Microsoft Teams - Add Additional Team Owner using Powershell

When a user is added to a Microsoft Team, they are added as either a "member" or an "owner". Adding them as an "owner" gives them additional privileges/rights within the team - such as being able to add other members, delete chat messages etc.

If you add a user to a team using the "add-teamuser" powershell cmdlet, it will by default add them as a member. You can use a switch within the command to add them as an owner instead.

Here's an example;

add-teamuser -groupid "abc123" -user "user@domain.com" -role owner

As you can see, the "-role owner" switch is what adds them as an owner to the team, instead of adding them as a member.

If the "-role" switch isn't specified, the user will be added as a member by default. You can alternatively include the "-role" switch and specify "member" as well - like the example below

add-teamuser -groupid "abc123" -user "user@domain.com" -role member

This could be useful if you're using some kind of loop and want to add some users as members and some as owners and have the owner/member specified in a variable.

Microsoft Teams - teamchanneluser cmdlet is not recognized

Microsoft Teams features some commands (cmdlets) that are not readily available in the public/general release version of the Microsoft Teams powershell module. Some of these commands are;

get-teamchanneluser

add-teamchanneluser

If you attempt to run these commands, you'll get an error message like the one below;

get-teamchanneluser : The term 'get-teamchanneluser' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

At line:1 char:1

To fix the problem you will need to install the preview release of the Microsoft Teams powershell module. You can check the release version numbers from the website below

https://www.powershellgallery.com/packages/MicrosoftTeams/2.0.0

To install the preview release version, make note of the version number then run the command below

Install-Module -Name MicrosoftTeams -AllowPrerelease

To fix the problem you need to force an update of a couple of Powershell modules - namely PowershellGet and PackageManagement. 

Install-Module : A parameter cannot be found that matches parameter name 'AllowPrerelease'.

At line:1 char:37

Run the commands below from an elevanted powershell command prompt;

Install-Module -Name PowerShellGet -Repository PSGallery -Force
Install-Module -Name PackageManagement -Repository PSGallery -Force

Exit/close your Powershell window/session then re-open and run the install-module command again - it should now complete successfully

You can confirm what version is installed by running the commands

import-module "MicrosoftTeams"

get-module

Look for the version number for the "MicrosoftTeams" module

Active Directory User Account Audit including Status with Powershell

Here is a script I have created that searches for all users within an Active Directory domain and provides a report (.csv file) showing all account names and their status. The status is determined from the useraccountcontrol property contained within each account.

The useraccountcontrol property is stored as a number/integer - the most common numbers/values I've translated to their meanings as part of this script - eg. Enabled, Disabled, Password Expired etc.

You only need to change the value for $outfile variable if required - the script should work in it's current form on any windows/active directory domain

$report = @()
$outfile = "C:\temp\UserAudit.csv"

$searcher = New-Object DirectoryServices.DirectorySearcher 
$searcher.filter = "(&(objectCategory=person)(objectClass=user))"

$userlist =  $searcher.FindAll()

foreach ($user in $userlist)
    {
    $name = $($user.properties.displayname)
    $dn = $($user.properties.distinguishedname)
    $status = $($user.properties.useraccountcontrol)
        if ($status -eq "66050"){$status = "Disabled, password never expires"}
        elseif ($status -eq "66048"){$status = "Enabled, password never expires"}
        elseif ($status -eq "512"){$status = "Enabled Account"}
        elseif ($status -eq "514"){$status = "Disabled Account"}
        elseif ($status -eq "66080"){$status = "Enabled, password never expires, user cannot change password"}
    
    $report += new-object psobject -property @{Name=$name;DN=$dn;Status=$status}
    }
    
$report | select Name, Status, DN | export-csv -path $outfile -notype

The script could be further customized to include other values/properties from the account as required. In it's current form it includes the users display name, distinguished name and status.

How to easily view/find the distinguished name for an Active Directory user account

The distinguished name for a user account is often required for scripting or other management/administrative tasks when working with Active Directory. It represents the unique identifier for every user account so is one of the best ways to work with user accounts (as opposed to just working off first name, last name etc).

They are difficult to remember, and nearly impossible to type using the correct format/syntax - so here's some simple instructions on how to quickly/easily obtain the distinguished name for a user account from Active Directory Users & Computers;

1. Open Active Directory Users & Computers
2. Ensure "Advanced Features" are enabled (go to View > Advanced Features)
3. Open the Active Directroy User object you wish to view the DN for
4. Select the Attribute Editor tab
5. Scroll down to the locate the Distinguished Name value
6. You can double click the entry then copy it to the clipboard from the "Value" field as per the screenshot below
   
   

Copy Active Directory User Group Memberships to Another User with Powershell

I have developed the below script to allow you to easily copy Active Directory user group memberships from one user to another. This can be handy if a user is a member of a large number of groups and you don't wish to manually copy them over.

