Category Archives: Powershell

Automation, OneDrive for Business, Powershell, Sharepoint Online

Monitoring and fixing Onedrive client sync health

Leave a comment

Onedrive for Business is most user’s gateway to cloud storage in Microsoft 365.

But sync errors are still a daily issue, and sometimes get worse when e.g. running virtualized (max 100k items), hitting large folders, long paths, or running locally with lots of syncs (max 1m items on preview).

Onedrive does not have a PS module or online console to monitor which users are stuck. Some approaches have been posted by the community, e.g:

  • my and Rudy’s solution from ~2020 monitoring the sync state log file that can lag for days.
  • Custom libraries that have dependencies and don’t remediate
  • Reading the registry by Kelvin (no remediation, more a counter when you’re near a threshold)
  • Microsoft’s sync dashboard as described by Florian (no remediation, lagged and very basic detection)

As I was seeing lots of stuck clients on AVD when users were adding links to Onedrive, I wanted to find a faster and more reliable method of detecting sync issues.

And why stop there? Remediation is around the corner… 🙂

So with Claude I went hunting and found a hook in the Windows 11 storage provider status API / cldapi.dll

This show the status and ability to hydrate files on demand, and progress.

Moving to remediation, it’s a fairly simple matter to monitor sync status and progress, and TEST a single small file hydration. If that is failing, Onedrive is stuck and needs a restart. For us, this has fixed a lot of stuck onedrive clients underneath RemoteApps in AVD 🙂

Links:

View and Remediate (Intune): https://github.com/jflieben/assortedFunctionsV2/blob/main/O4B/remediate-OneDriveHydration.ps1

View and Remediate (GPO/logon): https://github.com/jflieben/assortedFunctionsV2/blob/main/O4B/repair-OneDrive.ps1

EntraID, Identity, Powershell

Managed Sites.Selected permissions

Leave a comment

Of course you did not give your service principal or managed identity Sites.ReadWrite.All right? Right?

Ok, well, if you did, I can imagine, since there is no GUI for it and having to look up site ID’s, MI/SPN’s GUID’s and then executing Graph queries is quite the hassle!

So I added a small feature to SPNRoleMgr that makes this a 100% GUI workflow directly in your browser (no installs, no dependencies!).

/tools was built mainly for myself, but you are more than welcome to use it to make your life easier (and please get rid of sites.readwrite.all!)

Automation, DriftMaester, LCToolkit, Office 365, Powershell, Sharepoint Online

DriftMaester 1.3.0

Leave a comment

With Maester 2.2, we now finally have Sharepoint support and tests! And of course much more, but that’s what stood out most to me. (legacy active directory just makes me feel dirty).

So, DriftMaester also needs to handle these new permissions and has the new pnp module dependency! Time to update 🙂

DriftMaester auto updates, but it doesn’t have permissions to increase its own permissions. So, for whoever wants to leverage the new tests, run this quick oneliner in Azure Shell!

iex ((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/jflieben/DriftMaester/main/Update-DriftMaesterPermissions.ps1').Content)

You can also run the full GUI again as it is a fully idempotent install (overwrite without delete): 

iex ((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/jflieben/DriftMaester/main/Install-DriftMaester.ps1').Content)

The full changelog of 1.2.0 to 1.3.0 is:

  • SharePoint Online support: the installer grants the managed identity the SharePoint Sites.FullControl.All application role, and the invoke runbook connects PnP.PowerShell to the tenant admin endpoint with that managed identity so the Maester SharePoint Online tests run unattended.
  • Reports now lead with the number of passed tests instead of the score percentage as this is more valueable when new tests are added
  • Fixed the ORCA tests failing with “Cannot find type [PolicyInfo]”. Maester is now imported at script scope in the invoke runbook, because its manifest loads the ORCA class definitions through ScriptsToProcess, which only defines them in the scope that called Import-Module.
  • The installer now reuses the Azure sign-in for Microsoft Graph by passing an Az-issued Graph token to Connect-MgGraph, so the admin signs in once instead of twice.
  • Centralized permissions and added a permissions reconciliation script (Update-DriftMaesterPermissions.ps1) that automatically adds new permissions and can be executed lightweight in Azure Shell
Automation, EntraID, Exchange Online, Office 365, PowerApps, Powershell, Security

M365AutoRevocate

Leave a comment

Offboarding has always been an interesting case, and one I rarely see customers do 100% right. The will is there, often focused on keeping access to data or reclaiming licenses.

But execution is a whole different world. Automation for onboarding often exists, offboarding rarely, and if it exists, it is usually still triggered manually, and more often than not only for managed accounts (admins, guests, service accounts etc are totally forgotten), and then what is actually done upon offboarding?

Microsoft Graph has an option to subscribe to changes, specifically for user objects. This means we can listen to deactivation, idle (x days inactive) or deletion events and act accordingly. E.g. unshare onedrive, notify a manager of flows and powerapps or teams the user still owns, reclaim licenses, disable upon inactve, etc etc.

So I co-wrote a little PowerShell solution, of course perfectly based on best practises around MI auth, least privileges and assume breach.

It lets you configure WHAT (loads of things, expandable) to do WHEN (inactive, delete, deactivate), and runs at almost no cost in your own azure subscription, as usual, open source and a oneliner to install: https://github.com/jflieben/M365AutoRevocate

Automation, Azure DevOps, DriftMaester, EntraID, Powershell, Security

DriftMaester 1.2.0

Leave a comment

A nicer installer!

And more changes:

  • Installer hardening: storage security baseline, lifecycle retention policy, root-elevation cleanup by object id, access report output, and optional RunNow workflow.
  • Invoke runbook reliability: token refresh before post-processing, report-delivery modes, severity gating, failure notifications, retention cleanup, summary blobs for trend reads, and optional Teams webhook notifications.
  • Update runbook reliability: target runtime resolution now stays scoped to driftmaester runtime and adds Maester dependency compatibility auto-bump behavior.
  • Added Remove-DriftMaester uninstaller script for full or scoped cleanup.