Showing posts with label Active Directory. Show all posts
Showing posts with label Active Directory. Show all posts

Azure AD Sync behind proxy

To be able to have Azure AD Sync (AADSync) behind a proxy it must allow unauthenticated proxying (i.e. no ID/PWD). If you can fulfill this then you need to do the following:
  1. Configure the proxy server
  2. Configure AADSync to use the proxy server
Configure the proxy server
Do configuring to allow traffic to Office 365 IP's and URL's.

Configure AADSync
If you have a static ID/PWD for the service account then use the following command:
runas /user:domain\serviceuser "control.exe inetcpl.cpl"

In some cases you also need to edit the machine.config for .Net framework 4.5
  1. Open C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config
  2. Add proxy settings (case sensitive XML)
Example on proxy settings
<system.net>
<defaultProxy>
<proxy usesystemdefault="true" proxyaddress="http://proxy-ip:80" bypassonlocal="true" />
</defaultProxy>
</system.net>
Reference: 
Sometimes you also need to set winhttp using NetSh
set proxy proxy-server="http=myproxy;https=sproxy:88" bypass-list="*.contoso.com"
NetSh commands

Hide/Show Mail icon in Control Panel on Remote Desktop/Citrix for Office 365 ProPlus

In Remote Desktop and Citrix environments it's common to hide specific Control Panel applets or maybe only show a few using GPO's : User Configuration\Administrative Templates\Control Panel

  • Hide specified Control Panel items
  • Show only specified Control Panel items


  • When I deployed Office 365 ProPlus (with shared licensing) on the Remote Desktop server my Mail icons disappeared from users Control Panel. The new name to use are:

    Find all UPN suffixes used in a Active Directory (PSH)

    Very short script for fetching all UPN-suffixes used in a Active Directory using ADWS:
    Import-Module ActiveDirectory
    $users = get-aduser -filter * -properties UserPrincipalName  | where {  $_.userprincipalname -ne $null }
    $upnlist=@()
    foreach ($i in $users)
    {
    $s = $i.UserPrincipalName.tostring()
    $upn  = $S.substring($s.IndexOf("@"))
    $upnlist+=$upn
    }
    $upnlist | Group-Object
    

    Creating test users in Active Directory (Powershell)

    I needed some test accounts to a DEMO / LAB environment today but with somewhat real names. I wrote the following Powershell script (requires ActiveDirectory module).


    
    #####################################################################
    # Written by Rikard Strand
    # Script provided AS IS  without warranty of any kind
    #####################################################################
    
    # Import AD module
    Import-Module ActiveDirectory
    
    #####################################################################
    ### Variables to edit : START
    # UPN Suffix (set to a valid UPN Suffix)
    $upnsuffix = "domain.com"
    
    # OU to create in (set to a valid OU)
    $OU = "OU=TEST,DC=domain,DC=com"
    
    # How many users do you want to create
     $total = 6689
    
    ### Variables to edit : END
    #####################################################################
    
    # Generate first name, add more names if needed
    $fn=@()
    $fn="Mary","Patricia","Linda","Barbara","Elizabeth","Jennifer","Maria","Susan","Margaret"
    $fn+="Dorothy","Olivia","Isabella","Fiona","Sarah","Angelina","Angela","Jasmine"
    $fn+="Jacob","Mason","Ethan","Noah","William","Liam","Jayden","Michael","Alexander"
    $fn+="Aiden","Mateo","Nicolás","Alejandro","Samuel","Diego","Daniel","Benjamín","Lucas"
    $fn+="Joshua","Gary","Patrick","Eric","Albert","Keith","Ralph","Will","Samuel","Roy"
    $fn+="Derek","Herman","Clyde","Glen","Hector","Shane","Ricardo","Dan","Dean","Edwin"
    $fn+="Jake","Marco","Drew","Jody","Al","Nicolas","Owen","Sandra","Jennifer","Amy"
    $fn+="Jill","Veronica","Rihanna","Madonna","Eva","April","Dolores","Lynn","Annette"
    $fn+="Marion","Erica","Sherri","Sabrina","Hilda","Nora","Nina","Leah","Carole","Olga"
    $fn+="Angelina","Ginger","Brooke","Rachael","Kari","Estelle","Mable","Krystal","Lynette"
    $fn+="Kevin","Daniel","Jayden","Matthew","Bruce","Adam","Don","Floyd","Tim","Doris"
    $fn+="Alice","Kelly","Judy","Brenda","Holly","Jeanette","Emma","Esther","Carrie","Elaine"
    $fn+="Billie","Violet","Tracey","Becky","Sheryl","Ada","Isabel","Paulette","Nikki"
    $fn+="Rhonda""Tammie","Patrice","Stacie"
    
