You can just find the user via the ADUC (Active Directory Users and Computers), go to the ‘attributes‘ tab on them, find ‘proxyaddresses‘ and add a new record prefixed with smtp:. For example, you could add ‘smtp:firstname.lastname@domain.com‘
But what if you need to add lots of aliases to lots of people?
You can do this with just a CSV file and the right PowerShell commands.
First, lets start off with the formatting of the CSV file. This should have two columns, one for the samaccountname of the user and another for the proxy addresses. Proxy addresses NEED to be prefixed with ‘smtp:‘, separated by a semi-colon and all lowercase.
Here’s an example:
samaccountname
Proxyaddresses
username
smtp:name@domain.com;smtp:name2@domain.com
Next, we need to build the correct PowerShell script. I’ll list the steps of the script below followed by the script itself:
Import the CSV file
Run through each item in the CSV and try to add the proxy addresses
Output either a success or failure message
Once you’ve built both components, you’ll need to update the CSV path in the PowerShell script.
You can now run the script for the aliases to be created. It can take a while for the entries to show, for me it’s typically 30 seconds to 5 minutes depending on the size of the CSV.
I have created the *final* iteration of this WPF form which can be found here
*UPDATE*
I didn’t like having to remote desktop into my domain controller and couldn’t figure out if there was a LAPS tool included in RSAT tools so I decided just to make my own and to add some extra features.
I wanted the GUI to look pretty much identity to the actual LAPS GUI. You can see the difference below:
My custom GUI
Default GUI
You might be able to see that I changed the “Set” button to say “Set and Update”. This was because I wanted the form to also attempt to update the group policy settings on the computer so that it would get a new password a lot quicker than the original GUI.
There’s not much else I can say, I will leave the entire script below for you to copy and paste. You will need to add the domain controller for your environment in the $domaincontroller variable at the top of the script. I have converted this to an EXE and run whenever I need it, never skips a beat. Let me know how you get on with it. Enjoy!
This is something that I have recently created so that when a script asks for a credentials and there is an error, it doesn’t display a big, ugly and often intimidating error message for any poor soul trying to run my scripts.
That’s why I have recently (as in yesterday) “created” a “fool proof” way of entering and validating credentials against a domain.
This was a problem because whenever someone ran my script and did ANYTHING other than enter perfectly correct credentials, it would throw and error and exit the script. Or even carry on with the script WITHOUT THE CREDENTIALS, which obviously wouldn’t work. I know, I know. Amateur hour! But it was a crap system I must admit.
That’d why I spent and hour or so creating this beauty! It captures any errors, such as null credentials and incorrect credentials and only continues if a user exists with the same samaccountname as the one entered at the credentials prompt and if the user is in the domain admins group. Just for added “security”. Really I just want the appropriate people to be using the script.
This is the code I use!
#PROMPTING FOR CREDENTIALS
$cred = $host.UI.PromptForCredential("Need credentials", "Please enter your username and password.", "", "")
if ($cred -ne $null -and $cred -ne ''){
#CHECKING IF THE CREDENTIAL USERNAME EXISTS
$check = $(try {Get-ADUser -Identity $cred.UserName} catch {$null})
if ($check -ne $null){
#GETTING CREDENTIAL USERNAME GROUPMEMBERSHIP
$checkadmin = Get-ADPrincipalGroupMembership -Identity $cred.UserName
$checkadminrefined = $checkadmin.SamAccountName
#PUTTING GROUP MEMBERSHIP INTO AN ARRAY
$array = $checkadminrefined
#CHECKING IF USER GROUP LIST CONTAINS DOMAIN ADMINS
if ($array -contains "Domain Admins"){
Write-Host "Credentials are GOOD! - Continuing with script" -ForegroundColor Green
Start-Sleep -Seconds 1
}else{
#RESULT IF USER IS NOT DOMAIN ADMINS
Clear-Host
Write-Host "Credentials are not a domain admin! - Close and start again" -ForegroundColor Red ;
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
Exit
}
}else{
#RESULT IF NO USER CAN BE FOUND FROM CREDENTIAL USERNAME
Clear-Host
Write-Host "Check is empty - No user found matching credentials supplied! - Close and start again" -ForegroundColor Red
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
Exit
}
}else{
#RESULT IF PROMPT IS CLOSED / NO CREDENTIALS SUPPLIED
Clear-Host
write-host "No credentials supplied - Close and start again" -ForegroundColor Red
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
Exit
}
You should be able to read the script and see which each part does. I left comments in the script which I don’t normally do since it might be easier for you to see what its doing with pointers at each stage.
This sort of thing is useful if you have a bunch of users that have passwords which are set to not expired, but then you decide that they do need to expire. But if you simply untick the “Password doesn’t expired” attribute then it will instantly make them change their password because the “pwdLastSet” date will be from when the user was first set-up.
This trick will set the “pwdLastSet” date to today so that they have some warning before being told to reset their password.
First of all, make sure that you have “Advanced Features” turned on from the “View” menu.
Now find the user that you want to reset the value for and edit their properties. Navigate to the “Attribute Editor” tab and scroll down until you see the “pwdLastSet” attribute.
Edit the value to be “0“, this means that the value has never been set. See screenshot below.
Now click okay on all of the boxes until the users properties window has closed. Now reopen the users window, go back to the attributes editor and change pwdLastSet to “-1. See screenshot below:
Now press okay to all the boxes until the users properties window has closed. Now when you check for the pwdLastSet attribute it will be set to the current date.
