[GH-ISSUE #102] User query LDAP successfully but still get a message about graph and tokens. #40

New issue

Closed

opened 2026-02-27 20:30:57 +03:00 by kerem · 4 comments

kerem commented

2026-02-27 20:30:57 +03:00

Owner

Originally created by @fpsacha on GitHub (Mar 8, 2024).
Original GitHub issue: https://github.com/Set-OutlookSignatures/Set-OutlookSignatures/issues/102

I am deploying the tool on a couple of test PC without any issue. We have a local AD and all the PC can do the ldap query correctly. Signatures are working fine. But i have 1 user that is trying to connect to Graph and i am not sure why.

usually after the line : Currently logged-in user, i get the logged on user and the manager and the script continue. But this user get a message about the graph token and it open a webpage to use the Enterprise Apps. I do not want to use MS-Graph but it only does this on this one user.

What am i missing ?


`Enumerate domains @2024-03-08T10:03:55-05:00@
  User forest:  $NameofDomainRedacted
  User provided trusted domain/forest:   $NameofDomainRedacted
    Trusted domain/forest already in list.

Check trusts for open LDAP port and connectivity @2024-03-08T10:03:55-05:00@
  $NameofDomainRedacted
    LDAP query successful

Check trusts for open Global Catalog port and connectivity @2024-03-08T10:03:56-05:00@
  $NameofDomainRedacted
    GC query successful

Get AD properties of currently logged-in user and assigned manager @2024-03-08T10:03:56-05:00@
  Currently logged-in user
    Set up environment for connection to Microsoft Graph @2024-03-08T10:03:56-05:00@
VERBOSE: Loading module from path
'C:\Users\REDACTED\AppData\Local\Temp\c97801ce-b4be-4e71-9983-9f12707483d3\msal.ps\msal.ps.psd1'.
VERBOSE: Loading module from path
'C:\Users\REDACTED\AppData\Local\Temp\c97801ce-b4be-4e71-9983-9f12707483d3\msal.ps\MSAL.PS.psm1'.
VERBOSE: Exporting function 'Assert-DirectoryExists'.
VERBOSE: Exporting function 'ConvertFrom-SecureStringAsPlainText'.`

Originally created by @fpsacha on GitHub (Mar 8, 2024). Original GitHub issue: https://github.com/Set-OutlookSignatures/Set-OutlookSignatures/issues/102 I am deploying the tool on a couple of test PC without any issue. We have a local AD and all the PC can do the ldap query correctly. Signatures are working fine. But i have 1 user that is trying to connect to Graph and i am not sure why. usually after the line : Currently logged-in user, i get the logged on user and the manager and the script continue. But this user get a message about the graph token and it open a webpage to use the Enterprise Apps. I do not want to use MS-Graph but it only does this on this one user. What am i missing ? ``` `Enumerate domains @2024-03-08T10:03:55-05:00@ User forest: $NameofDomainRedacted User provided trusted domain/forest: $NameofDomainRedacted Trusted domain/forest already in list. Check trusts for open LDAP port and connectivity @2024-03-08T10:03:55-05:00@ $NameofDomainRedacted LDAP query successful Check trusts for open Global Catalog port and connectivity @2024-03-08T10:03:56-05:00@ $NameofDomainRedacted GC query successful Get AD properties of currently logged-in user and assigned manager @2024-03-08T10:03:56-05:00@ Currently logged-in user Set up environment for connection to Microsoft Graph @2024-03-08T10:03:56-05:00@ VERBOSE: Loading module from path 'C:\Users\REDACTED\AppData\Local\Temp\c97801ce-b4be-4e71-9983-9f12707483d3\msal.ps\msal.ps.psd1'. VERBOSE: Loading module from path 'C:\Users\REDACTED\AppData\Local\Temp\c97801ce-b4be-4e71-9983-9f12707483d3\msal.ps\MSAL.PS.psm1'. VERBOSE: Exporting function 'Assert-DirectoryExists'. VERBOSE: Exporting function 'ConvertFrom-SecureStringAsPlainText'.` ```

kerem closed this issue

2026-02-27 20:30:57 +03:00

kerem commented

2026-02-27 20:30:57 +03:00

Author

Owner

@GruberMarkus commented on GitHub (Mar 8, 2024):

