Exchange Server 2019 实战操作指南

显示计算机、网络图标，在运行窗口输入rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0
桌面壁纸显示ip地址信息https://learn.microsoft.com/zh-cn/sysinternals/downloads/bginfo

Boot Time:        <Boot Time>OS Version:        <OS Version>Host Name:        <Host Name>Logon Domain:        <Logon Domain>Machine Domain:        <Machine Domain>CPU:        <CPU>Memory:        <Memory>IP Address:        <IP Address>DHCP Server:        <DHCP Server>MAC Address:        <MAC Address>Subnet Mask:        <Subnet Mask>DNS Server:        <DNS Server>Default Gateway:        <Default Gateway>Volumes:        <Volumes>

Install-WindowsFeature RSAT-ADDS

Install-WindowsFeature Server-Media-Foundation

#把window2019的安装ios加到到本电脑上的z磁盘Install-WindowsFeature NET-Framework-45-Features, Server-Media-Foundation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation, RSAT-ADDS -Source Z:\sources\sxs

#扩展AD架构\Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareSchema

\Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAD /OrganizationName:"tyun"
#在AD用戶与計算机上，你会发现 Microsoft Exchange Security Groups

\Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAllDomains

send-mailmessage -to administrator@tyun.cn -subject "TEST49" -Body "請注意！SRVEX 磁碟空間目前已剩下不到 78% 的可用空間 " -smtpserver srvex.ianext.com -from administrator@tyun.cn  -Encoding  Unicode

#查看exchange服务Get-Service -Name "MSExch*"
#显示完成的exchange名称Get-Service -Name "MSExch*" | ft -auto

# 直接重啟 Exchange 已经停止的服务Get-Service -Name "MSExchange*" | Where-Object {$_.Status -eq "Stopped"} | Restart-Service

#用户登录Exchange信息Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox, SharedMailbox | Get-MailboxStatistics | Sort-Object Lastlogontime -Descending | Select-Object DisplayName,MailboxTypeDetail,LastLogonTime,ServerName

#查看目前有架构下所有的 Exchange Server 完整主机名称等等信息Get-ExchangeServer | Select FQDN, ServerRole,AdminDisplayVersion,IsEdgeServer


#查看本机所有 Exchange 服务的执行状态Get-Service -Name *Exchange* | Select Status, DisplayName | Sort Status | FT -Auto
#测试主机连接smtp服务是否正常Test-NetConnection srvex.tyun.cn -Port 25 -InformationLevel "Detailed"

#测试连接的所有网络、来源地址、目的地址以及路由信息Test-NetConnection -ComputerName srvex.tyun.cn -DiagnoseRouting -InformationLevel Detailed
#Exchange DNS 查看Get-TransportService | FL *dns*

#把ad用户导入到exchangeGet-User -RecipientTypeDetails User -Filter { UserPrincipalName -ne $Null } | Enable-Mailbox

#查询到的ad用户导出到ADuser.csv文件里Get-ADUser -Filter * -SearchBase "DC=TYUN, DC=CN" |Select-Object -Property SamAccountName, Surname, GivenName, Name, Group, UserPrincipalName, Path, AccountPassword, Enabled, ChangePasswordAtLogon | Export-Csv -Encoding unicode ADuser.csv文件在C:\Users\Administrator下面

#PowerShell 批量导入AD域用户(密码写在脚本上Tyun@2022)import-csv c:\ad\User.csv | Foreach {New-ADUser  -samAccountName $_.SamAccountName  -Surname $_.Surname   -GivenName $_.GivenName  -Name $_.Name  -UserPrincipalName $_.Userprincipalname  -DisplayName $_.DisplayName  -Description $_.Description   -Path $_.Path -AccountPassword(ConvertTo-SecureString "Tyun@2022" -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon 1  -passthru -PasswordNeverExpires ($_.PasswordNeverExpires -eq "1") }
#PowerShell 批量导入AD域用户(密码写在csv里面)import-csv c:\ad\User.csv | Foreach {New-ADUser  -samAccountName $_.SamAccountName  -Surname $_.Surname   -GivenName $_.GivenName  -Name $_.Name  -UserPrincipalName $_.Userprincipalname  -DisplayName $_.DisplayName  -Description $_.Description   -Path $_.Path  -Enabled $true -AccountPassword (ConvertTo-SecureString $_.AccountPassword -AsPlainText -force) -passthru -PasswordNeverExpires ($_.PasswordNeverExpires -eq "1")}


