JustinGrote

<#
.SYNOPSIS
	Retrieves the members of several Microsoft Graph groups via batch processing.
.EXAMPLE
	Get-GraphGroupMember -Id '00000000-0000-0000-0000-000000000000'
.EXAMPLE
	Get-MgGroup -All | Get-GraphGroupMember
.EXAMPLE
  Invoke-MgGraphRequest -Uri 'v1.0/groups' |% Value |% Get-GraphGroupMember

JustinGrote

function Get-MgUserExchangeAttributes {
	param(
		[Parameter(Mandatory)]
		[Guid]$UserId
	)

	$attributes = (1..5).ForEach{"extension_79c86e5137c54776975dce9deb389ed4_extensionAttribute$_"}
	$result = Get-MgUser -UserId $UserId -Property $attributes -ErrorAction Stop
	return [PSCustomObject]@{
		UserId = $UserId

JustinGrote

#This exploits the fact that you can have up to 500 filter parameters to a get-distributiongroup query (but I do 450 here to be conservative)
#This is much faster than trying to do it via runspaces.
function Get-DistributionGroupBatch {
	param(
		[string[]]$Name,
		[int]$BatchSize = 450
	)

	for ($i, $i -lt $Name.Count; $i += $BatchSize) {
		$batch = $Name[$i..([Math]::Min($i + $BatchSize - 1, $Name.Count - 1))]

JustinGrote

#This is an example of doing exchange operations in parallel in runspaces.
#When Exchange PowerShell Module Connects, it saves token info in a global .NET object and then asks an API to generate a PowerShell
#Module when it downloads. That PowerShell module has the path for the key built-in, so all you have to do
#Is load the specified module into each runspace.

#requires -version 7.2
$ErrorActionPreference = 'stop'
$command = @(
	'Get-ExoMailbox'
	'Get-ExoMailboxFolderStatistics'

JustinGrote

<#[
.SYNOPSIS
	Parses Exchange log files and returns records in descending date order.

.DESCRIPTION
	Exchange logs store their column names in a '#Fields:' comment line. This
	script reads that header, parses every data row, and sorts all records from
	newest to oldest using the 'date-time' column.

.PARAMETER Path

JustinGrote

using namespace System.Management.Automation
using namespace System.Collections.Generic
using namespace System.Collections.Concurrent

$baseUri = 'https://www.powershellgallery.com/api/v2/Packages?$orderby=Published desc&$skip='
$maxPackages = 700000
$interval = 100
$statusDictionary = [ConcurrentDictionary[string, bool]]::new()

$existingpackagesjson = (iwr 'https://pwsh.gallery/sleet.packageindex.json').content -replace 'PSObject','__MODULEFASTIGNOREME' | convertfrom-json |% packages

JustinGrote

using namespace System.Diagnostics.Eventing.Reader

[CmdletBinding(DefaultParameterSetName = 'ByCount')]
param(
	#A list of domain controllers to query. Leave blank if running directly on a domain controller.
	[string[]]$ComputerName,

	#Maximum amount of events to retrieve. This is set to 1000 for a quick initial fetch. Note this is max events *investigated* and not max events returned.
	[Parameter(ParameterSetName = 'ByCount')]
	[int]$MaxEvents = 1000,

JustinGrote

[CmdletBinding(DefaultParameterSetName = 'ByCount')]
param(
	#A list of domain controllers to query. Leave blank if running directly on a domain controller.
	[string[]]$ComputerName,

	#Maximum amount of events to retrieve. This is set to 1000 for a quick initial fetch. Note this is max events *investigated* and not max events returned.
	[Parameter(ParameterSetName = 'ByCount')]
	[int]$MaxEvents = 1000,

	#How long back to search for events. Overrides MaxEvents if specified.

JustinGrote

param(
	[Parameter(Mandatory = $true)]
	[string[]]$ExchangeServers,

	[Parameter(Mandatory = $true)]
	[PSCredential]$Credential,

	[Parameter(Mandatory = $false)]
	[datetime]$StartTime = (Get-Date).AddDays(-1),

JustinGrote

// The complete data we need gets split over multiple logs, so we have to recombine them. Export to CSV afterwards.

AuditLogs
| where OperationName == "Update policy"
| where isnotempty(CorrelationId) and isnotempty(AdditionalDetails)
| project TimeGenerated, CorrelationId, Identity, AdditionalDetails
| mv-apply d = AdditionalDetails on (
    summarize
        seq = tolong(take_anyif(tostring(d.value), tostring(coalesce(d.key, d.name)) == "seq")),
        b   = take_anyif(tostring(d.value), tostring(coalesce(d.key, d.name)) == "b")