mirror of
https://github.com/Set-OutlookSignatures/Set-OutlookSignatures.git
synced 2026-04-26 10:45:52 +03:00
[GH-ISSUE #35] Search method Group Onpremise #7
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/Set-OutlookSignatures-Set-OutlookSignatures#7
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @AlpineZ33 on GitHub (Mar 21, 2022).
Original GitHub issue: https://github.com/Set-OutlookSignatures/Set-OutlookSignatures/issues/35
Originally assigned to: @GruberMarkus, @AlpineZ33 on GitHub.
Hello,
First of all, I thank you for your work on this signature, the functions are great and will be very useful to me.
Is there a limitation in the membership of AD Onpremise groups? I have tried all the possible syntaxes, I always have an error "Not found, please check" in the Group specific template section.
Knowing that a simple TokemGroups search script returns the membership of my user
Thanks in advance for your help.
@GruberMarkus commented on GitHub (Mar 21, 2022):
Hi,
there should be no limits if you are using the latest version.
Please attach the output of Set-OutlookSignatures (as text file, not as picture), and your ini file.
Please also let me know the NetBIOS name of the Active Directory containing the group, as well as the SamAccountName and DisplayName of the group.
@AlpineZ33 commented on GitHub (Mar 21, 2022):
Hi,
Thanks for your answer.
I am using the latest version and I think I have set the ini file correctly.
Here is the output of Set-OutlookSignatures, I voluntarily modified the personal information:
`Start script @2022-03-21T11:00:47+01:00@
Script notes @2022-03-21T11:00:47+01:00@
Script : Set-OutlookSignatures
Version: v2.5.2
Web : https://github.com/GruberMarkus/Set-OutlookSignatures
License: MIT license (see '.\docs\LICENSE.txt' for details and copyright)
Check parameters and script environment @2022-03-21T11:00:47+01:00@
PowerShell: '5.1.22000.282', 'Desktop'
PowerShell bitness: 64-bit process on a 64-bit operating system
PowerShell parameters: '.\set-outlooksignatures.ps1 -SetCurrentUserOOFMessage:false -UseHtmTemplates:true -SignatureTemplatePath '.\templates\HTML' -SignatureIniPath '.
\templates\HTML\config.ini' -ReplacementVariableConfigFile '.\config\variablesGI.ps1''
Script path: 'C:\Users\xxxxxx\Signature 2022\Set-OutlookSignatures_v2.5.2\Set-OutlookSignatures.ps1'
TrustsToCheckForGroups: '*'
SignatureTemplatePath: '.\templates\HTML'
SignatureIniPath: '.\templates\HTML\config.ini'
SetCurrentUserOutlookWebSignature: 'True'
SetCurrentUserOOFMessage: 'false'
UseHtmTemplates: 'true'
GraphOnly: 'False'
GraphConfigFile: '.\config\default graph config.ps1'
GraphCredentialFile: ''
ReplacementVariableConfigFile: '.\config\variablesGI.ps1'
EmbedImagesInHTML: 'True'
CreateRTFSignatures: 'True'
CreateTXTSignatures: 'True'
DeleteUserCreatedSignatures: 'False'
DeleteScriptCreatedSignaturesWithoutTemplate: 'True'
AdditionalSignaturePath: 'C:\Users\xxxxxx\Documents\Outlook Signatures'
AdditionalSignaturePathFolder: ''
AdditionalSignaturePath combined: 'C:\Users\xxxxxx\Documents\Outlook Signatures'
SimulateUser: ''
SimulateMailboxes: ''
Get Outlook and Word version, default Outlook profile @2022-03-21T11:00:47+01:00@
Outlook registry version: 16.0
Outlook default profile: Outlook
Outlook file version: 16.0.14931.20132
Roaming signatures disabled in Outlook: 0
Word registry version: 16.0
Get Outlook signature file path(s) @2022-03-21T11:00:47+01:00@
C:\Users\xxxxxx\AppData\Roaming\Microsoft\Signatures
Get e-mail addresses from Outlook profiles and corresponding registry paths @2022-03-21T11:00:47+01:00@
HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
didier@monemail.com
Enumerate domains @2022-03-21T11:00:47+01:00@
Current user forest: mondomain.LCL
