I was recently asked to figure out a way to determine which users had cache mode enabled in Outlook 2016 and the end result is the script below.
In order to run the script, you will need to specify the following variables:
$Directory = Insert the exact path of where you would like to save your report ( EX: C:\Reports)
$File = Insert the file name of your report (EX: MyReport.csv)
$ComputerList = Insert the full path of your computer list (EX: C:\Computerlist.txt)
<# .SYNOPSIS Run a report to find who is in Outlook Cache Mode .NOTES File Name : OutlookCachingReport.ps1 Author : Jose Espitia Requires : PowerShell V5 Version : Version 1.00 #> # Specify where to save the report $Directory = "C:\Reports" $File = "MyReport.csv" # Computer list $ComputerList = "C:\ComputerList" $Computers = Get-Content "$ComputerList" ForEach($Computer in $Computers) { Try { # Test connection with computer Test-Connection -ComputerName $Computer -ErrorAction Stop # Query remote machines $HKEY_Users = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey("Users",$Computer) # Get list of SIDs $SIDs = $HKEY_Users.GetSubKeyNames() | Where-Object { ($_ -like "S-1-5-21*") -and ($_ -notlike "*_Classes") } # Associate SID with Username $TotalSIDs = ForEach ($SID in $SIDS) { Try { $SID = [system.security.principal.securityidentIfier]$SID $user = $SID.Translate([System.Security.Principal.NTAccount]) New-Object PSObject -Property @{ Name = $User.value SID = $SID.value } } Catch { Write-Warning ("Unable to translate {0}.`n{1}" -f $UserName,$_.Exception.Message) } } $UserList = $TotalSIDs # Loop through users to determine If they are in cache mode ForEach($User in $UserList) { # Get SID $UserSID = $User.SID # Get list of Outlook profiles $OutlookProfiles = $HKEY_Users.OpenSubKey("$UserSID\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\") # Loop through Outlook profiles to find caching key ForEach($Profile in ($OutlookProfiles.GetSubKeyNames())) { $ProfileKey = $HKEY_Users.OpenSubKey("$UserSID\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\$Profile") # Locate cache key If(($ProfileKey.GetValueNames() -contains "00036601") -eq $True) { $Result = $ProfileKey.GetValue("00036601") # Convert value to HEX $Result = [System.BitConverter]::ToString($Result) # Determine if cache mode is enabled If($Result -like "8*") { $CacheMode = "Enabled" } Else { $CacheMode = "Disabled" } # Create custom table $Table = New-Object PSObject -Property @{ Username = $User.Name SID = $User.SID "Computer Name" = $Computer "Cache Mode" = $CacheMode "Registry Key Value" = $Result } | Select-Object Username, SID, "Computer Name", "Cache mode", "Registry Key Value" # Export table to CSV $Table | Export-Csv -NoTypeInformation -Append -Path "$directory\$file" } } } } Catch { # Create custom table $Table = New-Object PSObject -Property @{ Username = "N/A" SID = "N/A" "Computer Name" = $Computer "Cache Mode" = "N/A" "Registry Key Value" = "N/A" } | Select-Object Username, SID, "Computer Name", "Cache mode", "Registry Key Value" # Export table to CSV $Table | Export-Csv -NoTypeInformation -Append -Path "$directory\$file" } }
Feel free to leave questions in the comments!
Riley
Hi Jose, your script is very good. I’m finding that I don’t have the 00036601 key; however, so I suspect that 0365 has a different one. Do you happen to know what would be it’s equivalent? Thank you so much!
Jose Espitia
I am currently only managing the MSI version of Office 2016 so I’m not sure. I would still try adding the keys in the post to see if it resolves the search issue.
Michael Dickson
Excellent script Jose, just what I was looking for. Question for you do you need a certain format for the computer list file? I am receiving a csv file with no information?
Jose Espitia
Michael,
I used a text file but you can definitely use a CSV by using some of the native CSV cmdlets in PS. Let me know if you need any assistance 🙂
Arthur
Hi Jose,
I hope your script is bringing me closer to a needle in the haystack:
Do you know a way to find out who has altered the default slider (12 months) via one of these registry values?
I know how to set a default via GPO, but “management” wants an overview first
Jose Espitia
Have you tried modifying the default slider with ProcMon turned on? That should tell you which registry keys were modified.
Brian
Do you have a version for Outlook 2010? Or how to modify it for Outlook 2010? We still have several computers running Outlook 2010. Working on getting them all on 2016 or O365 soon.