#指定用户查询所有域组名称Get-ADPrincipalGroupMembership hexingxing | ft name
#指定用户查询所有域组名称并以名称排序Get-ADPrincipalGroupMembership hexingxing | sort name | ft name
#Get-ADUser(Get-ADUser -Identity hexingxing -Properties *).MemberOf
用户上次设置密码时间Get-ADUser king -Properties * | ft PasswordLastSet
设置账户king密码永不过期Set-ADAccountControl -Identity king -PasswordNeverExpires:$true
取消账户king密码永不过期Set-ADAccountControl -Identity king -PasswordNeverExpires:$false
设置king的账户过期时间为 2022/10/18 0:00:00，即最后可用使用时间为 2022/10/18Set-ADAccountExpiration -Identity king -DateTime "10/18/2022"

忽略旧密码为账户设置新密码Set-ADAccountPassword -Identity king -NewPassword (ConvertTo-SecureString -AsPlainText "ef7s00#" -Force)
根据提示信息输入旧密码并更新用户密码Set-ADAccountPassword -Identity king
AD 域启用账户Enable-ADAccount -Identity king
AD 域禁用账户Disable-ADAccount -Identity king

导出it组织单元下的所有用户Get-ADUser -Filter * -Properties * -SearchBase "DC=it,DC=tyun,DC=cn" |Select-Object name,SamAccountName,Givenname,surname,Displayname,title,mobile,CanonicalName,Created,Department,DistinguishedName,EmailAddress,homeMDB,mail,mailNickname,MemberOf,msExchCoManagedObjectsBL,msExchHomeServerName,PasswordLastSet,PrimaryGroup,proxyAddresses,UserPrincipalName,whenCreated,whenChanged,MobilePhone,telephoneNumber,employeeNumber,postalCode,company |Export-Csv C:\AllADUser20221001.csv -Encoding UTF8 –NoTypeInformation


ldifde -f "c:\alldbauser.ldf" -d "DC=it,DC=tyun,DC=cn" -r objectClass=user -l "name,SamAccountName,Givenname,surname,Displayname,title,mobile,CanonicalName,Created,Department,DistinguishedName,EmailAddress,homeMDB,mail,mailNickname,MemberOf,msExchCoManagedObjectsBL,msExchHomeServerName,PasswordLastSet,PrimaryGroup,proxyAddresses,UserPrincipalName,whenCreated,whenChanged,MobilePhone,telephoneNumber,employeeNumber,postalCode,company"

#获取AD域服务器密码策略信息Get-ADDefaultDomainPasswordPolicy
ComplexityEnabled：密码必须符合复杂性要求MaxPasswordAge：密码最长使用期限MinPasswordAge：密码最短使用期限MinPasswordLength：最小密码长度PasswordHistoryCount：强制密码历史
密码最长使用期限是 24 天；
Set-ADDefaultDomainPasswordPolicy -Identity tyun.cn -ComplexityEnabled $True -MaxPasswordAge 180.00:00:00

#获取已经过期的用户Get-Aduser -Filter *  -Properties * | where {$_.PasswordExpired -eq $true} | FT Name

#获取所有标识密码过期时间的用户Get-ADUser -Filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties * | Select-Object -Property "Name", @{n="ExpiryDate";e={$_.PasswordLastSet.AddDays((Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days)}} | Sort-Object ExpiryDate 


#获取指定标识密码过期时间的用户Get-ADUser -Filter {name -like "king"} -Properties * | Select-Object -Property "Name", @{n="ExpiryDate";e={$_.PasswordLastSet.AddDays((Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days)}} | Sort-Object ExpiryDate
#获取所有用户密码属性信息Get-ADUser -Filter * -Properties * | Sort-Object Name | ft Name,PasswordLastSet,PasswordExpired,PasswordNeverExpires

#删除单个用户Remove-ADUser -Identity king -Confirm:$false
#SAM 账户名删除属于子项/子集/子树的用户对象Get-ADUser -Identity king | foreach{Remove-ADObject -Identity $_.ObjectGUID -Recursive -Confirm:$False}
#搜索并删除指定组织单位（OU）容器内的用户对象Get-ADUser -Filter * -SearchBase "OU=cnList,OU=testGroup,DC=tyun,DC=cn" | foreach{Remove-ADObject -Identity $_.ObjectGUID -Recursive -Confirm:$False}
#删除子项（子树）需要使用如下删除域对象Remove-ADObject -Identity king -Recursive

