Generate a new secure password with PowerShell

The PowerShell Gallery is a perfect solution to store your own scripts which you use on a regular basis where other people can use them to. In this case I added my script to generate a new secure password with PowerShell where you only need to specify the length required. There are a lot of times where you need to create a new password for example the AD recovery password, SharePoint farm passphrase or just for a user account. The password will have uppercase, lowercase and special characters.

The script can be found at https://www.powershellgallery.com/packages/New-SecurePassword.
I always recommend reading the code first as this is a script from the internet which can be found after clicking on “Show” at “FileList”

You can install the script using the below command

Install-Script -Name New-SecurePassword

Press Y if you want to install the script from the PSGallery where you can then just enter the following command to generate a new secure password with PowerShell.

New-SecurePassword.ps1 -Length 16

The password is readable using Write-Host but also copied directly to the clipboard.

Passwords, PowerShell, Security

PowerShell, Security

Posted on July 31, 2018

Create SharePoint service accounts with PowerShell

There are a few of these scripts around to create SharePoint service accounts with PowerShell but I decided to create a new one as SharePoint 2019 is coming with a bit more functionality and error handling.
A good blog about the different service accounts needed can be found at https://absolute-sharepoint.com/2017/03/sharepoint-2016-service-accounts-recommendations.html
The general recommendation in this blog is to use different service accounts for each environment which can be easily done with this script.

Using the script

The script needs the activedirectory module to function correctly.
Please install the Active Directory management tools to be able to use this module.
I recommend running this script on the domain controller or a management server with sufficient permissions.

PowerShell Gallery

The script has been uploaded to the PowerShell Gallery.
Start PowerShell as an administrator on a server/computer and run the following command:

Install-Script -Name Add-ServiceAccounts

Press Y if you want to add the default imported scripts location to the PATH environment variable.

Press Y to install and import the NuGet provider now as this is a “clean” server installation.

Press Y to install the scripts from the PSGallery and the script will be saved on the default location C:\Program Files\WindowsPowerShell\Scripts.
I always recommend first reading through the .ps1 file if you haven’t already read it at the PowerShell Gallery page.

You can now run the following command to create the service accounts:

Add-ServiceAccounts -OU "OU=Service Accounts,OU=SPFire,DC=sharepointfire,DC=com" -UPNSuffix "SharePointFire.com" -Prefix "SA_SP2019" -LogPath "C:\Install"

The service accounts have been created in the specified location

You can also verify the log file and add the passwords to your password database.

Copy / Paste

The other option is to just copy and paste the below code in PowerShell as administrator.
Please note that the below script may not be the latest version as the PowerShell Gallery script will always be more updated!
You can add additional users easier this way by simply updating the $Accounts variable with more users.

<#PSScriptInfo .VERSION 2.3 .GUID a8d133a6-dc3b-4dbf-a6f5-1ea8abcbb7bd .AUTHOR Maarten Peeters - SharePointFire - https://sharepointfire.com .COMPANYNAME SharePointFire .COPYRIGHT .TAGS SharePoint, Active Directory, Service Accounts .LICENSEURI .PROJECTURI .ICONURI .EXTERNALMODULEDEPENDENCIES ActiveDirectory .RELEASENOTES Version 1.0: Original published version. Version 2.0: Removed function Version 2.1: Changed Admin to Install Version 2.2: Fixed A positional parameter cannot be found that accepts argument Version 2.3: Fixed A positional parameter cannot be found that accepts argument #> 

