Tech Blog

The company I work for is much like the Borg where they like to assimilate new companies.

Part of this assimilation often involves a domain trust and adding users from one domain to a second domains AD groups to gain access to permissions in Domain 2.

This is really useful if your giving a user a laptop on domain 1 but they need access to files on domain 2.

My Mate Handsom Dave came up with this script too:

Compare users from Domain 1 and Domain 2 on display name (username didnt match),

Get the Domain 2 groups,

Look at domain 2 groups members,

If they exist in domain 1 then add those people into the group in Domain 2.

Remember: The AD groups need to be Domain Local.

#Get the users from domain1
$domain1 = get-aduser -filter * -Server dc01.domain1.com
#get the users from domain2
$domain2 = get-aduser -filter * -Server dc02.domain2.net
#compare the users on name (not username as they didnt match)
$usercompare = Compare-Object -ReferenceObject $domain1.name -DifferenceObject $domain2.name -IncludeEqual
#If its the same then save to this variable
$inboth = $usercompare | where {$_.sideindicator -eq "=="}
#In Domain 2 get all the AD groups that start with ACL_
$domain1groups = Get-ADGroup -filter {name -like "ACL_*"} -Server dc01.domain1.com

#Here we go
foreach ($group in $domain1groups)
{ 
    #get the ad members from the acl group 
    $domain1groupmembers = Get-ADGroupMember $group.name -Server dc01.domain1.com 
    foreach ($groupmember in $domain1groupmembers) 
    { 
        #if the member of the group matches someone in the inboth variable
        if ($inboth.inputobject -contains $groupmember.name) 
        { 
        
        $domain2userobject = Get-ADUser -Filter {name -like $groupmember.name} 
        
        # add that domain 1 person to the domain 2 ad group
        Add-ADGroupMember -Identity $group -Members $domain2userobject -server dc01.domain1.com -WhatIf
        } 
        
        }
        
}

So today we had a requirement to start using Outlook Anywhere (Outlook over RPC) on our Exchange 2010 server, the setup is dead easy:

Logon to your CAS server,

Install the server feature “RPC over HTTP Proxy”,

Open the Exchange Management consol and go to Server Configuration and Client Access, Click Enable Outlook Anywhere,

Use your domain (you dont need HTTP/S), choose your authentication and if you need to offload your certificate to another server:

Thats the Exchange bit done.

Next change your DNS:

Locally and externally you need two things; an A record and a SRV record both need to point at Autodicsover.DOMAIN.ORG, here’s two examples from 123 reg:

Finally make sure 443 is allow through your Firewall.

Last but not least test with:

https://testconnectivity.microsoft.com

Ok so now onto the UPN bit, in my case my email differed from my domain i.e. my domain is bohemian.local and my email domain is bohemiangrove.co.uk.

What this means is when logging on via Outlook I get prompted to type domain and password:

If you’d rather not do this then you need to add your email domain as a UPN suffix.

To do this, on a DC open: Active Directory Domains and Trusts

rom the displayed context menu, click Properties.

On the properties box that appears, in the Alternative UPN suffixes field, specify the desired alternate UPN suffix for the domain and click Add.

Apply and ok. Finally open Active Directory Users and Computer

Find a user and under User logon name section, choose the alternate UPN suffix from the drop-down list that was created earlier in Active Directory Domains and Trusts snap–in.

Then test Outlook Anywhere using the users email as the username.