    # Generate sur name, add more names if needed
    $sn =@()
    $sn="Smith","Martin","Patel","Taylor","Wong","Campbell","Williams","Thompson","Jones"
    $sn+="Brown","Clark","Jackson","Lewis","Walker","Perez","Mitchell","Cussler","Edwards"
    $sn+="Lee","Cruz","Morgan","Peterson","Cook","Cox","Price","Myers","Foster","Ross"
    $Sn+="Wilson","White","Rose","Quinn","McLaughlin","Campbell","Brown","Stewart","Russel"
    $Sn+="Green","Harris","Copper","King","Hall","Ward","Carter","Patel","Allen","Murray"
    $Sn+="Gardner","Walsh","Fox","Wolf","Bear","Lloyd","Robertson","Graham","Cole","Ali"
    $Sn+="Webb","Watts","Poole","Foxhound","Hussain","Mason","Rogers","Ellis","Russel"
    $Sn+="Bush","Franklin","Young","Knight","Spencer","Griffin","Hogwarths","Potter"
    $Sn+="Kobben","Dolstra","Salt","Pepper","Dolan","Swan","Fountain","Beck","Denton"
    $Sn+="Pitt","Crane","Bowes","Bonner","York","McIellan","Froigh","Duff","Hale"
    $Sn+="Florez","Fortin","Moore","Carter","Hill","Chapman","Gill","West","East","North"
    $Sn+="Ryan","Barker","Jenkins","Lawson","Bulter","Kahn","Simpson","Saunders","Kennedy"
    $Sn+="Kingston","Powell","van Dam","Castle","Hull","Proctor","Keeling","Rich"
    $Sn+="Millington","Nairn","Dickens","Bouvet","Knott","Nolan","South"
    
    # Generate City
    $city=@()
    $city="London","Manchester","Las Vegas","Miami","Dubai","Hong Kong"
    $city+="Beijing","Cairo","Jakarta","Lagos","Mexico City","New York","Moscow","Seoul"
    $city+="Istanbul","Copenhagen","Tokyo","Rio de Janeiro","Bahamas","Ottawa","Quebec"
    $city+="Baltimore","Bangkok","Berlin","Brussels","Budapest","Damascus","Dublin"
    $city+="Kuala Lumpur","Nice","Paris","Osaka","Montreal","Milan","Helsinki","Glasgow"
    $city+="Shenzhen","Oslo","Stockholm","Roma","Madrid","Barcelona","Cannes","Luxembourg"
    $city+="Hamburg","Kiev","Manila"
    
    # Generate Department
    $depnames=@()
    $depnames="Sales","Finace","Humans Services","Education","Defence","Support"
    $depnames+="Health care","Service Delivery","Claims","HR","Agents",""
    
    # Generate Titles
    $titlenames=@()
    $titlenames="Consultant","Senior Consultant","Micro manager","Traniee",""
    $titlenames+="Manager","Assistant","Apostle","Shogun","Talent","Star"
    
    # Create the users
     for ($userIndex=0; $userIndex -lt $total; $userIndex++) 
     { 
      $userID = "{0:0000}" -f ($userIndex + 1)
      $userName = "test$userID"
      $given = $fn[(Get-Random $fn.count)]
      $sur = $sn[(Get-Random $sn.count)]
      $c = $city[(Get-Random $city.count)]
      $dep = $depnames[(Get-Random $depnames.count)]
      $title = $titlenames[(Get-Random $titlenames.count)]
      write-host $userID" | Creating "$given $sur "a" $title "in" $dep "@" $c 
    
    New-ADUser `
       -AccountPassword (ConvertTo-SecureString "Pass123." -AsPlainText -Force) `
       -City $c `
       -Company "The Global company" `
       -Department $dep `
       -Description ("TEST ACCOUNT " + $userID + "(User is meant for test purposes)")`
       -EmailAddress "$userName@theglobalcompany.test" `
       -EmployeeNumber "$userID" `
       -EmployeeID "ISED$userID" `
       -Enabled $true `
       -Name "$given $sur ($userID)" `
       -GivenName $given `
       -Surname $sur `
       -DisplayName "$given $sur ($userID)" `
       -HomePhone "703-556-$userID" `
       -MobilePhone "703-557-$userID" `
       -Path $OU `
       -POBox "PO Box $userID"`
       -PostalCode $userID `
       -SamAccountName $userName `
       -StreetAddress "$userID Global street" `
       -Title $Title `
       -UserPrincipalName $userName"@"$upnsuffix
    }
    