This script is also beneficial in that it doesn't require the Active Directory modules to be installed in powershell for it to work.

In order for the script to work, you will first need to know the distinguished name (DN) for both the source and target user accounts. This can be easily obtained from Active Directory Users & Computers using the steps below;

1. Open Active Directory Users & Computers
2. Ensure "Advanced Features" are enabled (go to View > Advanced Features)
3. Open the Active Directroy User object you wish to view the DN for
4. Select the Attribute Editor tab
5. Scroll down to the locate the Distinguished Name value
6. You can double click the entry then copy it to the clipboard from the "Value" field as per the screenshot below
   
   

Once you have the source and target user distinguished names, replace the values for the $srcuserdn and $dstuserdn variables. Be sure to leave the quotes ("") in place

$srcuserdn = "CN=Mike,CN=Users,DC=morrissey,DC=local"
$dstuserdn = "CN=Peter,CN=Users,DC=morrissey,DC=local"
$dstuserldap = "LDAP://$dstuserdn"

$grouplist = dsquery user $srcuserdn | dsget user -memberof

foreach ($group in $grouplist)
    {
    if ($group)
        {
        $group = $group.substring(1,$group.length-2)
        $ldapcon = "LDAP://$group"
        $ldapgroup = [ADSI] $ldapcon
        $ldapgroup.add($dstuserldap)
        }
    }

Exporting Exchange Distribution Group Members with Powershell

Before making any major changes to distribution groups, I like to take a backup of the current membership lists prior to making any changes. Particularly in cases where membership lists are quite large, it's always better to be safe than sorry for when a user or distribution group owner wants to know who was a member prior to making the change.

Getting the list of members and exporting it to a simple .csv file can be achieved using the Powershell script below.

Note that you should change the first two (2) variables ($DLName and $ExportFilePath) accordingly.

#Script to get/export list of all distribution group members
#Date Created: 24th January, 2013
#Author: Peter Morrissey


#Enable Exchange cmdlets
add-pssnapin *exchange* -erroraction SilentlyContinue

$DLName = "DL_Example_List"
$ExportFilePath = "C:\Export\Export.csv"


$MemberList = get-distributiongroupmember -identity $DLName

ForEach ($Member in $MemberList){write-output "$($member.name)" | out-file -filepath "$exportfilepath" -append -noClobber}

Creating a Graphical User Interface (GUI) with Powershell

One of the first things I wanted to do when I started learning Powershell was to create a simple graphical user interface (GUI) that I could use to automate some of my day to day tasks. One main task in particular that took up a lot of my time was creating new user accounts. The process involved creating an Active Directory account, attaching a new mailbox to the Active directory account, adding the new account to security and distribution groups, and also sending a notification email to the new account requester with all the information in it. Doing this process manually was incredibly time consuming, and I knew there had to be a better way.

By using Powershell, I created a script that prompts with several input boxes and list boxes where I can enter all the required details to create a user account. All these inputs are saved as variables, and can then be used to run a single command to perform all the necessary steps.

Here is a screenshot of one of the input boxes that is presented during the script:

By repeating this prompt for first name, last name, office, department, title, phone number, password etc, I was able to quickly and easily collect all the information I needed to create an Active Directory account using the dsadd command - which also runs as part of the script once all the information has been collected.

Once I had an Active Directory account created, I was then able to create a mailbox and attach it to the Active Directory account using the Enable-Mailbox cmdlet.

And finally, once the Active Directory account and mailbox were created,  I could add the user to any required security/distribution groups, and send all the new account information via email to the requester. (I will cover each these topics in more detail in future blog posts.)

One of the most valuable things you can teach yourself with Powershell is how to create input boxes and list boxes for the collecting of information you require to run a command. Some examples of such commands are creating user accounts (as I just discussed), enabling or disabling ActiveSync on a mailbox, or enabling/disabling email forwarding. The possibilities are endless, though most of mine focus around the Active Directory/Microsoft Exchange technologies.

This Technet Article is what I used to get started on input boxes and highly recommend it as a starting point as the article breaks down each line of code and explains what it does.

Once you learn how to create, modify and use input boxes, you can apply the same lines of code over and over again within all your scripts - invest the time to learn it and it will save you time in the end, and open up enormous possibilities/options for your Powershell scripting.