Check for open LDAP port and connectivity @2022-03-21T11:00:48+01:00@
mondomain.LCL
LDAP query successful
Check for open Global Catalog port and connectivity @2022-03-21T11:00:49+01:00@
mondomain.LCL
GC query successful
Get AD properties of currently logged in user and assigned manager @2022-03-21T11:00:49+01:00@
Currently logged in user
CN=Didier,OU=Informatique,OU=Utilisateurs,OU=xxxx,DC=mondomain,DC=LCL
Manager of currently logged in user
No manager found
Get AD properties of each mailbox @2022-03-21T11:00:50+01:00@
Mailbox 'didier@monemail.com'
Search for mailbox user object in domain/forest 'mondomain.LCL': Found
CN=Didier,OU=Informatique,OU=Utilisateurs,OU=xxxx,DC=mondomain,DC=LCL
Sort mailbox list: User's primary mailbox, mailboxes in default Outlook profile, others @2022-03-21T11:00:51+01:00@
AD mail attribute of currently logged in user: didier@monemail.com
Matching mailbox found
Mailbox priority (highest to lowest)
didier@monemail.com
Get all signature template files and categorize them @2022-03-21T11:00:51+01:00@
'SignatureGI-csu_V5.htm' found in signature template path but not in ini, please check
'SignatureGI-csu-mobile_V5.htm' found in signature template path but not in ini, please check
'SignatureGI-nova_V5.htm' found in signature template path but not in ini, please check
'SignatureGI-nova-mobile_V5.htm' found in signature template path but not in ini, please check
'SignatureGI-rsy_V5.htm'
Common template (no group or e-mail address allow tags specified)
Default signature for new e-mails
[defaultNew]
'SignatureGI-rsy-mobile_V5.htm'
Group specific template
[NETBIOSDomain Grp_SIGN_MOBILE] = Not found, please check
Default signature for new e-mails
[defaultNew]
Start Word background process for template editing @2022-03-21T11:00:56+01:00@
Mailbox didier@monemail.com @2022-03-21T11:00:59+01:00@
Get group membership of mailbox @2022-03-21T11:00:59+01:00@
mondomain.LCL @2022-03-21T11:00:59+01:00@
S-1-5-32-575
S-1-5-32-532
S-1-5-32-551
S-1-5-21-3261665145-7207452996-1220938570-24148
S-1-5-21-3261665145-7207452996-1220938570-1612
S-1-5-21-3261665145-6207452996-1220938570-13066
SMTP addresses @2022-03-21T11:01:00+01:00@
didier@monemail2.com
didier@monemail.com
Data for replacement variables @2022-03-21T11:01:00+01:00@
Execute config file 'C:\Users\xxxxxx\Signature 2022\Set-OutlookSignatures_v2.5.2\config\variablesGI.ps1'
CURRENTMAILBOXCOMPANY: MON WORKCURRENTMAILBOXCOUNTRY: FranceCURRENTMAILBOXDEPARTMENT: SICURRENTMAILBOXDISPLAYNAME: DidierCURRENTMAILBOXEXTATTR1: xxxxxCURRENTMAILBOXGIVENNAME: DidierCURRENTMAILBOXMAIL: didier@monemail.comCURRENTMAILBOXMAILNICKNAME: didier.xxxxxxxCURRENTMAILBOXMOBILE: +33 6 xx xx xx xxCURRENTMAILBOXNAMEWITHTITLES: DidierCURRENTMAILBOXPHOTO: Photo availableCURRENTMAILBOXPHOTODELETEEMPTY: Photo availableCURRENTMAILBOXSURNAME: xxxxxxxCURRENTMAILBOXTITLE: xxxxxxxCURRENTUSERCOMPANY: MON WORKCURRENTUSERCOUNTRY: FranceCURRENTUSERDEPARTMENT: SICURRENTUSERDISPLAYNAME: DidierCURRENTUSEREXTATTR1: xxxxxCURRENTUSERGIVENNAME: DidierCURRENTUSERMAIL: didier@monemail.comCURRENTUSERMAILNICKNAME: didier.xxxxxxxCURRENTUSERMOBILE: +33 6 xx xx xx xxCURRENTUSERMOBILE-PREFIX-NOEMPTY: Mob.CURRENTUSERNAMEWITHTITLES: Didier xxxxxxxCURRENTUSERPHOTO: Photo availableCURRENTUSERPHOTODELETEEMPTY: Photo availableCURRENTUSERSURNAME: xxxxxxxCURRENTUSERTITLE: xxxxxxxProcess common templates @2022-03-21T11:01:00+01:00@
'SignatureGI-rsy_V5.htm' @2022-03-21T11:01:00+01:00@
Checking permissions
Allows
Common: Template is classified as common template valid for all mailboxes
Denies
Group: Mailbox is not member of any denied group
E-Mail address: Mailbox does not have any denied e-mail address
Using template as there is at least one allow and no deny for this mailbox
Outlook signature name: 'SignatureGI-rsy_V5'