    # List all the users (requires PowerShell ISE environment)
    get-aduser -filter * -SearchBase "$OU" -Properties * | Out-GridView
    

    Add ACL's to AdminSDHolder for Exchange 2010 ActiveSync

    By default in Exchange 2010 any users protected by AdminSDHolder can't synchronize their mobile with ActiveSync. This is due to AdminSDHolder removing inheritance on security for user objects in sensitive groups (more information here).

    If you for some reason would like to add the permissions to AdminSDHolder then the following script works:

    REM This user permissions 
    dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /G "MYDOMAIN\Exchange Servers:CCDC;msExchActiveSyncDevices" 
    
    REM Descendant msExchActiveSyncDevices objects
    dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:LCRPWPRCWD;;msExchActiveSyncDevices" 
    dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:CCDC;msExchActiveSyncDevice;msExchActiveSyncDevices" 
    
    REM Descendant msExchActiveSyncDevice objects
    dsacls "CN=AdminSDHolder,CN=System,DC=MYDOMAIN,DC=COM" /I:S /G "MYDOMAIN\Exchange Servers:LCRPWPRCWD;;msExchActiveSyncDevice" 
    
    

    Manually kick off SDProp (Security Descriptor Propagator Update)

    This is how you manually can start SDProp (propagation of security permissions of AdminSDHolder) on Windows 2008 R2/2012 DCs (run the script on the DC holding the PDC FSMO role).

    Script
    # Requires/imports ActiveDirectory module
    Import-Module ActiveDirectory
    $PDC = Get-ADDomain | select -ExpandProperty PDCEmulator            
    $Temp = "c:\temp\RikardStrand\temp.txt"            
    write-host $temp
    Set-Content -Path $Temp -Value @'
    dn:
    changetype: modify
    add: runProtectAdminGroupsTask
    runProtectAdminGroupsTask: 1
    -
    '@             
    ldifde -i -f $Temp            
    
    

    Simple Powershell to find newly created computer objects

    import-module ActiveDirectory
    # Find computers created 45 days ago
    $time = (get-date).AddDays(-45)
    $comp = Get-ADComputer -Filter { createTimeStamp -gt $time  } -Properties *
    $comp | ft name,LastLogonDate,IPv4Address,enabled,CanonicalName -AutoSize
    $comp | select name,LastLogonDate,IPv4Address,enabled,CanonicalName | Out-GridView

    Create test users with Powershell

    Two very simple commands (in powershell) to create test users with Powershell and the built in commands.

    Create 50 users in Active Directory
    1..50 | ForEach { Net User "Exchange$_" Password1 /ADD /Domain }
    Create 50 users in Active Directory and also create an mailbox on Exchange 2010
    1..50 | ForEach { Net User "Exchange$_" Password1 /ADD /Domain; Enable-Mailbox “User$_” -Database “Mailbox Database” }

    Win2008R2 DC blue screen on startup

    Today I hade a very mysterious problem on one Win2008R2 DC. The server was denoted as a RODC and promoted as a RWDC. After a few reboots the server was working good and workstations used the new server. A few days later from the I did a new reboot and got a blue screen:
    STOP: c00002e2 Directory Services could not start because of the following error: A device attached to the system is not functioning. Error Status: 0xc0000001. Please shutdown this system and reboot into Directory Services Restore mode, check the event log for more detailed information.
    I started in DS Restore mode (F8 after BIOS Post) and the server booted up. The first screen that I saw was:
    Failure configuring Windows features. Reverting changes. Do not turn off your computer.
     After this the computer shutdown (but I got the same blue screen error). A new boot into DS Restore mode got me additional configuration of the server:
    Preparing to configure Windows. Do not turn of your computer.
    However my problem wasn't solved this time. After logging on into the server in DS Restore mode I looked at the event logs but there was no additional information stored here. I looked at my NTFS file system to verify that NTDS files were present (and they where). I looked in services.msc to see if  Active Directory Domain Services was present and it was. I started ntdsutil to look at the files and then I got a nasty JET Database Error:
    "Could not initialize the Jet engine: Jet Warning 1." Failed to open DIT for AD DS/LD instance NTDS. Error -2147418113
     Basically something was missing and I looked at the registy for the Active Directory Domain Services (NTDS); HKLM\SYSTEM\CurrentControlSet\services\NTDS. I was missing a bunch of keys (=registry folders) in this branch; Diagnostics, Parameters and RID values. So my fixing started (as I had my NTDS.dit file on the local file system). I copied the registry keys from another working DC and modified the following keys under  ...\NTDS;

