Schedule Task to run Exchange PowerShell Comman

Schedule Task to run Exchange PowerShell Command

Sometimes we may need to frequently run Exchange commands to export data or run Script to force changes , please flow below Steps for creating new Task in Exchange 2010

1. From Start Menu type Task Scheduler  in the search Window
2. In the Task scheduler window right click Create Task
3.  In the new Task window type Name of your Task (e.g.  Start EX Service)

4.     Go to Trigger Tab  and select New and chose your schedule

5.    Go to action Tab and select new then in Action tab select start a program

           A.      In the (Program/script) tab type : (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)

 B.       Then go to Add arguments Tab and type (-command ". 'C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; "Start-Service MSExchangeRPC"" ) 

6.   In the Actions Tab click new  to configure the task to send you mail whenever it start

7.   In the Action drop-down list chose Send an e-mail

8.  Type email address (From and TO) and type IP or Name of your SMTP Server

9.   Press OK Twice to finish

10. You can test the Task by stopping the service then go to task and right click à Run  

Account lockout

User Account keeps locked out
There are many reasons that make domain users locked out and we can list some of those reasons and how can we resolve it
A. Cashed password used by any application or saved manually by user
The above scenario may be case an account to be locked out after changing user password because the application try to use and authenticate using the old password to resolve this issue please follow the below steps to remove all saved passwords
1. Point start and open run
2. In the open filed type (rundll32.exe keymgr.dll, KRShowKeyMgr) and press enter
3. A new GUI named stored user Names and passwords will appear
4. You can use this interface to remove or edit all cashed passwords (remove all of them because this kind of cashed passwords not recommended it may be used against you if anyone have a physical access to this machine
5. After that rest the user password and use the new one

B. Kind of dictionary attack may cause the user account to be locked out
To determine which machine is the root cause of this kind of dictionary attack you need to enable debug logging for Net Logon Service that will help
1. Open run type CMD and press enter
2. In the command line window type nltest /dbflag:0x20000004 and press enter to enable the logging debug http://support.microsoft.com/default.aspx?scid=kb;en-us;109626

3. Rested the net logon service after that you will find netlogon.log under %systemdrive%\debug
4. Open that log file and observe the information available in that log file
5. Please refer to that table that describe every code number http://technet.microsoft.com/en-us/library/cc776964(WS.10).aspx


0x0 Successful login
0xC0000064 The specified user does not exist
0xC000006A The value provided as the current password is not correct
0xC000006C Password policy not met
0xC000006D The attempted logon is invalid due to a bad user name
0xC000006E User account restriction has prevented successful login
0xC000006F The user account has time restrictions and may not be logged onto at this time
0xC0000070 The user is restricted and may not log on from the source workstation
0xC0000071 The user account's password has expired
0xC0000072 The user account is currently disabled
0xC000009A Insufficient system resources
0xC0000193 The user's account has expired
0xC0000224 User must change his password before he logs on the first time
0xC0000234 The user account has been automatically locked

6. The last code 0xC0000234 will lead you to the source of that attack
7. After that please scan this machine with update AV to clean that kind of attacks
8. You can disable the logging debug by typing ( nltest /dbflag:0x0) on the command line and then restart the net logon service

At the end you can find a very useful toll provided by Microsoft used to troubleshoot account lockouts
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en