Create temporary file copy
Replace picture variables
Replace non-picture variables
Export to RTF format
Export to TXT format
Embed local files in HTM format and add marker
Copy signature files to 'C:\Users\xxxxxx\AppData\Roaming\Microsoft\Signatures'
Remove temporary files
Set signature as default for new messages
Process group specific templates @2022-03-21T11:01:02+01:00@
'SignatureGI-rsy-mobile_V5.htm' @2022-03-21T11:01:02+01:00@
Checking permissions
Allows
Group: Mailbox is not member of any allowed group
Denies
Group: Mailbox is not member of any denied group
E-Mail address: Mailbox does not have any denied e-mail address
Not using template as there is no allow or at least one deny for this mailbox
Process mailbox specific templates @2022-03-21T11:01:02+01:00@
Set up environment for connection to Outlook Web @2022-03-21T11:01:02+01:00@
Connect to Outlook Web @2022-03-21T11:01:02+01:00@
Try Windows Integrated Auth
Set Outlook Web signature @2022-03-21T11:01:03+01:00@
Different default signatures for new and reply/forward set, using new one: 'SignatureGI-rsy_V5'
Remove old signatures created by this script, which are no longer centrally available @2022-03-21T11:01:05+01:00@
Copy signatures to AdditionalSignaturePath @2022-03-21T11:01:05+01:00@
'C:\Users\xxxxxx\Documents\Outlook Signatures'
Clean-up @2022-03-21T11:01:05+01:00@
End script @2022-03-21T11:01:05+01:00@`
And the ini file :
`[]
SortOrder = Ascending
#[SignatureGI-nova_V5.htm]
#defaultNew
#OutlookSignatureName = SignatureGI-nova_V5
#[SignatureGI-nova-mobile_V5.htm]
#defaultNew
#OutlookSignatureName = SignatureGI-nova_V5
#[SignatureGI-csu_V5.htm]
#defaultNew
#OutlookSignatureName = SignatureGI-csu_V5
#[SignatureGI-csu-mobile_V5.htm]
#defaultNew
#OutlookSignatureName = SignatureGI-csu_V5
[SignatureGI-rsy-mobile_V5.htm]
NETBIOSDomain Grp_SIGN_MOBILE
OutlookSignatureName = SignatureGI-rsy-mobile_V5
defaultNew
[SignatureGI-rsy_V5.htm]
defaultNew
OutlookSignatureName = SignatureGI-rsy_V5`
@GruberMarkus commented on GitHub (Mar 21, 2022):
The ini file looks correct, the log file does not show anything worrying beside "[NETBIOSDomain Grp_SIGN_MOBILE] = Not found, please check".
What are the SIDs (objectSid and SidHistroy entries) of the group "NETBIOSDOMAIN\Grp_SIGN_MOBILE"?
What group type is "NETBIOSDOMAIN\Grp_SIGN_MOBILE" of? Is this group mail enabled?
Can the script resolve other groups, for example "NETBIOSDomain Domain Users" (could be a localized name in your environment)? It does not matter that is not part of this group, just assign it to a template.
PS 1: You don't need to define OutlookSignatureName in the ini file, if it matches the template name without file extension. Example: The template "SignatureGI-rsy-mobile_V5.htm" without a defined OutlookSignatureName will create a signature named "SignatureGI-rsy-mobile_V5" automatically.
PS 2: The mailbox didier@monemail.com has some remarkable group memberships. It is not a member of the "Domain Users" (S-1-5--513) group, but that can be a valid desired configuration. What group is the SID S-1-5-32-532, which looks like a well-known SID, but I can't in any Microsoft documentation?
@AlpineZ33 commented on GitHub (Mar 21, 2022):
I voluntarily removed a part of the SID from the script output, but I confirm that my user "Didier" is indeed a direct member of the "Users" and "Grp_SIGN_MOBILE" security groups
no, the script does not resolve any security group (with or without mail), not even a simple distribution list.
The objectSid of the group "Grp_SIGN_MOBILE" is S-1-5-21-3261665145-4207452996-1220938570-7638 and the group has no SidHistroy.
"Grp_SIGN_MOBILE" is a universal security group
The SID "Grp_SIGN_MOBILE" comes out well in the script output.
This is very strange
Thanks for the two tips....
