Here’s a quick powershell snippet to find accounts that don’t already have a photo set:

Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=Staff,DC=nwtraders,DC=msft" -properties thumbnailPhoto | ? {!$_.thumbnailPhoto} | select Name

• Create the account and Exchange mailbox;
• Set relevant attributes (Job Title, Office Address etc);
• Enable the user for office communicator;
• Set the calendar permissions so that everyone can view the persons calendar;

I chose Powershell as my tool of choice, it’s extremely flexible for stuff like this and most of the management functionality comes out the box with Exchange 2007 and later. I initially used Glen Scales’ EWS module for setting permissions and other bits but as we moved to Exchange 2010 the need for EWS disappeared (Thanks to functionality like Set-MailboxFolderPermissions).

The only third-party software I now use is Quest’s ActiveRoles Management Shell for Active Directory as there doesn’t seem to be a decent way to set custom attributes on a user account. Short of writing my own managed code to do it, or calling another application to make the change Quest’s tool seems to be the best choice.

I eventually came up with the following quick and dirty script to create users, based on the contents of a CSV file it will:

• Create the mailbox (uses New-Mailbox);
• Set attributes on the AD account such as the job title, office address etc;
• Set the default calendar permissions to ‘Reviewer’
• Set attributes on the account, enabling it to use Office Communications Server
• Generate a welcome letter to the user, including the OWA address and other bits of information

The format of the CSV file is as follows:

GivenName,Surname,Password,PhisicalDeliveryLocation,JobTitle
John,Doe,MyFirstPassword123!,London,Test Account

And finally, the PowerShell script itself:

#
# Create user accounts in AD, Exchange and OCS.
# This script will read a CSV file and create user accounts based on that information.
#
# Requirements:
#  [+] http://www.quest.com/powershell/activeroles-server.aspx (For setting
#      attributes on an AD DS account)
#  [+] Exchange Management Console installed (for Powershell stuff, new-mailbox,
#      Get-MailboxDatabase etc).
#
#import-module activedirectory;
Add-PSSnapin Quest.ActiveRoles.ADManagement

$cfgTab = [char]9
$cfgCompany = "NW Traders";
$cfgOCSHomeServer = "CN=LC Services,CN=Microsoft,CN=OCSSRV01,CN=Pools,CN=RTC Service,CN=Services,CN=Configuration,DC=nwtraders,DC=msft"; # OCS Server
$cfgMailDomain = "@nwtraders.msft"; #E-Mail Domain

#=============================================================================
# A series of hash tables for office information.
#=============================================================================
$cfgLondon = @{
  "Address" = "10 Downing Street, London, SW1A 2AA";
  "Telephone" = "+44 2079 250 918";
  "OU" = "OU=London,OU=Europe,OU=Users,DC=NWTRADERS,DC=MSFT";
  "DC" = "LONDON" };

$cfgWashington = @{
  "Address" = "The White House, 1600 Pennsylvania Avenue NW, Washington, DC 20500";
  "Telephone" = "+1 202 456 1414";
   "OU" = "OU=Washington,OU=US,OU=Users,DC=NWTRADERS,DC=MSFT";
  "DC" = "WASHINGTON" };

#=============================================================================
# Creates an array of the above hash tables.
#=============================================================================
$cfgOffices = @{
  "London" = $cfgLondon;
  "Washington" = $cfgWashington;
  };

#=============================================================================
# Displays a select file dialog box, returning the path to a CSV file.
#=============================================================================
function chooseCSVfile
{
	param([string]$Title,[string]$Directory,[string]$Filter="CSV Files (*.csv)|*.csv")
	[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null
	$openFileDialog = New-Object System.Windows.Forms.OpenFileDialog
	$openFileDialog.InitialDirectory = $Directory
	$openFileDialog.Filter = $Filter
	$openFileDialog.Title = $Title
	$openFileDialog.ShowHelp = $true

	$Show = $openFileDialog.ShowDialog()

	If ($Show -eq "OK")
	{
		Return $openFileDialog.FileName
	}
	Else
	{
		Exit
	}
}

#=============================================================================
# Generate welcome e-mail.
#=============================================================================
Function generateIntroLetter
{
	param( [string]$GivenName, [string]$samAccountName, [string]$Password, [string]$DisplayName, [string]$DomainController )