<# .SYNOPSIS Simple Function to create needed SharePoint service accounts .DESCRIPTION Simple Function to create needed SharePoint service accounts. Each service account will receive an unique password. .PARAMETER OU Enter the full path to the OU where to add the service accounts. For example: OU=Service Accounts,OU=SPFire,DC=sharepointfire,DC=com .PARAMETER UPNSuffix Enter the UPNSuffix to be used during creation For example: sharepointfire.com .PARAMETER Prefix Specify the prefix to be used for the service accounts. For example: SA_SP2019 which will create service accounts like SA_SP2019Farm and SA_SP2019Install .PARAMETER LogPath Enter the full path to store a .csv file (; delimited) of the created service accounts with their unique password For example: C:\Install .EXAMPLE Add-ServiceAccounts.ps1 -OU "OU=Service Accounts,OU=SPFire,DC=sharepointfire,DC=com" -UPNSuffix "SharePointFire.com" -Prefix "SA_SP2019" -LogPath "C:\Install" .NOTES Version: 2.3 Author: Maarten Peeters Creation Date: 29-07-2018 Purpose/Change: Fast creation of Service Accounts #>

param(
    [Parameter(mandatory=$true)]
    [string] $OU,
    [Parameter(mandatory=$true)]
    [string] $UPNSuffix,
    [Parameter(mandatory=$true)]
    [string] $Prefix,
    [Parameter(mandatory=$true)]
    [string] $LogPath
)

#Array of accounts to be created. Add names if needed as for example Visio Unattented userID
$Accounts = "Install", "Farm", "Services", "Pool", "MySitePool", "Crawl", "Sync", "C2WTS", "SU", "SR"

try{
    #Verify if Active Directory Module is available
    if (Get-Module -ListAvailable -Name activedirectory) {
        #Import Active Directory Module
        import-module activedirectory -ErrorAction SilentlyContinue

        #Verify if the OU exists
        if(get-adorganizationalunit -Filter { DistinguishedName -eq $OU }) {

            #Test if logpath exists
            If(Test-Path $LogPath) { 
                #Loop through all accounts and create them
                foreach($Account in $Accounts){
                    $Password = ([char[]]([char]33..[char]95) + ([char[]]([char]97..[char]126)) + 0..16 | Sort-Object {Get-Random})[0..15] -join ''
                    New-ADUser -Name "$($Prefix)$($Account)" -SamAccountName "$($Prefix)$($Account)" -DisplayName "$($Prefix)$($Account)" -UserPrincipalName "$($Prefix)$($Account)@$($UPNSuffix)" -Path $OU -Enabled $true -ChangePasswordAtLogon $false -PasswordNeverExpires $true -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -force) -PassThru | out-null
                    $Log += "$($Prefix)$($Account);$($Password) `n"
                }
                $Log | out-file -FilePath "$($LogPath)\SharePointAccounts$((get-date).tostring('sshhMMddyyyy')).csv"
                Write-Host "Accounts created and log located on $($LogPath)" -foregroundcolor green
            } Else { 
                Write-Host "The path $($LogPath) could not be found. Please enter a correct path to store the passwords" -foregroundcolor yellow
            }
        }  else  {
            Write-Host "The OU $($OU) could not be found. Please enter a correct OU to store the accounts" -foregroundcolor yellow
        }
    } else {
        Write-Host "Active Directory module not loaded. Please install Active Directory Management Tools" -foregroundcolor yellow
    }
}
catch{
    write-host "Error occurred: $($_.Exception.Message)" -foregroundcolor red
}

You will need to enter the parameters used for this script.

And these accounts will also be created correctly

With their unique passwords

Active Directory, Service Accounts, SharePoint

Active Directory, PowerShell, SharePoint

Posted on July 30, 2018

SharePoint Online site provisioning using Microsoft Flow, Azure Functions and Azure Storage Queue

A while back I created a provider hosted app using CSOM in C# for creating project sites but this required the users to have sufficient permissions to create a site. Using Microsoft Flow, Azure Function, Azure Storage Queue, PowerShell and SharePoint Online I created a proof of concept with the latest techniques and using the AppId/AppSecret so the user doesn’t need additional permissions. This solution isn’t free as it needs an Azure Subscription but the costs are minimal. Please find references to Microsoft in the summary at the end.