@AlpineZ33 commented on GitHub (Mar 21, 2022):
And to complete, here is the complete and unmodified release of the SID
Get group membership of mailbox @2022-03-21T14:02:57+01:00@ mondomain.LCL @2022-03-21T14:02:57+01:00@ S-1-5-32-545 S-1-5-32-562 S-1-5-32-551 S-1-5-21-3261665145-4207452996-1220938570-34148 S-1-5-21-3261665145-4207452996-1220938570-9612 S-1-5-21-3261665145-4207452996-1220938570-63066 S-1-5-21-3261665145-4207452996-1220938570-7638 S-1-5-21-3261665145-4207452996-1220938570-11140 S-1-5-21-3261665145-4207452996-1220938570-34264 S-1-5-21-3261665145-4207452996-1220938570-34440 S-1-5-21-3261665145-4207452996-1220938570-2198 S-1-5-21-3261665145-4207452996-1220938570-10647 S-1-5-21-3261665145-4207452996-1220938570-34515 S-1-5-21-3261665145-4207452996-1220938570-30950 S-1-5-21-3261665145-4207452996-1220938570-513 S-1-5-21-3261665145-4207452996-1220938570-1391 S-1-5-21-3261665145-4207452996-1220938570-4810 S-1-5-21-3261665145-4207452996-1220938570-34369 S-1-5-21-3261665145-4207452996-1220938570-9620 S-1-5-21-3261665145-4207452996-1220938570-27757 S-1-5-21-3261665145-4207452996-1220938570-1285 S-1-5-21-3261665145-4207452996-1220938570-12768 S-1-5-21-3261665145-4207452996-1220938570-11113 S-1-5-21-3261665145-4207452996-1220938570-27984 S-1-5-21-3261665145-4207452996-1220938570-34519 S-1-5-21-3261665145-4207452996-1220938570-34449 S-1-5-21-3261665145-4207452996-1220938570-34603 S-1-5-21-3261665145-4207452996-1220938570-34213 S-1-5-21-3261665145-4207452996-1220938570-2409 S-1-5-21-3261665145-4207452996-1220938570-1269 S-1-5-21-3261665145-4207452996-1220938570-12858 S-1-5-21-3261665145-4207452996-1220938570-7821 S-1-5-21-3261665145-4207452996-1220938570-7637 S-1-5-21-3261665145-4207452996-1220938570-27717 S-1-5-21-3261665145-4207452996-1220938570-27709 S-1-5-21-3261665145-4207452996-1220938570-34113 S-1-5-21-3261665145-4207452996-1220938570-34143 S-1-5-21-3261665145-4207452996-1220938570-34150 S-1-5-21-3261665145-4207452996-1220938570-34234 S-1-5-21-3261665145-4207452996-1220938570-34391 S-1-5-21-3261665145-4207452996-1220938570-34430 S-1-5-21-3261665145-4207452996-1220938570-34432 S-1-5-21-3261665145-4207452996-1220938570-34570 S-1-5-21-3261665145-4207452996-1220938570-62302 SMTP addresses @2022-03-21T14:02:58+01:00@@GruberMarkus commented on GitHub (Mar 21, 2022):
I can't reproduce the problem here. All possible types of groups combined with mail-enabled and not mail-enabled.
Using the account didier@monemail.com, can you launch an LDAP browser (or the "Active Directory Users and Computers" MMC Snap-In) and successfully navigate to the group "NetBIOSDomain\Grp_SIGN_MOBILE" and view it's properties?
Did you set any custom permissions on the "Users" and/or "Computers" container?
Please also run the following script and post the result:
@AlpineZ33 commented on GitHub (Mar 21, 2022):
Yes, I can with users "didier" navigate in the OU to my security group (all my security groups are in subcontainers example : CN=Grp_SIGN_MOBILE,OU=Securite,OU=Groupes,OU=xxxxx,DC=mondomain,DC=LCL)
Here is the output of the script:
`Looking for SamAccountName 'mondomain\Grp_SIGN_MOBILE'
Result
Name Value
[mondomain Grp_SIGN_MOBILE] S-1-5-21-3261665145-4207452996-1220938570-7638`
@GruberMarkus commented on GitHub (Mar 21, 2022):
The script itself can't convert any group's name to it's SID, but the code snipplets from within the script can.
So the next check is to find out where something in the script goes wrong in a way that does not throw an error.
I added some very rough hints to the code, which should help me analyze where in the script something strange happens.
Please replace your Set-outlookSignatures.ps1 with the attached copy, execute it and attach the log file.
Please don't copy/paste the output into your answer, but upload a file containing the output. This way, the indents are not replaced by GitHub, which for me is easier to read and debug.
set-outlooksignatures.ps1.txt
@AlpineZ33 commented on GitHub (Mar 21, 2022):
Here is the output of the script, I modified the personal information
export20220321-17h28.txt
.