	$tmpServer = get-mailbox $DisplayName -DomainController $DomainController | select servername
	$tmpOWA = get-OutlookAnywhere -Server $tmpServer.ServerName -DomainController $DomainController -ADPropertiesOnly | select ExternalHostname
	$tmpOWA = "https://" + $tmpOWA.ExternalHostname + "/owa/"

	$rtfBuilder = new-object system.text.stringbuilder 

	# Append RTF header
	$null = $rtfBuilder.Append("{\rtf1\ansi\ansicpg1252\deff0\deflang2057{\fonttbl{\f0\fswiss\fprq2\fcharset0 Calibri;}{\f1\fnil\fcharset0 Calibri;}}")
	$null = $rtfBuilder.Append("`r`n") 

	# Append RTF color table which will contain all Powershell console colors.
	#$null = $rtfBuilder.Append('{\colortbl ;\red0\green0\blue255;}')
	#$null = $rtfBuilder.Append("`r`n") 

	$null = $rtfBuilder.Append("{\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\sa200\sl276\slmult1\f0\fs22 Dear $GivenName,\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("Please find the below access credentials for the NW Traders network. These are the only credentials you should need at NW Traders and will log you into your computer, e-mail account and other systems. As such, they should be kept confidential.\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("\tab Username\tab\tab $samAccountName\line\tab Password\tab\tab $PlainPassword\line\tab Domain\tab\tab\tab NWTRADERS\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("It is highly recommended that you change your password the first time you login. You should be able to use Outlook both in the office and at home, if for some reason that is not available you can access webmail using the following address:\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("\pard\tab{\field{\*\fldinst{HYPERLINK `$tmpOWA`}}{\fldrslt{\ul\cf1 h$tmpOWA}}}\f0\fs22\pard\par")
	$null = $rtfBuilder.Append("\pard\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("If you require support please contact the IT Support team via e-mail, {\field{\*\fldinst{HYPERLINK `mailto:it@nwtraders.msft` }}{\fldrslt{\cf1\ul it@nwtraders.msft}}}\cf0\ulnone\f0\fs22 . Alternatively an increasing number of self-service resources are available on our intranet:\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("\pard\fi720\par")
	$null = $rtfBuilder.Append("\pard\fi720{\field{\*\fldinst{HYPERLINK `http://intranet/`}}{\fldrslt{\ul\cf1 http://intranet/}}}\f0\fs22\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("\pard\sa200\sl276\slmult1\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("Kind Regards,\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("IT Support.\lang9\f1\par")
	$null = $rtfBuilder.Append("`r`n")
	$null = $rtfBuilder.Append("}")

	# Save as RTF File.
	echo $rtfBuilder.ToString() | out-file -Encoding Ascii "$samAccountName.rtf"
}

#=============================================================================
# Displays a list of mailbox databases, which the user needs to choose from.
#=============================================================================
Function chooseMailboxDatabase()
{
	$MbDbase = Get-MailboxDatabase
	$NumOfDB = $MbDbase.Count
	$Number = 0
	$Choice = 0

	If ($NumOfDB -eq $Null)
	{
		Write-Host $MbDbase.Identity
		return $MbDbase.Identity
	}
	else
	{
		foreach ($mbxDB in $MbDbase)
		{
			Write-Host "$Number . " $MbxDB.Identity
			$Number ++
		}
		Write-Host ""
		$Choice = Read-Host "Mailbox Database"
		return $MbDbase[$Choice].Identity
	}
}

#=============================================================================
# Opening user detail list"
#=============================================================================
$FileName = chooseCSVfile -Title "Import an CSV file" -Directory "c:\"
$UserInformation = Import-Csv $FileName

#=============================================================================
# Do some logic about our environment.
#=============================================================================
Foreach ($User in $UserInformation)
{
	$SurName = $User.Surname
	$GivenName = $User.givenName
	$samAccountName = $GivenName + " " + $SurName
	$DisplayName = $SurName + ", " + $GivenName
	$PlainPassword = $User.Password
	$userPrincipalName = $samAccountName + $cfgMailDomain

	#Exchange Specific
	$strMailAddress = $samAccountName -replace " ", ".";
	$strMailAddress += $cfgMailDomain;
	$strMailAlias = $samAccountName -replace " ", ".";

