count -gt 0) {\r\n $msExchExtensionCustomAttribute3 = $_.Properties.msexchextensioncustomattribute3[0]\r\n } else {\r\n $msExchExtensionCustomAttribute3 = ""\r\n }\r\n If (($_.Properties.msexchextensioncustomattribute4 | Measure-Object).Count -gt 0) {\r\n $msExchExtensionCustomAttribute4 = $_.Properties.msexchextensioncustomattribute4[0]\r\n } else {\r\n $msExchExtensionCustomAttribute4 = ""\r\n }\r\n If (($_.Properties.msexchextensioncustomattribute5 | Measure-Object).Count -gt 0) {\r\n $msExchExtensionCustomAttribute5 = $_.Properties.msexchextensioncustomattribute5[0]\r\n } else {\r\n $msExchExtensionCustomAttribute5 = ""\r\n }\r\n\r\n $whencreated = $_.Properties.whencreated[0]\r\n \r\n # If it was created less than 30 days ago mark it as a new account.\r\n If ($whencreated -gt (Get-Date).AddDays(-30)) {\r\n $IsNew = $True\r\n } else {\r\n $IsNew = $False\r\n }\r\n\r\n $whenchanged = $_.Properties.whenchanged[0]\r\n\r\n If (($_.Properties.expirationtime | Measure-Object).Count -gt 0) {\r\n $ExpirationTime = $_.Properties.expirationtime\r\n } Else {\r\n $ExpirationTime = $NULL\r\n $TotalExpirationTimeNotSet = $TotalExpirationTimeNotSet + 1\r\n }\r\n If ($ExpirationTime -ne $NULL -AND $ExpirationTime -lt (Get-Date)) {\r\n $Expired = $True\r\n } Else {\r\n $Expired = $False\r\n }\r\n\r\n # Check if it should be excluded\r\n $Exclude = $False\r\n If (($_.Properties.$ExcludeAttribute | Measure-Object).Count -gt 0) {\r\n If ($_.Properties.$ExcludeAttribute[0] -eq $ExcludeText) {\r\n $Exclude = $True\r\n $TotalExcludedObjects = $TotalExcludedObjects + 1\r\n }\r\n }\r\n\r\n $Conflict = $False\r\n If ($Name -Like "*CNF:*") {\r\n # Replace the Line Feed character in the name so that it's a nicely represented string.\r\n $Name = $Name -replace "`n",""\r\n $Conflict = $True\r\n $TotalConflictingObjects = $TotalConflictingObjects + 1\r\n }\r\n\r\n If ($ParentOU -Like "CN=Users*") {\r\n $TotalDefaultUsersContainer = $TotalDefaultUsersContainer + 1\r\n }\r\n\r\n If (($_.Properties.iscriticalsystemobject | Measure-Object).Count -gt 0) {\r\n $isCriticalSystemObject = $_.Properties.iscriticalsystemobject[0]\r\n } else {\r\n $isCriticalSystemObject = ""\r\n }\r\n\r\n $UMIntegrationObject = $False\r\n If (($_.Properties.'msrtcsip-line' | Measure-Object).Count -gt 0 -AND\r\n ($_.Properties.otheripphone | Measure-Object).Count -gt 0 ) {\r\n If ($_.Properties.'msrtcsip-line' -like "tel:*" -AND \r\n $_.Properties.otheripphone -like "sip:*" -AND\r\n $_.Properties.otheripphone -like "*;opaque=app:exum:*" ) {\r\n $UMIntegrationObject = $True\r\n $TotalUMIntegrationObjects = $TotalUMIntegrationObjects + 1\r\n }\r\n }\r\n\r\n $ADFSObject = $False\r\n If ($ParentOU -Like "*CN=ADFS,CN=Microsoft,CN=Program Data*") {\r\n $ADFSObject = $True\r\n $TotalADFSFarmObjects = $TotalADFSFarmObjects + 1\r\n }\r\n\r\n If (($_.Properties.info | Measure-Object).Count -gt 0) {\r\n $notes = $_.Properties.info[0]\r\n $notes = $notes -replace "`r`n", "|"\r\n } else {\r\n $notes = ""\r\n }\r\n\r\n If ($IncludeMemberOf) {\r\n $Members = ""\r\n $groups = $_.Properties.memberof | ForEach {\r\n $groupDN = $_\r\n $objGroup = [ADSI]("LDAP:\/\/" + $groupDN)\r\n $Member = $objGroup.samaccountname\r\n If ($Members -ne "" ) {\r\n $Members += "|" + $Member\r\n } else {\r\n $Members += $Member\r\n }\r\n $objGroup = $null\r\n }\r\n }\r\n\r\n $obj = New-Object -TypeName PSObject\r\n $obj | Add-Member -MemberType NoteProperty -Name "Name" -value $Name\r\n $obj | Add-Member -MemberType NoteProperty -Name "ParentOU" -value $ParentOU\r\n $obj | Add-Member -MemberType NoteProperty -Name "Firstname" -value $Firstname\r\n $obj | Add-Member -MemberType NoteProperty -Name "Surname" -value $Surname\r\n $obj | Add-Member -MemberType NoteProperty -Name "NonAlphaCharsInSurname" -value $nonalphacharsinsurname\r\n $obj | Add-Member -MemberType NoteProperty -Name "Initials" -value $Initials\r\n $obj | Add-Member -MemberType NoteProperty -Name "E-Mail" -value $EMail\r\n $obj | Add-Member -MemberType NoteProperty -Name "MailEnabled" -value $MailEnabled\r\n If ($IncludeEmployeeAttributes) {\r\n $obj | Add-Member -MemberType NoteProperty -Name "EmployeeID" -value $EmployeeID\r\n $obj | Add-Member -MemberType NoteProperty -Name "EmployeeNumber" -value $EmployeeNumber\r\n $obj | Add-Member -MemberType NoteProperty -Name "EmployeeType" -value $EmployeeType\r\n }\r\n If ($IncludeExtendedDetails) {\r\n $obj | Add-Member -MemberType NoteProperty -Name "DisplayName" -value $DisplayName\r\n $obj | Add-Member -MemberType NoteProperty -Name "Description" -value $Description\r\n $obj | Add-Member -MemberType NoteProperty -Name "TelephoneNumber" -value $TelephoneNumber\r\n $obj | Add-Member -MemberType NoteProperty -Name "Mobile" -value $Mobile\r\n $obj | Add-Member -MemberType NoteProperty -Name "Title" -value $Title\r\n $obj | Add-Member -MemberType NoteProperty -Name "Company" -value $Company\r\n $obj | Add-Member -MemberType NoteProperty -Name "Office" -value $Office\r\n }\r\n $obj | Add-Member -MemberType NoteProperty -Name "Manager" -value $Manager\r\n If ($IncludeExchExtensionCustomAttributes) {\r\n $obj | Add-Member -MemberType NoteProperty -Name "msExchExtensionCustomAttribute1" -value $msExchExtensionCustomAttribute1\r\n $obj | Add-Member -MemberType NoteProperty -Name "msExchExtensionCustomAttribute2" -value $msExchExtensionCustomAttribute2\r\n $obj | Add-Member -MemberType NoteProperty -Name "msExchExtensionCustomAttribute3" -value $msExchExtensionCustomAttribute3\r\n $obj | Add-Member -MemberType NoteProperty -Name "msExchExtensionCustomAttribute4" -value $msExchExtensionCustomAttribute4\r\n $obj | Add-Member -MemberType NoteProperty -Name "msExchExtensionCustomAttribute5" -value $msExchExtensionCustomAttribute5\r\n }\r\n $obj | Add-Member -MemberType NoteProperty -Name "Exclude" -value $Exclude\r\n $obj | Add-Member -MemberType NoteProperty -Name "IsNew" -value $IsNew\r\n $obj | Add-Member -MemberType NoteProperty -Name "ExpirationTime" -value $ExpirationTime\r\n $obj | Add-Member -MemberType NoteProperty -Name "Expired" -value $Expired\r\n $obj | Add-Member -MemberType NoteProperty -Name "WhenCreated" -value $whencreated\r\n $obj | Add-Member -MemberType NoteProperty -Name "WhenChanged" -value $whenchanged\r\n $obj | Add-Member -MemberType NoteProperty -Name "Conflicting" -value $Conflict\r\n $obj | Add-Member -MemberType NoteProperty -Name "isCriticalSystemObject" -value $isCriticalSystemObject\r\n $obj | Add-Member -MemberType NoteProperty -Name "UMIntegrationObject" -value $UMIntegrationObject\r\n $obj | Add-Member -MemberType NoteProperty -Name "ADFSObject" -value $ADFSObject\r\n $obj | Add-Member -MemberType NoteProperty -Name "Notes" -value $Notes\r\n If ($IncludeMemberOf) {\r\n $obj | Add-Member -MemberType NoteProperty -Name "MemberOf" -value $Members\r\n }\r\n\r\n # PowerShell V2 doesn't have an Append parameter for the Export-Csv cmdlet. Out-File does, but it's\r\n # very difficult to get the formatting right, especially if you want to use quotes around each item\r\n # and add a delimeter. However, we can easily do this by piping the object using the ConvertTo-Csv,\r\n # Select-Object and Out-File cmdlets instead.\r\n if ($PSVersionTable.PSVersion.Major -gt 2) {\r\n $obj | Export-Csv -Path "$ReferenceFileFull" -Append -Delimiter $Delimiter -NoTypeInformation -Encoding ASCII\r\n } Else {\r\n if (!(Test-Path -path $ReferenceFileFull)) {\r\n $obj | ConvertTo-Csv -NoTypeInformation -Delimiter $Delimiter | Select-Object -First 1 | Out-File -Encoding ascii -filepath "$ReferenceFileFull"\r\n }\r\n $obj | ConvertTo-Csv -NoTypeInformation -Delimiter $Delimiter | Select-Object -Skip 1 | Out-File -Encoding ascii -filepath "$ReferenceFileFull" -append -noclobber\r\n }\r\n\r\n $TotalcontactsProcessed ++\r\n If ($ProgressBar) {\r\n Write-Progress -Activity 'Processing Contacts' -Status ("Count: $($TotalcontactsProcessed) - Name: {0}" -f $Name) -PercentComplete (($TotalcontactsProcessed\/$contactCount)*100)\r\n }\r\n\r\n }\r\n\r\n # Dispose of the search and results properly to avoid a memory leak\r\n $colResults.Dispose()\r\n\r\n # Remove the quotes from the output file.