    • \Diagnostics\* (added all keys)
    • \Parameters\* (added all keys)
    • \Parameters\DS Drive Mappings (edited to correct GUID for volume)
      To find your volume GUID use mountvol.exe
    • \Parameters\Machine DN Name (edited to correct value)
    • \Parameters\DSA Database Epoch (deleted value)
    After doing the registry fixing my DC started and replication worked with my other domain controllers. When Windows did it's configuring (that somehow caused the problem in the first place) it also set some of the other services to disabled (and I enabled these in services.msc);
    • DFS Namespace (dfs)
    • DFS Replication (dfsr)
    • DNS Server (dns)
    • Intersite Messaging (ismserv)
    • Kerberos Key Distribution Center (kdc)
    Now I'm going to denote the server, move all services to a fresh/clean installed server and promote the new server to be my DC on the site.
    A few links that helped me during troubleshooting:

    Install DC from installation media

    If you ever need to install a Domain Controller without replicating all changes during the dcpromo process you can install from media. You simply do the following:

    1. Create media using ntdsutil (NTDSUTIL ifm)
    2. Move the files to the server 
    3. Run dcpromo on the server (choose advanced) and point to the files created

    VBScript to find all DC's in a Active Directory

    Sometimes you need to locate all DC's in a domain. A common approach is to check the "Domain Controllers" OU in the domain but this can be inaccurate (a denoted DC can still be present in this container).

    The following VBScript parses AD after the nTDSDSA object (Directory Service Agent):
    On Error Resume Next
    Const ADS_SCOPE_SUBTREE = 2
    Set objRootDSE = GetObject("LDAP://RootDSE")
    strConfigurationNC = objRootDSE.Get("configurationNamingContext")
    Set objConnection = CreateObject("ADODB.Connection")
    Set objCommand =   CreateObject("ADODB.Command")
    objConnection.Provider = "ADsDSOObject"
    objConnection.Open "Active Directory Provider"
    Set objCommand.ActiveConnection = objConnection
    objCommand.Properties("Page Size") = 1000
    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
    objCommand.CommandText = _
        "SELECT ADsPath FROM 'LDAP://" & strConfigurationNC & "' WHERE objectClass='nTDSDSA'" 
    Set objRecordSet = objCommand.Execute
    objRecordSet.MoveFirst
    Do Until objRecordSet.EOF
        Set objParent = GetObject(GetObject(objRecordset.Fields("ADsPath")).Parent)
        WScript.Echo objParent.name
        objRecordSet.MoveNext
    Loop

    Links

    Migrate users to a new AD forest (or domain)

    I often work with  projects that must migrate users from one Active Directory forest to another. There can be many reasons for doing this; migration projects, creating test forests/domains or moving users due to compliance or security demands.

    Some of these project customers often have requirements for moving all attributes and in some cases even SID (security identifier), passwords and/or groups and their members. In some cases even email addresses, aliases and security permissions for Exchange are required to be migrated (but that will be another post in the future).