This article describes the following scenario:

The user creates an item in a SharePoint list.
Microsoft Flow will be triggered on item creation.
Microsoft Flow will add a message on the Azure Storage Queue.
The Azure Function will monitor the Azure Storage Queue and create the subsite based on the values entered in the SharePoint list using PowerShell.

This article has the following chapters:

Create SharePoint List
Get and register AppId and AppSecret in SharePoint Online
Create Azure Storage Queue
Create Azure Function
Create PowerShell Script
Test Azure Storage Queue
Create Microsoft Flow

Create SharePoint List

First we are going to create a list in SharePoint which we are going to use for our site metadata.

Add an App

Custom List

Create

Add the below columns:

SiteURL –> Single line of Text
SiteTemplate –> Choice
SiteLanguage –> Choice

The list has been created which we are going to use for our site provisioning.

Get AppId and AppSecret in SharePoint Online

It is possible to use a username and password for the Azure Function but it is also possible to use an AppId and AppSecret for impersonation.
In this scenario we are going to use an AppId and AppSecret.

Go to the site collection where you want to register the app by appending the url with “_layouts/15/appregnew.aspx”

Fill in the above information and click on create

Save the Client Id and Secret as we are going to need it for our Azure Function.
Next append /_layouts/appinv.aspx to the url

With the below Permission Request XML we allow the app access to the site collection. You can specify different levels which are explained at https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/add-in-permissions-in-sharepoint .

<AppPermissionRequests AllowAppOnlyPolicy=”true”>

<AppPermissionRequest Scope=”http://sharepoint/content/sitecollection” Right=”FullControl” />

</AppPermissionRequests>

and click on Create

Trust It

Create Azure Storage Queue

We are going to setup the Azure Storage Queue which will handle all our messages which have been sent using Microsoft Flow.
Please note that this can also be achieved without the Azure Storage Queue as you can directly sent the message to the Azure Function using an Azure HttpTrigger function.

First go to your Azure Dashboard

Storage accounts

Add

Create

Open the newly created storage account

Click on Queues

+ Queue

The Azure Storage Queue has now been created which we use within our Microsoft Flow and Azure Function.

Create Azure Function

The next thing we will build is the Azure Function. The Azure Function will be created based on PowerShell and the SharePointPnPPowerShellOnline module.
We are going to start from the Azure Dashboard.

Go to the App Services

Add

Function App

Create

We are going to use the existing resource group and storage which we created during the Azure Storage Account. Click on Create

Open the newly created Azure Function

New function

Enable Experimental Language Support and navigate to Queue trigger

Click on PowerShell

Enter the queue name we created earlier. And click on New

Select the Azure Storage Account

Create and navigate back to the Platform features

Go to Platform features

Open Advanced tools (Kudu)

Click on Debug Console and then on PowerShell

Navigate to Site –> wwwroot –> QueueTriggerPowerShell

Create a new folder called “modules”

We are going to upload the PowerShell DLL’s which we are going to use here as it is not possible to import-modules from within the Azure Function. You can drag and drop the files to this folder.
The files we need are by default installed in the following location: C:\Program Files\WindowsPowerShell\Modules\SharePointPnPPowerShellOnline

Copy the contents from this folder to the Azure Function.
If you are missing this folder; Install this using PowerShell on the workstation with the command: Install-Module SharePointPnPPowerShellOnline

Also copy the items from the following locations:

C:\Windows\assembly\GAC_MSIL\Microsoft.IdentityModel
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.IdentityModel.Extensions

Go back to the function

Go to the application settings

Select 64-bit and scroll down

Add the AppId and AppSecret with the key to the application settings as we can reference to these settings from the Azure Function.
Save the modification and in the next chapter we will create the PowerShell script.

