#************************************************************************************
#
#	EVServiceAccountOutlookProfiles.ps1
#
#	On Enterprise Vault servers a high number of Outlook profiles for the EV service
#	account are known to cause MAPI issues connecting to Exchange servers. These
#	profiles can be cleared down at any time as they are recreated as and when EV
#	needs them.
#
#	21.09.2011	JK	v1.0	Initial draft.
#	23.09.2011	JK	v1.1	Added logging.
#
#	This script does the following:
#
#	1. Connects to HKEY_USERS registry hive.
#	2. Resolves each SID to the AccountName looking for a match to svc_evadmin
#	3. Counts the number of profiles which match 'VaultMbxAgent-%'
#	4. Emails if more than 50 Outlook profiles are found.
#
#************************************************************************************

# Do not include 'domain\EV_Service_Account', instead use 'EV_Service_Account'.
$EVServiceAccountName = 'your_service_account'
# Variable for single quote ' , used in WMI command.
$a = [char]39

# Get the folder the script is running from.
$ScriptFullPath = $MyInvocation.MyCommand.Path
$ScriptPath = split-path -parent $ScriptFullPath
# Set Output file path and filename, with today's date.
$LogFile = "$ScriptPath\ServiceAccountOutlookProfiles.log"

$ProfilesPath = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles"

# Connect to HKEY_USERS registry hive.
$null = New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS

# Get child items from HKEY_USERS.
Set-Location HKU:
$HKUItems = Get-Childitem | select Name

Foreach ($HKUItem in $HKUItems) {
	
	# Reset profile count to zero.
	$ProfileCount = 0
	
	# Get the SID without the first 11 characters (HKEY_USERS\).
	$SID = $HKUItem.Name.substring(11)
	
	# Get the last eight characters from the SID so those with _Classes can be excluded.
	$SIDLast8Chars = $Sid.substring($SID.length - 8) 
	
	if ($SIDLast8Chars -ne '_Classes' -AND $SID -ne '.DEFAULT') {
		$SIDAccountName = ([wmi]"win32_SID.SID=$a$SID$a").AccountName 
		
		if ($SIDAccountName -eq $EVServiceAccountName) {
			# Change location into the Enterprise Vault service account SID reg key.
			Set-Location HKU:$SID
			
			# Test to see if the Windows Messaging Subsystem\Profiles exists.
			$ProfilesPathTest = test-path $ProfilesPath -pathType container
			
			if ($ProfilesPathTest -eq $True) {
				
				CD $ProfilesPath
				
				$Profiles = Get-Childitem | select Name
				
				Foreach ($Profile in $Profiles) {
					if ($Profile.Name -like '*VaultMbxAgent*') { 
						$ProfileCount++
						$ProfileNames += $Profile.Name + "<BR>"
					}
				}
				
				$ComputerName = get-content env:computername
				
				$DateTime = get-date -uformat "%Y.%m.%d %H:%M:%S : "
				$LogFileContent = $DateTime + $ComputerName + ' -- ' + $ProfileCount + ' profile(s).'
				Add-Content $LogFile $LogFileContent
				
				if ($ProfileCount -gt '50') {
					$FromAddress = "EV@domain.com"
					$ToAddress = "EVadmin@domain.com"
					$MessageSubject = "Enterprise Vault: $ComputerName has $ProfileCount profiles for svc_evadmin."
					$MessageBody = "These profiles should be cleared down by running mail.cpl as svc_evadmin on $ComputerName.<BR> The number of profiles has a direct link to any problems EV servers are having connecting to Exchange servers. The profiles should be removed, and the EV admin service restarted ont he effected server.<BR><BR>$ProfileNames" 
					$SendingServer = "your_smtp_server"
					$SMTPMessage = New-Object System.Net.Mail.MailMessage $FromAddress, $ToAddress, $MessageSubject, $MessageBody
					$SMTPMessage.IsBodyHtml = $true
					#$SMTPMessage.Attachments.Add($att)
					$SMTPClient = New-Object System.Net.Mail.SMTPClient $SendingServer
					$SMTPClient.Send($SMTPMessage)
					#$att.Dispose()
					
				}
			}
		}	
	}
}
CD \