    There are many tools that can be used for migrating users but Microsoft ADMT version 3.2 is a useful tool (specifically for users and groups). Below is a short step by step guide to migrate users and groups cross forest.
    1. Establish network infrastructure between domainsNetwork traffic must be routable between the domain controllers (preferably all DC's but at least the PDC Emulators in every domain). 
    2. Establish DNS infrastructure between domainsI usually setup conditional forwarding on all DNS servers to be able to do name lookups cross forest.
    3. Create one way forest trust between domainsSetup a one-way forest trust from target.com to source.com (i.e. target.com is trusted by source.com). This way you can have the migration tools in the target.com forest.
    4. Install ADMT version 3.1 on TargetDC1.target.comADMT requires a SQL database for storage. If you have a SQL deployed into the domain I recommend you to use that otherwise you can install SQL Express instance to host the data.
    5. Setup migration accounts
      1. Create  "acct_migrators" in target.com domain (Global Security Group)
      2. Add your migration account into the "Domain Admins" group in target.com
      3. Add "acct_migrators" from target.com into "Administrators" in source.com
    6. SID History (optional)If you require SID History you must do som additional tasks to be able to migrate source SID to target SIDHistory. This is especially useful if you also migrate services and/or files and preserve ACL's on the objects, services or servers.
      1. Enable TCP/IP support on PDC emulator
        This step isn't needed if you are using Windows 2003 servers or newer.
        • HKLM\System\CurrentControlSet\Control\LSA
          • Modify the "TcpipClientSupport" (REG_DWORD) and set it to "1"
        • Restart the DC hosting the PDC role
      2. Enable auditing in target.com and source.com domains
        Edit "Default Domain Controllers policy" with the following settings;
        • Computer Configuration > Polices > Windows Settings > Local Policies > Audit Policy
          • Audit Account Management: Success & Failure
          • Audit Directory Service Access: Success
      3. Create a NETBIOSDOMAINNAME$$$ group in source.com/Users container
        This goups is a special group used during SID migration by ADMT
    7. Password Export Server (PES) service (optional)
      If you need to migrate password with the user object this is possible with PES.
      1. Create PES encryption key on TargetDC1.domain.com
        admt key /option:create /sourcedomain:NETBIOSDOMAINNAME /keyfile:C:\Secure\Mig.key /keypassword:*
      2. Install PES server on SourceDC1.source.com
        Use a service account from target.com (NETBIOS\AccountName) and you will also need the encryption key file (and key file password) during the installation. The service is installed with "manual" as service startup (never change this)
      3. Restart the DC with PES service
    Migration
    I recommend to migrate the groups in the following order:
    1. Global groups
    2. Users
    3. Domain local and Universal groups
    During migration of passwords remember to start the PES service on the SourceDC1.target.com server and always stop the server after the password migration to prevent attacking surface on the service.

    Links

    CNAME on Windows 2008 R2 server (print server)

    In some cases you want to reference a single server using a CNAME (i.e. DNS alias that points to another record). You can use this technique to provide friendly names for the users to remember for the services, for example PrinterServer instead of NetPrnNoOsl01 (Net Printer Norway Oslo 01).


    In other to reference a server with CNAME on Windows 2008 R2 you need to do the following:



    1. Create a correct CNAME in you DNS

    2. Add registry entries on the server (3 entries)

    3. Register SPN names into Active Directory

    4. Reboot the server (so the changes are implemented)

    CName in DNS


    To create a CNAME in DNS use the dnsmgmt.msc to create the alias in the correct zone.


    Registry entries



    • Path: HKLM\SYSTEM\CurrentControlSet\Control\Print Key: DnsOnWire Type: REG_DWORD Value: 1

    • Path: HKLM\system\currentcontrolset\services\lanmanserver\parameters Key: DisableStrictNameChecking Type: REG_DWORD Value: 1

    • Path: HKLM\system\currentcontrolset\services\lanmanserver\parameters Key: OptionalNames Type: REG_MULTI_SZ Value: CNAME (only NETBIOS name)

    Register SPN’s


    You use the setspn.exe utility to add, list or remove SPN’s from users and/or computers. You need to create the SPN’s so authentication will work correctly.


    Create HOST/CNAME and HOST/CNAME.domain.suffix on the computerobject hosting the alias name.


    setspn.exe –a host/CNAME computerobject


    Example


    In this example I'’m creating an PrintServer CNAME for NetPrnNoOsl01 in contoso.com.



    1. CNAME PrintServer points to NetPrnNoOsl01.contoso.com.

    2. Add registry entries as specified

    3. Add SPN’s setspn.exe –a host/PrintServer NetPrnNoOsl01 setspn.exe –a host/PrintServer.contoso.com NetPrnNoOsl01

    Extremely slow logon to ICA/RDP showing "Checking your credentials..."

    Together with two of my collegues I recently worked on a Citrix problem with extremely slow logon. When trying to logon with ICA the server showed "Checking your credentials..." for a very long time (maybe 15 minutes) and RDP just gave me a blue background approximately the same time (after entering a valid ID/PWD).
    After cheching verious things like:
    • NETLOGON service (both on Citrix server and domain controllers in the same site)
    • KDC service (on the DC's)
    • Bindings on the NIC (Citrix server)
    • IMA service (on the Citrix server)
    • Time (i.e. no time skew difference on the server, for Kerberos to work)
    • ICA connection/protocoll settings
    • A load of other possible things
    My collegue (Jostein Støen)found the issue to be a DC (Windows 2008 server) that had cleaned a file with a virus and required a restart to fix all errors. After the restart all worked well again. The slow logon was caused by the server session timing out to the first DC and after the timeout the logon succeeded as normal.

