Skip to content

Exchange SE - Management Shell snippets

Check OAuth

Documentation by Microsoft

Is certificate configured?
1
Get-AuthConfig | Format-List CurrentcertificateThumbPrint
Yes -> get certificate
1
Get-ExchangeCertificate
No - generate new certificate
1
New-ExchangeCertificate -KeySize 2048 -SubjectName "cn=Microsoft Exchange Auth Certificate for Me" -FriendlyName "Microsoft Exchange Server Auth Certificate for Me" -PrivateKeyExportable $true -Services SMTP -DomainName <yourdomain>
No - already generated, configure it for OAuth
1
2
# Replace <ThumbprintFromStep4A> with the Thumbprint value obtained from the 'Get-ExchangeCertificate' command above
Set-AuthConfig -NewCertificateThumbprint <ThumbprintFromGetExchangeCertificate> -NewCertificateEffectiveDate $(get-date)
Publish certificate
1
Set-AuthConfig -PublishCertificate
Map certificates to services
1
2
# Replace <Thumbprint> with your certificate's actual thumbprint
Enable-ExchangeCertificate -Thumbprint <Thumbprint> -Services POP,IMAP,IIS,SMTP

Health state

Query state
1
Get-ServerHealth myexchange.mydomain | ?{$_.HealthSetName -eq "OWA.Proxy"}
Query component state
1
(Get-ServerComponentState -Identity myexchange.mydomain -Component OwaProxy).LocalStates
Enable/Disable component
1
Set-ServerComponentState myexchange.mydomain -Component OwaProxy -State Active -Requester HealthApi

Take care of Requester

List all unhealthy components
1
Get-ServerHealth myexchange.mydomain | ? { $_.AlertValue -eq "UnHealthy" }

Mailbox rules

Create new rule
1
New-InboxRule "Category HR" -HeaderContainsWords "X-CUSTOM-FW-RULE: DENY RULE HR" -ApplyCategory "HR" -Mailbox myuser

Query mailbox state & repair mailbox

Documentation by New-MailboxRepairRequest

Documentation by Get-MailboxRepairRequest

Check only
1
New-MailboxRepairRequest -Mailbox myuser -CorruptionType ProvisionedFolder,SearchFolder,FolderView,AggregateCounts -DetectOnly
Repair mailbox
1
New-MailboxRepairRequest -Mailbox myuser -CorruptionType ProvisionedFolder,SearchFolder,FolderView,AggregateCounts
Get state of repair request for mailbox
1
Get-MailboxRepairRequest -Mailbox myuser
Get state of repair request for full database
1
Get-MailboxRepairRequest -Database MailboxDatabase01
Show only errors
1
Get-MailboxRepairRequest -Database MailboxDatabase01 | Format-list Tasks,Corruption*

Move mailbox

Move mailbox to new database
1
2
# Optional -BadItemLimits (number of bad objects, which are accepted)
New-MoveRequest -Identity 'myuser@mydomain' -TargetDatabase "NEWDB"
State of move request
1
Get-MoveRequest -ResultSize Unlimited | Get-MoveRequestStatistics
Delete finished mailbox move requests
1
Get-MoveRequest | where {$_.status -eq "Completed"} | Remove-MoveRequest

Managed Folder Assistant

Managed folder assistant can be used to start archiving of mailbox.

1
Start-ManagedFolderAssistant -Identity myuser

Renew certificates

On the Exchange Console (launchems), create a CSR (e.g., read the thumbprint of the certificate to be renewed with the healthchecker.ps script):

1
2
$txtrequest = Get-ExchangeCertificate -Thumbprint 3EB742B253689947017397C250BB31D65DB748F1 | New-ExchangeCertificate -GenerateRequest 
[System.IO.File]::WriteAllBytes('c:\custom\exch.req', [System.Text.Encoding]::Unicode.GetBytes($txtrequest))

Copy the file exch.req you just created to the domain controller and, as Administrator, execute the following on the DC

1
certreq -attrib "CertificateTemplate:WebServer"

In the user interface, select the previously copied file, the CA, and the storage location

The newly signed certificate must be copied to the Exchange server and imported (launchems)

1
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes('c:\custom\exch-2024.cer'))

Afterwards, assign the corresponding certificate in the EAC.

Queue-Viewer

Exchange management tools must be installed to get an user interface for Exchange queues. The tools can be installed at Exchange servers or clients.

You can launch the Exchange Queue Viewer from the Run dialog (Win + R) or Command Prompt with:

1
%ProgramFiles%\Microsoft\Exchange Server\V15\Bin\Exchange Queue Viewer.msc

Or, from PowerShell, use:

1
Start-Process "$env:ProgramFiles\Microsoft\Exchange Server\V15\Bin\Exchange Queue Viewer.msc"