Find the Number of Users Assigned to Your Per-User Policies
A koan is a riddle used by Zen Buddhists to help focus the mind during meditation and, with any luck, to help the initiate develop intuitive thinking. Some of the more famous Zen koans include:
- "Two hands clap and there is a sound; what is the sound of one hand?"
- "What is Buddha?" Dongshan said, "Three pounds of flax."
- "What is the meaning of the ancestral teacher's coming from the west?" Zhaozhou said, "The cypress tree in front of the hall."
- "Does a dog have Buddha nature or not?" Zhaozhou said, "Wú!"
Note. You know, you’re right: some of those koans do make about as much sense as most technical documentation, don’t they?
Um, not our technical documentation, mind you.
There’s also this somewhat lesser-known koan:
“You create several per-user policies in Microsoft Lync Server 2010. How do you know if all, or even any, of these policies are actually being used?”
Wú!
That’s actually a valid question: what’s the point of creating, and managing, scores of per-user Lync Server policies if you never even use those policies? But how in the world can you tell whether or not any of your per-user policies have actually been assigned to a user (or two)?
As it turns out, it’s pretty easy to determine how many users have been assigned a particular per-user policy. For example, this command returns the number of users who have been assigned the voice policy RedmondVoicePolicy:
(Get-CsUser –Filter {VoicePolicy –eq "RedmondVoicePolicy"}).Count
That’s cool, but what if you have a whole bunch of per user voice policies. Do you have to repeat the preceding command time after time after time, running one command per voice policy? As a matter of fact, you do.
Well, unless you run this script instead:
$identities = @()
$policies = Get-CsVoicePolicy -Filter "tag:*" | Select-Object Identity
foreach ($i in $policies)
{
$x = $i.Identity
$x = $x -replace "Tag:",""
$identities += $x
}
foreach ($policy in $identities)
{
$policy
(Get-CsUser -Filter {VoicePolicy -eq $policy}).Count
}
This is actually a fairly simple little script. (Yes, we know. But in PowerShell, looks can be deceiving.) What we’re doing here is first creating an empty array named $identities; that’s what the command $identities = @() does. We then use Get-CsVoicePolicy and the –Filter parameter to return all the voice policies that have an Identity that begins with the string value tag: ; as you well know, any voice policy that has an Identity that begins with tag: is a per-user policy.
Note. You say you didn’t know that? Then you need to read the article All About Identities .
After we return all the per-user voice policies, we set up a foreach loop that strips the Tag: prefix off each Identity; once we’ve done that we can then use Get-CsUser and the –Filter parameter to return the number of users who have been assigned each policy. For example, suppose we have three per-user voice policies:
- Tag:RedmondVoicePolicy
- Tag:DublinVoicePolicy
- Tag:TokyoVoicePolicy
After stripping off the prefix, we’re left with these policy Identities:
- RedmondVoicePolicy
- DublinVoicePolicy
- TokyoVoicePolicy
And then, for all intents and purposes, we end up running these three commands:
(Get-CsUser -Filter {VoicePolicy -eq "RedmondVoicePolicy").Count
(Get-CsUser -Filter {VoicePolicy -eq "DublinVoicePolicy").Count
(Get-CsUser -Filter {VoicePolicy -eq "TokyoVoicePolicy").Count
Which, in turn, gives us back information similar to this:
RedmondVoicePolicy
9
DublinVoicePolicy
1
TokyoVoicePolicy
144
As you can see, the Tokyo policy has been assigned to a ton of users; the other two policies are less-widely used.
Of course, this particular script works only for voice policies. What if you’d like to return this same information for, say, client policies? That’s fine: just search for each instance of VoicePolicy and replace it with ClientPolicy. Give it a try and see what happens.
Hey, guess what: we’re pretty sure we hear one hand clapping out there! Thank you, thank you very much.