    Restore Exchange 2003 public folder to alternate hardware

    In some cases you need to recover old public folder data from Exchange while maintaning full production to all users. Public Folder stores isn't supported with recovery storage groups (RSG) within Exchange 2003 so an alternative is to use a separate hardware.

    Below is a simplified todo list

    1. Create a new server (physical or virtual) with appropriate disk space for the public folder
    2. Promote the new server to a Domain Controller in a new forest and domain (use DNS on the same server)
    3. Run Exchange 2003 forestprep
    4. Run Exchange 2003 domainprep
    5. Retrieve Exchange names from the running Exchange forest
      1. Exchange organization name
      2. Administrative group name (for the public folder store)
      3. Storage group name
      4. Public folder store name
    6. Install Exchange 2003 on the new server
      1. Specify the identical organization name
    7. Patch the Exchange server to identical patch level
    8. Change the Exchange organization to "native" level
    9. Change name on the Administrative group
    10. Change name on the Storage group for the Public Folder store
    11. Change the name on the public folder store
    12. Restart the Exchange server (to refresh Information store cache)
    13. Dismount the PF store
    14. Check "This database can be overwritten by a restore" on the Public Folder store
    15. Restore the public folder database
      1. Redirection is used within most backup products
      2. Use the correct backupfile locally on the restore server if using NTBackup
    16. Mount the database
    17. Extract the data needed with a utility
      1. Outlook can be used
      2. PFDAVAdmin can be used

    Links

    Deploy MS .Net framework 3.5 with Group policies (GPO)

    Today I was faced with the challenge to deploy Microsoft .Net Framework 3.5 with GPO (software installation). The application itself have many dependencies/requirements to have a successfull installation:

    • MS XML Parser 6
    • RGB Rasterizer
    • .NET FW 2.0 SP1
    • .NET FW 3.0 SP1

    Create a AIP (Administrative Installation point)

    I found a blog (Project84) that had created a batch script for creating the required administrative installation point. The script worked for me when I edited some parameters in the script:

    • Row 2: Changed WORKFOLDER
    • Row 14: Changed to correct path to dotnetfx35.exe

    After this I got the folders to be able to deploy software to x86 systems.

    MST files (Micsoft

    For installation to work with GPO's I created some MST-files for the deployment to set the property VSEXTUI=1 to the .Net Framework installers (2.0 SP1, 3.0 SP1 and 3.5).

    GPO-deployment

    To deploy all software I created 4 GPO's in the correct OU and assigned the software to computers in the following order:

    1. RGB Rasterizer (no MST needed)
    2. .NET FW 2.0 SP1 (with MST)
    3. .NET FW 3.0 SP1 (with MST)
    4. .NET FW 3.5 (with MST)

    Silent installation

    If you need to do a silent installation of the .NET 3.5 then you can download the redistributable package and run it with the following command:

    dotnetfx35.exe /q /norestart

    Some useful links

    Mail attribute not updating when using ESM

    When using the ESM (Exchange Management Console) on Exchange 2007 to manage email addresses without a E-Mail address policy (i.e. custom addresses) the mail attribute of the user isn't updated (as seen on the General tab in ADUC).

    To update the mail attribute of the user you must start ADUC (Active Directory Users and Computers) and modify the attribute to be equal to the primary SMTP address. If you don't do this you can have errors (EventID: 9327/OAL Generator) with the Offline Address Book (OAB) generation and users will be missing in the GAL/AL for Outlook users in cached mode.
    You will also get information about which recipients missing in the Application log of the server building OAB's if you have Medium or higher diagnostic level on the OAL generator.
    Set diagnostic level on OAL generator
    Set-EventLogLevel -Identity "MSExchangeSA\OAL Generator" -Level Medium
    After running a new update of the OAB you will find information like this in the Application log:
    Event Type: ErrorEvent
    Source: MSExchangeSAEvent
    Category: OAL Generator
    Event ID: 9325
    Description:OALGen will skip user entry 'username' in address list '\Global Address List' because the SMTP address '' is invalid. - Default Offline Address Book

    Summary
    Use E-mail policies as much as possible when creating e-mail addresses for the users. If this isn't possible then you must remember to manually enter the mail attribute field in ADUC for the user until Microsoft releases a patch for this error.