105
$msg.Body = wrap_body -body_text $message_body
$reciever = $who_made_reset.ToLower().Replace('ru1000\', '')
$reciever_mail = Get-ADUser $reciever -Properties mail |
Select-Object -ExpandProperty mail
if ($reciever_mail) {
$msg.To.Add($reciever_mail)
} else {
$msg.To.Add('900@leroymerlin.ru')
}
$smtp.Send($msg)
$msg.Dispose()
$message = "Password reset for account '$sam_account_name' is
forbidden"
form_log_msg $sam_account_name $who_made_reset $message
$incident_num >> $log_file
exit
}
}
catch
{
$msg.subject = "Ошибка при сбросе пароля учетной записи в AD
сотрудника Леруа Мерлен (инцидент $incident_num)"
$message_body = "Учетная запись <b>$sam_account_name</b> не
найдена!"
$msg.Body = wrap_body -body_text $message_body
$reciever = $who_made_reset.ToLower().Replace('ru1000\', '')
$reciever_mail = Get-ADUser $reciever -Properties mail | Select-
Object -ExpandProperty mail
if ($reciever_mail) {
$msg.To.Add($reciever_mail)
} else {
$msg.To.Add('900@leroymerlin.ru')
}
$smtp.Send($msg)
$msg.Dispose()
$message = "Account '$sam_account_name' was not found"
form_log_msg $sam_account_name $who_made_reset $message
$incident_num >> $log_file
throw "No '$sam_account_name' user found."
}
if (-not $user.Enabled)
{
$msg.subject = "Ошибка при сбросе пароля учетной записи в AD
сотрудника Леруа Мерлен (инцидент $incident_num)"
$message_body = "Учетная запись <b>$($user.Name)</b> выключена!
Пароль не был сброшен!"
$msg.Body = wrap_body -body_text $message_body
$reciever = $who_made_reset.ToLower().Replace('ru1000\', '')
$reciever_mail = Get-ADUser $reciever -Properties mail | Select-
Object -ExpandProperty mail
106
if ($reciever_mail) {
$msg.To.Add($reciever_mail)
} else {
$msg.To.Add('900@leroymerlin.ru')
}
$smtp.Send($msg)
$msg.Dispose()
$message = "Account '$sam_account_name' is disabled. Password was
not reset"
form_log_msg $sam_account_name $who_made_reset $message
$incident_num >> $log_file
throw "User '$($user.Name)' is disabled!"
}
Unlock-ADAccount $user
$plain_pass = random-password
$new_password = ConvertTo-SecureString $plain_pass -AsPlainText -Force
Set-ADAccountPassword -Identity $user -NewPassword $new_password -
Server $dc -Reset -ErrorAction Stop
$msg.subject = "Сброшен пароль по вашему запросу"
$msg.To.Add($manager_email)
$message_body = @"
Уважаемый коллега, ваш сотрудник <b>$($user.Name),
$($user.SamAccountName)</b> запросил смену пароля. В рамках запроса
$incident_num.
<br />
<br />
Новый пароль: <b>$plain_pass</b>
<br />
<br />
Для смены пароля на другой необходимо перейти по ссылке <a
href='http://intraru2/pages/passwordchange.aspx'>смена пароля</a>
<br />
<br />
Новый пароль будет установлен для корпоративных систем: <b>Intraru,
Pyxis, Navision, BackStore(не для СПОК), HR Maps</b>
<br /><br />
<b>Служба поддержки пользователей</b>
<br />
<b>ООО «Леруа Мерлен Восток»</b>
$msg.Body = wrap_body -body_text $message_body
$path = "C:\scripts\orchestrator\images\mail_reset"
$files= Get-ChildItem $path
Foreach($file in $files)
{
$attachment = New-Object System.Net.Mail.Attachment –ArgumentList
"$path\$($file.ToString())"
$attachment.ContentDisposition.Inline = $True
$attachment.ContentDisposition.DispositionType = "Inline"
$attachment.ContentType.MediaType = "image/jpg"
107
$attachment.ContentId = $file.ToString()
$msg.Attachments.Add($attachment)
}
$smtp.Credentials = $creds
$smtp.Send($msg)
$attachment.Dispose();
$msg.Dispose();
$message = "Password for account '$sam_account_name' was reset and sent
to $manager_email"
# form_log_msg $sam_account_name $who_made_reset $message $incident_num
>> $log_file
$script_name = $MyInvocation.MyCommand.Name
$log_props = @{
'actor_full_login' = $who_made_reset;
'message' = $message;
'script_name' = $script_name;
'incident_num' = $incident_num
}
log @log_props
Листинг сценария создания общего почтового ящика
param (
[Parameter(Mandatory=$true)]
[string]$mb_name,
[Parameter(Mandatory=$true)]
[string]$responsible,
[Parameter(Mandatory=$true)]
[string]$mb_description,
[Parameter(Mandatory=$false)]
[string]$raw_members,
[Parameter(Mandatory=$true)]
[string]$actor,
[Parameter(Mandatory=$true)]
[string]$incident_num
)
# Set-StrictMode -Version Latest
$modules = @(
"$($PSScriptRoot)\utils\logging.ps1",
"$($PSScriptRoot)\utils\mailing.ps1",
"$($PSScriptRoot)\utils\exchange.ps1"