\r\n If ($RemoveQuotesFromCSV) {\r\n (get-content "$ReferenceFileFull") |% {$_ -replace '"',""} | out-file "$ReferenceFileFull" -Fo -En ascii\r\n }\r\n\r\n # Note that for the summary output I went with a hashtable instead of binding multiple objects together.\r\n # Whilst some of the code may seem excessive and repetitive, I found this the simplest method to achieve\r\n # the desired output.\r\n $SummaryHashTable = @{}\r\n $Item = 0\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalMailEnabledObjects\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that are mail-enabled"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalMailEnabledObjects\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that are mail-enabled" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f (($TotalMailDisabledObjects - $TotalADFSFarmObjects)\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that are mail-disabled (excluding ADFS Farm objects)"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value ($TotalMailDisabledObjects - $TotalADFSFarmObjects)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that are mail-disabled (excluding ADFS Farm objects)" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalDefaultUsersContainer\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts left in the default Users container"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalDefaultUsersContainer\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts left in the default Users container" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalUMIntegrationObjects\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that are UM Integration objects"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalUMIntegrationObjects\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that are UM Integration objects" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalADFSFarmObjects\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that are ADFS Farm objects"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalADFSFarmObjects\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that are ADFS Farm objects" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalConflictingObjects\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that are conflicting\/duplicate objects"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalConflictingObjects\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that are conflicting\/duplicate objects" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalExcludedObjects\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that have their `'$ExcludeAttribute`' attribute set to `'$ExcludeText`'"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalExcludedObjects\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that have their `'$ExcludeAttribute`' attribute set to `'$ExcludeText`'" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalExpirationTimeNotSet\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that have no expiration time set (expirationTime attribute)"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalExpirationTimeNotSet\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that have no expiration time set (expirationTime attribute)" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n $Summaryobj = New-Object -TypeName PSObject\r\n $percent = "{0:P}" -f ($TotalManagerNotSet\/$ContactCount)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Item" -value ($Item = $Item + 1)\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Statement" -value "Contacts that have no manager set (manager attribute)"\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Total_Count" -value $TotalManagerNotSet\r\n $Summaryobj | Add-Member -MemberType NoteProperty -Name "Overall_Percentage" -value $percent\r\n $SummaryHashTable = $SummaryHashTable + @{"Contacts that have no manager set (manager attribute)" = $Summaryobj}\r\n $Summaryobj = $Null\r\n\r\n write-host -ForegroundColor Green "Summary Totals:"\r\n\r\n $Output = $SummaryHashTable.values | ForEach {$_ } | ForEach {$_ } | Sort-Object Item\r\n $Output | Format-Table -AutoSize\r\n\r\n # Write-Output $Output | Format-Table\r\n $Output | Export-Csv -Path "$ReferenceFileSummaryTotals" -Delimiter $Delimiter -NoTypeInformation\r\n\r\n # Remove the quotes\r\n If ($RemoveQuotesFromCSV) {\r\n (get-content "$ReferenceFileSummaryTotals") |% {$_ -replace '"',""} | out-file "$ReferenceFileSummaryTotals" -Fo -En ascii\r\n }\r\n\r\n write-host "Notes:" -foregroundColor Yellow\r\n write-host " - Contacts are typically used to represent external users for the purpose of e-mail." -foregroundColor Yellow\r\n write-host " - Contacts can be 'disabled' by mail-disabling them." -foregroundColor Yellow\r\n write-host " - Always clearly document situations where contacts have been disabled. i.e. Are they`n being kept for a reason, such as for their phone details, etc, or should they be`n deleted. Delete them if they are no longer valid." -foregroundColor Yellow\r\n write-host " - Contacts should not be left in the default Users container (ie. CN=Users). Move them to`n a more appropriate and meaningful location." -foregroundColor Yellow\r\n write-host " - Lync or OCS\/Exchange Unified Messaging (UM) integration Objects are contact objects used`n for Auto Attendant and Subscriber Access (Dial Plans) numbers for Enterprise Voice. Do`n not treat them as a traditional contact object." -foregroundColor Yellow\r\n write-host " - ADFS Farm objects under the certificate sharing container need to be managed by the ADFS`n team and not by this process. They are not a traditional contact object." -foregroundColor Yellow\r\n write-host " - A nice way to manage contacts is to set their expirationTime attribute. This will give`n us the ability to implement a nice life cycle management process. You can go one step`n further and add a user or mail enabled security group to the manager attribute. This`n will give us the ability to implement some workflow when the contact is x days before`n expiring." -foregroundColor Yellow\r\n\r\n write-host "`nCSV files to review:" -foregroundColor Yellow\r\n write-host " - $ReferenceFileFull" -foregroundColor Yellow\r\n write-host " - $ReferenceFileSummaryTotals" -foregroundColor Yellow\r\n\r\n}\r\n<\/pre>\nEnjoy!<\/p>\n","protected":false},"excerpt":{"rendered":"
This PowerShell script is one of the most comprehensive you will find that provides a thorough overview and full report of all contact\u00a0objects in a domain. It is the culmination of many Active Directory audit and reviews and therefore contains valuable input from many customers. A lot of thought has been put into the logic … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[202,5],"tags":[428,284,337,385,386,374,384,387,379,378,341,340],"class_list":["post-1484","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-scripting","tag-active-directory","tag-ad","tag-adds","tag-adfs-farm-objects","tag-certificate-sharing-container","tag-cnf","tag-contact","tag-life-cycle","tag-mail-disabled","tag-mail-enabled","tag-posh","tag-powershell"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/comments?post=1484"}],"version-history":[{"count":11,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1484\/revisions"}],"predecessor-version":[{"id":1622,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1484\/revisions\/1622"}],"wp:attachment":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/media?parent=1484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/categories?post=1484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/tags?post=1484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}