@GruberMarkus commented on GitHub (Mar 21, 2022):
While I analyze the log: Je suis toujours curieux de savoir qui utilise Set-OutlookSignatures. Est-ce que je devine bien que nous parlons de l'une des "trois vieilles" ? Si c'est vrai, veuillez saluer la ville melhor de ma part, car je n'y suis pas allé depuis (trop) longtemps.
@GruberMarkus commented on GitHub (Mar 21, 2022):
It fails at exactly the code snipplet that works fine as separate script in #issuecomment-1073926200..
Very strange.
I added a bit more debug output in the file attached.
Please replace your Set-OutlookSignatures.ps1 with the attached copy, execute it and attach the log file.
Please don't copy/paste the output into your answer, but upload a file containing the output. This way, the indents are not replaced by GitHub, which for me is easier to read and debug.
Please also check your ini file again:
Should there really be an issue around ini file encoding, I will need the original configuration files and logs without any obfuscation (you can send them via e-mail or grant me access to one of your on-prem or cloud file sharing services).
Attachment: set-outlooksignatures.ps1.txt
@AlpineZ33 commented on GitHub (Mar 21, 2022):
I did a copy/paste of the security group, there can't be an error.
There is no accent in the group name, and no accent in the subcontainers either.
The ini file is encoded in UTF8 under Notepad++ (I recreated a file with notepad.exe but the result is the same)
Can you give me the email address to send you the output of the script without modification?
@AlpineZ33 commented on GitHub (Mar 21, 2022):
Les trois vieilles ?
@GruberMarkus commented on GitHub (Mar 21, 2022):
Oui, les trois grandes banques françaises.
@GruberMarkus commented on GitHub (Mar 21, 2022):
Please send the files to the e-mail address mentioned on my GitHub profile (https://github.com/GruberMarkus/)
@GruberMarkus commented on GitHub (Mar 21, 2022):
Let’s have a look at the log file:
The first error message appears at line 93:
Exception lors de l'appel de « Translate » avec « 1 » argument(s) : « Impossible de traduire certaines ou toutes les références d'identité. »
This is not very specific, but the code hint tells us that the following PowerShell code fails:
$TemplateFilesGroupSIDs.add('[NETBIOSDomain Grp_SIGN_MOBILE]', (New-Object System.Security.Principal.NTAccount('NETBIOSDomain\Grp_SIGN_MOBILE')).Translate([System.Security.Principal.SecurityIdentifier]))
As the query for the SID of a group defined in the 'Domain\SamAccountName' format failed, the script now assumes that 'Grp_SIGN_MOBILE' ist the Display name of the group.
This search fails, too. The error message is at line 102:
Exception lors de l'appel de «InvokeMember» avec «5» argument(s): «Le domaine spécifié n’existe pas ou n’a pas pu être contacté. (Exception de HRESULT : 0x8007054B)»
This is a bit more specific, as it shows that the domain 'NETBIOSDomain' can’t be contacted. The failing PowerShell code is the third line of the following code block:
$objNT.InvokeMember('Init', 'InvokeMethod', $Null, $objTrans, (1, 'NETBIOSDomain')) # 1 = ADS_NAME_INITTYPE_DOMAIN
Note that two different approaches, System.Security.Principal.NTAccount().Translate and NameTranslate, fail. Either there is a problem in the script itself, or there is something wrong about the client or the domain.
Let’s see if it is the script:
Please execute the following two code blocks and send me the results.
Then, please run the attached debug version of Set-OutlookSignatures and attach the output: set-outlooksignatures.ps1.txt
@GruberMarkus commented on GitHub (Mar 21, 2022):
Please also run the following batch commands and post the output:
@AlpineZ33 commented on GitHub (Mar 21, 2022):
Thanks markus,
I've sent you the outputs by email.
this problem is very very strange
@GruberMarkus commented on GitHub (Mar 22, 2022):
The reason for the problem has been found: The NetBIOS domain name in the ini file was not spelled correctly.
The error was not detected earlier because private information in the log files was obfuscated in a way that exactly matched the misspelling of the NetBIOS domain name in the ini file.
The problem was solved by correcting the ini file entries.
It was nice working with you!
If you, your clients, users and admins are happy with Set-OutlookSignatures, my support and the savings compared to using commercial software, you may want to consider sponsoring future development.
You can find details in '.\docs\README.html' or at https://github.com/sponsors/GruberMarkus.