	# Attributes.
	$strOffice = $User.PhisicalDeliveryLocation;
	$strTitle = $user.JobTitle;
	$strOU	= $cfgOffices.Get_Item( $strOffice ).Get_Item("OU")
	$strOAddress = $cfgOffices.Get_Item( $strOffice ).Get_Item("Address");
	$strOTel = $cfgOffices.Get_Item( $strOffice ).Get_Item("Telephone");

Write-Host -Foreground Gray "---------------------------------------------------------------"
Write-Host -Foreground Red " "$DisplayName
Write-Host -Foreground Gray "---------------------------------------------------------------"
	Write-Host " Username:"$cfgTab$samAccountName;
	Write-Host " Password:"$cfgTab$PlainPassword;
	Write-Host " Job Title:"$cfgTab$strTitle;
	Write-Host " OU:"$cfgTab$cfgTab$strOU;
	Write-Host " E-Mail:"$cfgTab$strMailAddress
Write-Host -Foreground Gray "---------------------------------------------------------------"
Write-Host ""

	# Choose a mailbox database for this account.
	$mbDatabase = chooseMailboxDatabase
	Write-Host ""
	Write-Host -Foreground Gray "---------------------------------------------------------------"

	# Lets actually create the account now.
	$Password = ConvertTo-SecureString $PlainPassword -AsPlainText -Force

	# Create Exchange mailbox.
	New-Mailbox -Name $DisplayName -Alias $strMailAlias -OrganizationalUnit $strOU -UserPrincipalName $userPrincipalName -SamAccountName $samAccountName -FirstName $GivenName -Initials '' -LastName $SurName -Password $Password -ResetPasswordOnNextLogon $false -Database $mbDatabase -DomainController $cfgOffices.Get_Item( $strOffice ).Get_Item("DC")  | out-null

	# Set Quest Active Directory stuff to use a DC in the local site (mostly).
	# Otherwise trying to make exchange changes in a remote site using a local
	# DC is going to fail, since the account doesn't exist yet.
	Connect-QADService -service $cfgOffices.Get_Item( $strOffice ).Get_Item("DC") | out-null

	# Set attributes on AD DS account.
	Get-QADUser $DisplayName | set-qaduser -oa @{'Office'=$strOffice; 'StreetAddress'=$strOAddress; 'OfficePhone'=$strOTel; 'Company'=$cfgCompany; 'Title'=$strTitle } | out-null

	# Set calendar permissions.
	Set-MailboxFolderPermission -Identity $strMailAddress`:\Calendar -User Default -AccessRights Reviewer -DomainController $cfgOffices.Get_Item( $strOffice ).Get_Item("DC")  | out-null

	# Create the OCS Account.
	Get-QADUser $DisplayName | set-qaduser -oa @{'msRTCSIP-ArchivingEnabled'=0; 'msRTCSIP-FederationEnabled'=$true; 'msRTCSIP-InternetAccessEnabled'=$true; 'msRTCSIP-OptionFlags'=257; 'msRTCSIP-UserEnabled'=$true; 'msRTCSIP-PrimaryHomeServer'=$cfgOCSHomeServer; 'msRTCSIP-PrimaryUserAddress'=("sip:" + $strMailAddress ).ToString() } | out-null

	# Disconnect QADService.
	disconnect-qadservice

	# Generate Welcome e-mail.
	generateIntroLetter -GivenName $GivenName -samAccountName $samAccountName -Password $PlainPassword -DisplayName $DisplayName -DomainController $cfgOffices.Get_Item( $strOffice ).Get_Item("DC")
}

You can expect outlook similar to the below:

---------------------------------------------------------------
  Doe, John
---------------------------------------------------------------
 Username:      John Doe
 Password:      MyFirstPassword123!
 Company:       NW Traders
 Job Title:     Test Account
 OU:            OU=London,OU=Europe,OU=Users,DC=NWTRADERS,DC=MSFT
 E-Mail:        John.Doe@nwtraders.msft
---------------------------------------------------------------

0 .  LONDON
1 .  WASHINGTON

Mailbox Database: 0
---------------------------------------------------------------

You can then send the resulting RTF document to the persons line manager, or whoever should have it for when the employee starts on their first day.