At least one of the following conditions is met:

$GraphOnly -eq $true
Rather not, because the excerpt shows that on-prem AD domains are queried
($GraphOnly -eq $false) -and ($ADPropsCurrentUser.msexchrecipienttypedetails -ge 2147483648) -and (($SetCurrentUserOOFMessage -eq $true) -or ($SetCurrentUserOutlookWebSignature -eq $true)))
Possible. Please check the value of the msexchrecipienttypedetails AD attribute of the user.
($GraphOnly -eq $false) -and ($null -eq $ADPropsCurrentUser)
Possible, but unlikely. Can only be answered when you provide the full verbose output of Set-OutlookSignatures.
$OutlookUseNewOutlook -eq $true
Possible. Can only be answered when you provide the full verbose output of Set-OutlookSignatures.

@GruberMarkus commented on GitHub (Mar 8, 2024): At least one of the following conditions is met: - `$GraphOnly -eq $true` Rather not, because the excerpt shows that on-prem AD domains are queried - `($GraphOnly -eq $false) -and ($ADPropsCurrentUser.msexchrecipienttypedetails -ge 2147483648) -and (($SetCurrentUserOOFMessage -eq $true) -or ($SetCurrentUserOutlookWebSignature -eq $true)))` Possible. Please check the value of the `msexchrecipienttypedetails` AD attribute of the user. - `($GraphOnly -eq $false) -and ($null -eq $ADPropsCurrentUser)` Possible, but unlikely. Can only be answered when you provide the full verbose output of Set-OutlookSignatures. - `$OutlookUseNewOutlook -eq $true` Possible. Can only be answered when you provide the full verbose output of Set-OutlookSignatures.

kerem commented

2026-02-27 20:30:57 +03:00

Author

Owner

@fpsacha commented on GitHub (Mar 8, 2024):

I just had a look and this user is the only one with a string in the attribute msExchRecipientDisplayType
2147483648
That would explain it !

@fpsacha commented on GitHub (Mar 8, 2024): I just had a look and this user is the only one with a string in the attribute msExchRecipientDisplayType 2147483648 That would explain it !

kerem commented

2026-02-27 20:30:58 +03:00

Author

Owner

@GruberMarkus commented on GitHub (Mar 8, 2024):

That value indicates that the mailbox is in Exchange Online/Office 365/Microsoft 365.

As you also want to set the signature in Outlook Web and/or set an out-of-office reply, a Graph connection is required to get an access token for the mailbox.

The value for msexchrecipienttypedetails might not be correct, though. This may happen when using 3rd party tools etc, as they often are not careful enough about the meaning of these values.

Please let me know if this issue can be closed as successfully resolved.

@GruberMarkus commented on GitHub (Mar 8, 2024): That value indicates that the mailbox is in Exchange Online/Office 365/Microsoft 365. As you also want to set the signature in Outlook Web and/or set an out-of-office reply, a Graph connection is required to get an access token for the mailbox. The value for msexchrecipienttypedetails might not be correct, though. This may happen when using 3rd party tools etc, as they often are not careful enough about the meaning of these values. Please let me know if this issue can be closed as successfully resolved.

kerem commented

2026-02-27 20:30:58 +03:00

Author

Owner

@fpsacha commented on GitHub (Mar 11, 2024):

Thanks for the info ! We are going to try to clean that up internally. You can close this. Thank you again.

@fpsacha commented on GitHub (Mar 11, 2024): Thanks for the info ! We are going to try to clean that up internally. You can close this. Thank you again.

kerem referenced this issue

2026-02-27 20:31:14 +03:00

[PR #40] [MERGED] Release v3.2.0 #95