Office365 Powershell One-Liner: Find Emails Stuck in Users’ Outboxes

I wrote this quick and dirty one-liner to help monitor and find stuck emails in Exchange / Office365 mailboxes across a tenant and export the list as a CSV.

Get-Mailbox -ResultSize Unlimited | Get-MailboxFolderStatistics | Where-Object {$_.Name -eq "Outbox" -and $_.ItemsInFolder -gt '0' } | Select-Object Identity, FolderType, ItemsinFolder, FolderSize | Export-CSV "C:\CSVs\Outbox.csv"

Using ProcessExplorer Integration with VirusTotal

1. Download Process Explorer from its homepage here: Process Explorer

2. Extract the ZIP file contents to a folder of your choosing. If you don’t have a 3rd party Zip program (I recommend 7-Zip!) you can use Windows’ built-in one: right click the Zip file and select “Extract all…”

3. Double-click the file procexp.exe

4. Enable “Check VirusTotal.com”

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-enable-vt.png

The new column VirusTotal will be added automatically, and initially show “Hash submitted…”. After a few seconds it will show the results

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-vt-standard.png

5. Processes that are running as System and not as a standard user won’t show a VirusTotal result until Process Explorer is restarted with elevated permissions

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-admin-launch.png

You may see a UAC prompt here… click Yes. After a few seconds, we will see the VirusTotal result for every process:

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-admin.png

A VirusTotal result of 0/55 means that 55 anti-virus products have checked the file and that non of them have detected anything awry!

Click the result/link to open the detailed report in a web browser. There you’ll find when the scan was done and other useful information like what anti-virus products detected anything and what type of possible infection/malware.

Example of a VirusTotal detection:

Process Explorer + VirusTotal (to check all processes with 50+ AV's)

   Note If only one AV detected something chances are that it’s a “false positive” (wrongly detected) and that the file is clean. Click the VirusTotal link to get more details about it. 6. If you have processes that show “Unknown” in the VirusTotal column, it means that specific file and version has never been uploaded to VirusTotal. To automatically upload these files to VirusTotal select this option:

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-submit-unknown.png

7. To submit a file to VirusTotal manually, any file (not only “Unknown” ones), which means to upload and re-scan the file, double click a process, go to the Image tab and click the button below named “Submit”

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-submit-one.png

You can then exit the Properties window and wait until you see a result in the VirusTotal column for that process. It’ll take a few minutes.
8. You can also do a VirusTotal check for all the DLL files a process uses. Select a process and press Ctrl+L to toggle the lower pane. It will submit the file hashes to VirusTotal and show the result after a few seconds:

Process Explorer + VirusTotal (to check all processes with 50+ AV's)-pe-lower-pane.png

If you find more than one suspicious process and want to terminate them, it’s recommended by Mark Russinovich, the father of Process Explorer, to first suspend (via right click menu) them. As the vast majority of malware infections include multiple processes that can easily restart each other when a single one is killed, suspending first is a much safer way.

WordPress Error: There has been a critical error on your website. Please check your site admin email inbox for instructions. Learn more about debugging in WordPress.

There has been a critical error on your website. Please check your site admin email inbox for instructions. Learn more about debugging in WordPress.

I encountered this error recently and while WordPress was operational, I could not access the admin dashboard.

The resolution for me was to access my CPanel / file manager for my WordPress back end and rename the WP-Content/Plugins folder to PluginsOLD, which effectively disabled all plugins. After this, I was able to access the admin dashboard and then one by one move the plugins back into a new Plugins folder until one broke the dashboard again… and there you have your problematic plugin!

Managing Alerts for Non-Certified Dell Drives in OpenManage

The pricing for Dell physical drives, especially in servers is often outrageously expensive. Of course, they come with Dell ProSupport so often the price is worth it. Sometimes though, you’ll need to buy and use drives that are not from Dell. If you do this, OpenManage will throw alerts about being non-certified, which will throw off monitoring. Here is the fix:

Open stsvc.ini located in either C:\Program Files\Dell\SysMgt\sm or C:\Program Files (x86)\Dell\SysMgt\sm depending on whether you have the 32-bit/64-bit version. Next, look for the section near the top that reads

; nonDellCertified flag for blocking all non-dell certified alerts.
NonDellCertifiedFlag=yes

Change NonDellCertifiedFlag=yes to NonDellCertifiedFlag=no and save the file. Lastly, restart the Dell OpenManage service, called DSM SA Data Manager, in your Services Manager. Voila!

The limit for logging reached while waiting for system resources. Try again. MAPI 1.0 [000004C2]

Ran into this one today. After some Googling, found a lot of overly complicated “fixes” that seemed more like band-aids. Luckily, updating Office resolved the issue! ANother alternative was to start Outlook in Safe Mode via Outlook.exe /safe and removing or updating a Salesforce add-in.

Acronis Backup Failure and Warning Due to Addon

Recently encountered this one with Acronis Backup and Recovery 11.7. Backups were failing and throwing warnings saying

Failed to load addon: ArsAgentProvider.dll

Message: Cannot load the dynamic library

Event code: 0x00C10001+0x00000001+0x0000FFF0+0x8007007E

Code: 12,648,449(0xC10001)

 

After a good bit of troubleshooting and searching, I found this article that says it applies to 11.5, but works for 11.7. Download the DLL file and throw it into your Acronis directory. The file was COMPLETELY gone from my directory, even after running a repair install.

The next backup I kicked off went through 100% successfully.

ESXI iSCSI Connection or NAS Showing As Normal / Degraded

I ran into this issue at a client where we were forced to use an iSCSI connection for their backup. After upgrading to ESXI v6, the connection started showing as Normal / Degraded.

After doing a number of troubleshooting items, I found an obscure forum post where it was claimed that ESXI will flag it as degraded if there is only one connection (ie. the connection is not redundent).

I ended up un-bonding my NAS’s two NICs, added the “new” second NIC as a target for ESXI, rescanned the storage devices on ESXI, and voila… my degradation was resolved!

Enable DNS Request Logging for Windows Servers

I am in the process of decommissioning several DNS and Active Directory servers and wanted to make sure there were no undocumented devices on the LAN that were statically set to use one of the soon-to-be-decommissioned DNS servers. I figured the best way to do this would be to record all requests for DNS from the specific servers and it is fairly straight forward to do.
1. Open the Domain Name System Microsoft Management Console (DNS MMC) snap-in by going to Start, Programs, Administrative Tools, and then DNS Manager
2. From the DNS Server, right-click the server and select Properties

3. The Properties pop-window will appear on your screen.
4. Select the Debug Logging tab and the Log packets debugging check box, respectively.
5. Ensure that the Incoming, UDP, Queries/Transfers, and Request check boxes are selected.

To ensure that the server’s drive does not exceed capacity, make sure you set an appropriate file size limit!

6. Click the OK button.

That is it! Your text file will start logging items for you. This will work on:

  • Windows Server 2003
  • Windows Server 2003 R2
  • Windows Server 2008
  • Windows Server 2008 R2
  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016

Fixing Server Error in ‘/owa’ Application Error

Ran into this one today… and it is  nothing you want to see happen on an Exchange server! I was re-assigning services to a new SSL certificate when I started getting this error. After doing some searching, I found the easy fix from Microsoft. Under Server Config > Client Access, you can click Reset Virtual Directories on the far right. From there, you can choose which directories to rebuild (OWA, Autodiscover, etc.) Doing that fixed my issue for OWA!

 

 

More info can be found in Microsoft’s Technet Article: https://technet.microsoft.com/en-us/library/ff629372(v=exchg.141).aspx