导入 CSV 数据列表删除用户对象import-csv .\del.csv | foreach{Get-ADUser -Identity $_.name} | foreach{Remove-ADObject -Identity $_.ObjectGUID -Recursive -Confirm:$False}
Get-ADUser king

可以参考https://hexingxing.cn/tag/active-directory/page/2/

https://github.com/phillips321/adaudit/blob/master/AdAudit.ps1

#查询域控PDC服务器netdom query fsmo
#配置PDC使用ntp服务器同步时间w32tm /config /manualpeerlist:"server0.cn.pool.ntp.org,0x8 server1.cn.pool.ntp.org,0x8 time.windows.com,0x8" /syncfromflags:manual /reliable:yes /update
#查看当前Windows Time运行情况w32tm /query /status
#查看当前ntp时间服务器设置w32tm /query /peers
#查看PDC服务器ntp同步状态，和ntp服务器时间差w32tm /stripchart /computer:time.windows.com /samples:100 /dataonly

#AD 域客户端同步域服务器时间net time  \\192.168.232.10  /set  /y

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\  /v  SpecialPollInterval  /t REG_DWORD /d 1200 /freg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters /v  NtpServer   /d ntp1.aliyun.com /f net stop w32timenet start w32time

.\AutoSysprep.ps1 -help
重新初始化服务器的SID并重启服务器.\AutoSysprep.ps1 -ReserveHostname -ReserveNetwork -SkipRearm -PostAction "reboot"

New-ADFineGrainedPasswordPolicy -Name "PasswordSetting3" -Precedence 1 -ComplexityEnabled $true -Description "The Domain Users Password Policy" -DisplayName "PasswordSetting3" -LockoutDuration "0.00:30:00" -LockoutObservationWindow "0.00:30:00" -LockoutThreshold "5" -MaxPasswordAge "24.00:00:00" -MinPasswordAge "1.00:00:10" -MinPasswordLength "7" -PasswordHistoryCount "24"

优先级：1（最高）强制最短密码长度：7（个字符）强制密码历史记录：24（个历史密码）密码复杂性要求：启用强制密码最短期限：1（天）强制密码最长期限：24（天）强制账号锁定策略：30（分钟）内5次（登录失败）锁定30（分钟）

#安装远程工具管理包Install-WindowsFeature RSAT-ADDS
#安装 Server Media Foundation 窗口功能Install-WindowsFeature Server-Media-Foundation
# Exchange 安装程序安装所需的 Windows 组件Install-WindowsFeature NET-Framework-45-Features, Server-Media-Foundation, RPC-over-HTTP-proxy, RSAT-Clustering, RSAT-Clustering-CmdInterface, RSAT-Clustering-Mgmt, RSAT-Clustering-PowerShell, WAS-Process-Model, Web-Asp-Net45, Web-Basic-Auth, Web-Client-Auth, Web-Digest-Auth, Web-Dir-Browsing, Web-Dyn-Compression, Web-Http-Errors, Web-Http-Logging, Web-Http-Redirect, Web-Http-Tracing, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Lgcy-Mgmt-Console, Web-Metabase, Web-Mgmt-Console, Web-Mgmt-Service, Web-Net-Ext45, Web-Request-Monitor, Web-Server, Web-Stat-Compression, Web-Static-Content, Web-Windows-Auth, Web-WMI, Windows-Identity-Foundation, RSAT-ADDS -Source G:\sources\sxs
#重启下服务器后安装下面的命令操作
先加载window server 2019镜像，打开powershell窗口进入g:\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareSchema

\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAD /OrganizationName:"tyun"

\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareAllDomains

\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /PrepareSchema

#将许可证Exchange SRV2019-MBX 的服务器Set-ExchangeServer SRV2019-MBX -ProductKey YCQY7-BNTF6-R337H-69FGX-P39TY
#重新启动 Microsoft Exchange信息存储服务Restart-Service MSExchangeIS
#验证证书属性Get-ExchangeServer SRV2019-MBX | Format-List Name,Edition,*Trial*
Get-ExchangeServer | Format-Table -Auto Name,Edition,*Trial*

各版本的秘钥信息Enterprise: YCQY7-BNTF6-R337H-69FGX-P39TY
Standard: G3FMN-FGW6B-MQ9VW-YVFV8-292KP

