The wonderful colleague who has succeeded me as the main ActiveRoles Server admin here at Awesome German Auto Parts Manufacturer (awesome.com) ran into trouble last week while trying to find out which user had a proxy address that she was trying to assign. firstname.lastname@awesome.com is not quite as unique as one might think, even in a country with loads of rather long family names, and when a holder of a firstname.lastname@awesome.com leaves, there’s possibly another who would like to have it, and who outsiders are trying to reach at that address.

So my successor cleverly noticed that Get-QADUser has a -ProxyAddress parameter, so tried this on the stubborn address:

Get-QADUser -ProxyAddress "firstname.lastname@awesome.com"

Nothing.

She tried it on her own address, as she was quite sure that one was in there.

Nothing.

Resourceful lady that she is, she started Googling.

Nothing beyond this old Dmitry Sotnikov post: http://dmitrysotnikov.wordpress.com/2010/08/13/manage-email-addresses-without-exchange-cmdlets/

His example shows the address type (in this case, x400) prefix on the searched-for address, but doesn’t state that this is necessary for this parameter to work properly.

Because I’d hit my own wall on Lync emergency calling configuration, I experimentally tried:

Get-QADUser -ProxAddress "smtp:myfirst.mylast@awesome.com"

Result!

Just to check, I tried it without whispering “smtp:“, and…

Nothing.

My colleague verified this, and then reminded me that there was this Exchange quota data-gathering script I’d promised to help with a few weeks ago…

Fun facts about the ProxyAddresses Active Directory attribute and Get-QADUser -ProxyAddress:

– ProxyAddresses is a multi-valued attribute, and -ProxyAddress will search each value in all the ProxyAddresses attributes of ActiveRoles-managed AD objects until it finds all matches.

– Wildcards (“*logonname@awesome.com“) take longer (20 seconds here) than exact matches like “smtp:logonname@awesome.com” (less than a second), but do work. Get-QADUser always returns user objects, and it will return the object only once per query, even if there are several matches within a user’s ProxyAddresses attribute. A wildcard in the middle of the search (“sip:*logonname@awesome.com“) will also work, but takes AGES (2.5 minutes in my environment).

– Since the ProxyAddresses attribute also contain EUM (Exchange UM) and SIP addresses (Lync or other Unified Communications platform), Get-QADUser -ProxyAddress is also useful for finding the source of a collision there. The wildcard is particularly useful here: “*:firstname.lastname@awesome.com” will find all the objects that contain that address, regardless of type.

– It is case-insensitive. That means that it will match both “smtp:firstname.lastname@awesome.com” (a secondary proxy address) and “SMTP:firstname.lastname@awesome.com” (the user’s current primary email address).

– Get-QADUser -PrimaryProxyAddress is picky in exactly the same way: Get-QADUser -PrimaryProxyAddress "firstname.lastname@awesome.com" didn’t work; Get-QADUser -PrimaryProxyAddress "smtp:firstname.lastname@awesome.com" did. The performance differences between wildcard and exact match searches were in line with -ProxyAddress as well.

The following one-liner finds all the users with *.mueller@awesome.com proxy addresses, no matter what type, and makes a flat (String) MatchingAddresses attribute for the ones with more than one match (for example, sip:max.mueller@awesome.com and smtp:max.mueller@awesome.com).

Get-QADUser -ProxyAddress "*.mueller@awesome.com" | select name, @{n="MatchingAddresses";e={($_.proxyaddresses | where { $_ -like "*.mueller@awesome.com"}) -join ';' }}