)
foreach ($module in $modules) {
Import-Module -Name $module
}
108
$get_adcomp_props = @{
SearchBase = 'OU=EXMAILDAG,OU=Exchange,OU=Servers,OU=HQ (Shabolovka
31A),' +
'OU=Leroy Merlin
Vostok,DC=hq,DC=ru,DC=corp,DC=leroymerlin,DC=com'
Filter = 'name -notlike "*dag"'
}
$exchange_servers = Get-ADComputer @get_adcomp_props
$exchange_server = Get-Random -InputObject $exchange_servers
$exchange_uri = "http://$($exchange_server.DNSHostName)/PowerShell"
$configuration_name = 'Microsoft.Exchange'
$connection_name = $exchange_server
$pssession_props = @{
ConnectionUri = $exchange_uri;
ErrorAction = 'SilentlyContinue';
}
$existing_session = Get-PSSession @pssession_props
if (-not $existing_session) {
$pssession_props = @{
ConfigurationName = $configuration_name;
ConnectionUri = $exchange_uri;
Name = $connection_name;
}
$session = New-PSSession @pssession_props
$pssession_props = @{
Session = $session;
WarningAction = 'SilentlyContinue';
ErrorAction = 'SilentlyContinue';
}
Import-PSSession @pssession_props | Out-Null
}
$dc = (Get-ADForest).SchemaMaster
$access_group_ou = 'OU=Shared Mailboxes,OU=Exchange,OU=\#Services,' +
'OU=Leroy Merlin Vostok,DC=hq,DC=ru,DC=corp,DC=leroymerlin,DC=com'
$mb_ou = 'OU=Shared Mailboxes,OU=Exchange,OU=\#Services,' +
'OU=Leroy Merlin Vostok,DC=hq,DC=ru,DC=corp,DC=leroymerlin,DC=com'
$description = "$mb_name@ - Full access"
if ($send_as) {
$description += " + Send As"
}
$description += " / $mb_description / ответственный: $responsible"
$access_group_name = "LM-EX-Mailbox-$mb_name-Full"
try {
$get_adgroup_props = @{
Identity = $access_group_name;
109
ErrorAction = 'Stop';
}
Get-ADGroup @get_adgroup_props | Out-Null
} catch {
$new_adgroup_props = @{
Name = $access_group_name;
GroupScope = 'Universal';
Description = $description;
DisplayName = $access_group_name;
GroupCategory = 'Security';
Path = $access_group_ou;
SamAccountName = $access_group_name;
Server = $dc;
Confirm = $false;
}
New-ADGroup @new_adgroup_props | Out-Null
}
try {
$get_mailbox_props = @{
Identity = $mb_name;
ErrorAction = 'Stop';
}
$mb_found = Get-Mailbox @get_mailbox_props | Out-Null
if (-not $mb_found) {
throw
}
} catch {
$new_mailbox_props = @{
Shared = $true;
Name = $mb_name;
DisplayName = $mb_name;
Alias = $mb_name;
OrganizationalUnit = $mb_ou;
DomainController = $dc;
}
New-Mailbox @new_mailbox_props | Out-Null
}
$mb_permission_props = @{
Identity = $mb_name;
User = $access_group_name;
AccessRights = 'FullAccess';
InheritanceType = 'All';
DomainController = $dc;
}
Add-MailboxPermission @mb_permission_props | Out-Null
$sendas_props = @{
Identity = $mb_name;
User = $access_group_name;
ExtendedRights = 'Send-As';
110
DomainController = $dc;
}
Add-ADPermission @sendas_props | Out-Null
if ($raw_members) {
$members = $raw_members.Split(',') | ForEach-Object {$_.Trim()}
$add_adgrp_mbr_props = @{
Identity = $access_group_name;
Members = $members;
Server = $dc;
Confirm = $false;
}
Add-ADGroupMember @add_adgrp_mbr_props | Out-Null
}
$upn = $mb_name + '@leroymerlin.ru'
$upn_settings = @{
Identity = $mb_name;
UserPrincipalName = $upn;
DomainController = $dc;
}
Set-Mailbox @upn_settings | Out-Null
$descript = @{
Identity = $mb_name;
Description = $mb_description;
DomainController = $dc;
}
Set-ADuser @descript | Out-Null
foreach ($module in $modules) {
Get-Module -ListAvailable $module | Remove-Module
}
# tech block
# log
$message = "New shared mailbox '$mb_name' created. " +
"Granted access to $raw_members"
$log_props = @{
'actor_full_login' = $actor;
'message' = $message;
'script_name' = $MyInvocation.MyCommand.Name;
'incident_num' = $incident_num;
}
log @log_props
# mail
$message_subject = @"
111
Создание общего почтового ящика $mb_name (инцидент $incident_num)
"@
$message_body = @"
Общий почтовый ящик '$mb_name' создан. Учетным записям $raw_members
предоставлен полный доступ с правом на отправку от имени этого
почтового ящика.
"@
$actor_login = $actor.ToLower().Replace('ru1000\', '')
$actor_email = (Get-ADUser -Identity $actor_login -Properties
mail).mail
if ($actor_email) {
$recipients = @(
$actor_email;
)
} else {
$recipients = @(
'900@leroymerlin.ru';
)
}
$body = wrap_body $message_body
$prop_items = @{
'To' = $recipients;
'Subject' = $message_subject;
'body' = $body;
}
$props = props @prop_items
Send-MailMessage @props