I should note, Andy Grogan (Exchange MVP) has a very similar tool which you might like to take a look at. I gleaned the Open-CSV idea and plagiarised the choose mailbox database code from him.

To cut a long story short, it’s a long process as most of the functionality is via Powershell rather than the Exchange Management Console.

Anyway, here’s a quick guide.

1. Create the recovery storage group
This just creates an empty storage group for the recovery database, nothing fancy going on here.

[PS] C:\>new-storagegroup -LogFolderPath F:\Backup\Restore\Logs -Name ExchangeRestore -SystemFolderPath F:\Backup\Restore\Data -Recovery
Name                      Server            Replicated        Recovery
----                      ------            ----------        --------
ExchangeRestore           IMM-CORE-EXCH01   None              True
[PS] C:\>

2. Create a new recovery mailbox database
This creates a new empty database for NTBackup to restore to.

[PS] C:\>new-mailboxdatabase -mailboxdatabasetorecover "Mailbox Database" -storagegroup ExchangeRestore -edbfilepath "F:\Backup\Restore\Data\Mailbox Database.edb"
Name                 Server          StorageGroup         Recovery
----                 ------          ------------         --------
Mailbox Database     IMM-CORE-EXCH01 ExchangeRestore      True
[PS] C:\>

3. Restore the mailbox database via NTBackup
Now restore the mailbox database via ntbackup, remembering to tick the “this is the last backup to restore” option. Tick the check box not to mount the store after the restore completes.

4. Mount the restored mailbox database

[PS] C:\>Mount-Database -Identity 'ExchangeRestore\Mailbox Database'
[PS] C:\>

5. Restore the mailbox to a folder in another mailbox
I prefer to redirect the mailbox restore elsewhere, just so that I can look through it and decide what I want to do with the restored data. Below I’m restoring my mailbox to an existing mailbox called ‘Restore’.

[PS] C:\>Restore-Mailbox -RSGMailbox 'Dave Hope' -RSGDatabase 'ExchangeRestore\Mailbox Database' -id 'Restore' -TargetFolder 'Restore'
[PS] C:\>

6. Dismount the recovered mailbox database
We should now be done with our recovered mailbox database, so we can dismount it ready for removal.

[PS] C:\>Dismount-database -Identity 'ExchangeRestore\Mailbox Database'
[PS] C:\>

7. Remove the mailbox database
This removes the mailbox database from the storage group – it doesn’t actually delete the files.

[PS] C:\>Remove-MailboxDatabase -Identity 'ExchangeRestore\Mailbox Database'
[PS] C:\>

8. Remove the storage group
Since we shouldn’t need out recovery storage group (at least, until next time) we can remove that too.

[PS] C:\>Remove-StorageGroup -Identity 'ExchangeRestore'
[PS] C:\>

There, all done! Good luck with your Exchange restore.

Combining the CAS & Mailbox roles prevents OWA proxying
If like me you start off your Exchange migration by just adding a CAS role on a new Exchange 2007 server you’ll notice that it’ll proxy the webmail requests for your 2003 servers.

If you decide to add the mailbox role to that server, it stops doing that and just redirects clients. That’s fine internally, but if you have external people trying to access webmail it’ll just send them to https://exchange2003.nwtraders.local/exchange/

Microsoft have a workaround, which is simply deploying a standalone CAS role. Not a possibility for me, so my only option is to have two seperate OWA URLs.

Migrating AutoAccept sink resources to Exchange 2007 Rooms & Resources
Microsoft implemented booking in Exchaneg 2007, which i’m ecstatic about (no, i’m not being sarcastic). To migrate your legacy resources move the mailbox, and then run the following:

Set-Mailbox -Identity ConferenceRoom1 -Type Room
Set-MailboxCalendarSettings -Identity ConferenceRoom1 -AutomateProcessing AutoAccept

For more infromation, see here.

Annoying things they missed
Nothing’s perfect, but if Microsoft could add the followign in a patch/service pack i’d love them forever.

• Powershell cmdlet to manage calendar permissions – at present, you have to give yourself permissions to the mailbox, open it and set the calendar permissions. Yawn.
• Functionality to set default document favourites – Documents in OWA 2007 is great! but, with a non-technical staff it’d be nice to provide some common shares (their home directory for example) and perhaps our general document store