Create PowerShell Script

Go to the QueueTriggerPowerShell in the Azure Function

Add the below PowerShell code

$requestBody = Get-Content $triggerInput -Raw | ConvertFrom-Json

$ParentSiteUrl = "https://spfire.sharepoint.com/sites/projectsitecreation/"

$WebTemplate = $requestBody.WebTemplate

$SiteTitle = $requestBody.SiteTitle

$SiteDescription = "Site with PowerShell"

$SiteURL = $requestBody.SiteURL

$SiteLanguage = $requestBody.SiteLanguage

$AppId = $env:AppId

$AppSecret = $env:AppSecret

connect-PnPOnline -AppId $AppId -AppSecret $AppSecret -url $ParentSiteUrl

New-PnPWeb -Title $SiteTitle -url $SiteURL -Locale $SiteLanguage -Template $WebTemplate -Description $SiteDescription

Write-Output "PowerShell script processed queue message '$requestBody'"

Click on test in the right corner

Enter the below Request body

{
“WebTemplate”: “STS#0”,
“SiteTitle”: “TestCreation1”,
“SiteURL”: “TestCreation1”,
“SiteLanguage”: 1033
}

and click on Save and run

You can verify the log for success and navigate to the created site

We now know that the PowerShell code is successful.

Test Azure Storage Queue

Go to the Azure Storage Queue to test if adding a message is being successfully processed by the Azure Function.

Add message

OK and you can verify if the Azure function picked up the message if you still have the log open

Or go to the newly created site

We confirmed the Azure Storage Queue with the Azure Function is working correctly.

Create Microsoft Flow

We can now create a Microsoft Flow that will add an message in the Azure Storage Queue which will be picked up by our Azure Function.
Go to https://flow.microsoft.com

Create from blank

When an item is created

And add a new step

Put a message on a queue

Add a new connection if you already had one like me

The Connection Name can be anything where the Storage Account Name and Shared Storage Key can be found in Azure

Save the flow and create a new item in the previous created SharePoint List

Save and first verify the Microsoft Flow

Next verify the Azure Function Log if still open

And last verify if the site has been created

The site has been created successfully.

Summary

We have now created a working site provisioning solution based on a SharePoint list.
This solution uses multiple techniques such as Microsoft Flow, Azure Storage Queues, Azure Functions and SharePoint Online.
This is just an example of working with these techniques but you can for example do more after the site creation such as adding extra permissions and set default columns.
It is possible to do more with Microsoft Flow as for example send an email after creation or update the status during the creation

You can find more information at https://docs.microsoft.com/en-us/sharepoint/dev/declarative-customization/site-design-pnp-provisioning regarding for example an app ID and app secret with administrative rights on your tenant, Microsoft Flow and an Azure function. Costs for an Azure Function are mentioned in https://azure.microsoft.com/en-us/pricing/details/functions and queue costs at https://azure.microsoft.com/en-us/pricing/details/storage/queues/

Information about the SharePoint PnP PowerShell CmdLets can be found at https://github.com/SharePoint/PnP-PowerShell and https://docs.microsoft.com/en-us/powershell/sharepoint/sharepoint-pnp/sharepoint-pnp-cmdlets?view=sharepoint-ps

Please let me know your use case for Azure Functions and if there are any questions.

Azure Function, Azure Queue, Azure Storage Queue, Flow, Microsoft Flow, Office 365, SharePoint Online

Azure, Flow, Office 365, PowerShell

Posted on April 17, 2018

SharePoint Fire

Blog about SharePoint, Office 365 and other ICT related subjects

SharePoint Fire

Menu

Generate a new secure password with PowerShell

Create SharePoint service accounts with PowerShell

Using the script

PowerShell Gallery

Copy / Paste

SharePoint Online site provisioning using Microsoft Flow, Azure Functions and Azure Storage Queue

Create SharePoint List

Get AppId and AppSecret in SharePoint Online

Create Azure Storage Queue

Create Azure Function

Create PowerShell Script

Test Azure Storage Queue

Create Microsoft Flow

Summary

August 2018
M	T	W	T	F	S	S
« Jul
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31