.*autodiscover\.json.*\@.*Powershell.*

条件输入{REQUEST_URI}

add-pssnapin microsoft.exchange*
查询EXCHANGE服务器数据库和日志文件路径Get-MailboxDatabase -Server SRV2019-MBX| Select Name,EdbFilePath,LogFolderPath | fl
#查看Exchange Server版本号Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

Install-WindowsFeature Web-Client-Auth

%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/owa/" -section:system.webserver/security/access /sslFlags:"Ssl, SslRequireCert" /commit:apphost
%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/ecp/" -section:system.webserver/security/access /sslFlags:"Ssl, SslRequireCert" /commit:apphost
%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/Microsoft-Server-ActiveSync/" -section:system.webserver/security/access /sslFlags:"Ssl, SslRequireCert" /commit:apphost

颁发自签证书New-ExchangeCertificate -FriendlyName "Contoso Exchange Certificate" -SubjectName CN=srv2019-mbx -DomainName mail.tyun.cn,autodiscover.tyun.cn,srv2019-mbx.tyun.cn -Services SMTP,IIS -PrivateKeyExportable $true
New-ExchangeCertificate -FriendlyName "Contoso Exchange Certificate2019" -SubjectName CN=mail -DomainName mail.tyun.cn,autodiscover.tyun.cn,srv2019-mbx.tyun.cn -Services SMTP,IIS -PrivateKeyExportable $true
查询证书信息Get-ExchangeCertificate | where {$_.Status -eq "Valid" -and $_.IsSelfSigned -eq $true} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter
续自签证书Get-ExchangeCertificate -Thumbprint BC37CBE2E59566BFF7D01FEAC9B6517841475F2D | New-ExchangeCertificate -Force -PrivateKeyExportable $true


颁发机构续订
#如果需要将证书续订请求文件 的内容 发送到 CA，请使用以下语法创建 Base64 编码的请求文件$txtrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest [-KeySize <1024 | 2048 | 4096>] [-Server <ServerIdentity>][System.IO.File]::WriteAllBytes('<FilePathOrUNCPath>\<FileName>.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))
#如果需要将 证书续订请求文件 发送到 CA，请使用以下语法创建 DER 编码的请求文件$binrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest -BinaryEncoded [-KeySize <1024 | 2048 | 4096>] [-Server <ServerIdentity>][System.IO.File]::WriteAllBytes('<FilePathOrUNCPath>\<FileName>.pfx', $binrequest.FileData)
#若要找到您想续订的证书的指纹值，请运行以下命令：Get-ExchangeCertificate | where {$_.Status -eq "Valid" -and $_.IsSelfSigned -eq $false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint,NotBefore,NotAfter
#此示例为具有指纹值 5DB9879E38E36BCB60B761E29794392B23D1C054的现有证书创建 Base64 编码的证书续订请求：$txtrequest = Get-ExchangeCertificate -Thumbprint 5DB9879E38E36BCB60B761E29794392B23D1C054 | New-ExchangeCertificate -GenerateRequest[System.IO.File]::WriteAllBytes('\\FileServer01\Data\ContosoCertRenewal.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))
#此示例为同一证书创建 DER (二进制) 编码的证书续订请求：$binrequest = Get-ExchangeCertificate -Thumbprint <Thumbprint> | New-ExchangeCertificate -GenerateRequest -BinaryEncoded[System.IO.File]::WriteAllBytes('\\FileServer01\Data\ContosoCertRenewal.pfx', $binrequest.FileData)
#在用于存储证书请求的服务器上的 Exchange 命令行管理程序 中，运行以下命令：Get-ExchangeCertificate | where {$_.Status -eq "PendingRequest" -and $_.IsSelfSigned -eq $false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint

$txtrequest = New-ExchangeCertificate -PrivateKeyExportable $True -GenerateRequest -FriendlyName "Mail.tyun.cn Cert" -SubjectName "CN=mail.tyun.cn"[System.IO.File]::WriteAllBytes('\\SRV2019-MBX\Data\Mail.tyun.cn Cert.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))

#查看exchange2019存储证书信息Get-ExchangeCertificate | where {$_.Status -eq "PendingRequest" -and $_.IsSelfSigned -eq $false} | Format-List FriendlyName,Subject,CertificateDomains,Thumbprint

Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('\\SRV2019-MBX\Data\certnew.cer'))