Well, here’s how to do it:

Get SiteID: https://tenant.sharepoint.com/teams/site/_api/site/id

The response is something like: <d:Id xmlns:d=”http://schemas.microsoft.com/ado/2007/08/dataservices“ xmlns:m=”http://schemas.microsoft.com/ado/2007/08/dataservices/metadata“ xmlns:georss=”http://www.georss.org/georss“ xmlns:gml=”http://www.opengis.net/gml“ m:type=”Edm.Guid“>aa6733a3-1d04-4db4-b35c-9ee5674c3004</d:Id>

Get siteURL from ID: https://tenant.sharepoint.com/_api/SP.Site.GetUrlById(guid’aa6733a3-1d04-4db4-b35c-9ee5674c3004′)

The response will be like:

<d:GetUrlById xmlns:d=”http://schemas.microsoft.com/ado/2007/08/dataservices“ xmlns:m=”http://schemas.microsoft.com/ado/2007/08/dataservices/metadata“ xmlns:georss=”http://www.georss.org/georss“ xmlns:gml=”http://www.opengis.net/gml“>https://tenant.sharepoint.com/teams/site</d:GetUrlById>

Enjoy!

You used to call the number 058, later 958 and get a lady saying: “At the next signal, the time will be exactly <time>”

OK, so I though, how can I implement this in my VoIP setup.

So, here goes:

Requirements:

• An already existing PBX where we will create the extension 958 that we can call
• A Linux machine running Asterisk

Here are the configs, supposing that you already have the Linux machine up and running. In this setup I used Ubuntu 26.04 on ARM:

Install Asterisk

sudo apt update
sudo apt install -y asterisk asterisk-modules asterisk-config

Enable and start Asterisk

sudo systemctl enable –now asterisk
sudo systemctl status asterisk

and verify Asterisk CLI is running: sudo asterisk -rvvvvv

Connected to Asterisk 22.5.2~dfsg+~cs6.15.60671435-1 currently running on asterisk-time (pid = 3022)

Connect to your PBX extension

sudo nano /etc/asterisk/pjsip.conf 

[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060

[yeastar-auth]
type=auth
auth_type=userpass
username=958
password=YOUR_EXTENSION_958_PASSWORD

[yeastar-aor]
type=aor
contact=sip:PBXIP:5060

[yeastar-endpoint]
type=endpoint
transport=transport-udp
context=from-yeastar
disallow=all
allow=alaw
allow=ulaw
aors=yeastar-aor
outbound_auth=yeastar-auth
from_user=958
from_domain=PBXIP
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes

[yeastar-identify]
type=identify
endpoint=yeastar-endpoint
match=PBXIP

[yeastar-reg]
type=registration
transport=transport-udp
outbound_auth=yeastar-auth
server_uri=sip:PBXIP:5060
client_uri=sip:958@PBXIP
contact_user=958
retry_interval=30
expiration=300
forbidden_retry_interval=30
auth_rejection_permanent=no

RELOAD ASTERISK

sudo asterisk -rx “pjsip reload”
sudo asterisk -rx “pjsip send register yeastar-reg”
sudo asterisk -rx “pjsip show registrations”

The registration should look like:

<Registration/ServerURI…………………………> <Auth………………..> <Status…….>
==========================================================================================

yeastar-reg/sip:PBXIP:5060 yeastar-auth Registered (exp. 558s)

Objects found: 1

EDIT THE EXTENSIONS (basically the “person” who will speak the time”)

sudo nano /etc/asterisk/extensions.conf

[from-yeastar]
exten => 958,1,Answer()
same => n,Wait(1)
same => n(loop),Playback(at-tone-time-exactly)
same => n,Wait(1)
same => n,PlayTones(1000/250)
same => n,Wait(1)
same => n,StopPlayTones()
same => n,SayUnixTime(,Europe/Bucharest,H)
same => n,Wait(0.3)
same => n,SayUnixTime(,Europe/Bucharest,M)
same => n,Playback(minutes)
same => n,SayUnixTime(,Europe/Bucharest,S)
same => n,Playback(seconds)
same => n,Wait(3)
same => n,Goto(loop)

exten => s,1,Goto(958,1)

then reload the dialplan:

sudo asterisk -rx “dialplan reload”

There you go! Now just dial 958 from any phone on the PBX and enjoy the old times

So, let’s start with:

1. Hardware

1 x vCPU

2 GB of RAM

128 GB Storage

2. Software and configs

• OS: Ubuntu Server 24.04.3 LTS
• IceCast

sudo apt update
sudo apt -y upgrade
sudo apt install -y icecast2

• enable IceCast daemon

sudo nano /etc/default/icecast2

ENABLE=true

• verify settings on IceCast’s main config file

sudo nano /etc/icecast2/icecast.xml

• Start Icecast + enable on boot

sudo systemctl enable –now icecast2
sudo systemctl status icecast2 –no-pager

• Open the IceCast web page

From your PC browser:

http://YOUR_SERVER_IP:8000/

Admin page:

http://YOUR_SERVER_IP:8000/admin/

user: admin

password: whatever you set as <admin-password>

• Create the music folder + IceCast user

sudo adduser –system –group –no-create-home icecast

sudo mkdir -p /srv/radio/music
sudo chown -R icecast:icecast /srv/radio

sudo systemctl restart icecast2

• Install Liquidsoap

sudo apt update
sudo apt install -y liquidsoap

Test install using: liquidsoap –version

• Create the Radio script

sudo nano /srv/radio/radio.liq

Config sample:

set(“log.stdout”, true)
set(“log.level”, 3)

# Folder-based playlist
music = playlist(
“/srv/radio/music”,
mode=”random”,
reload=10
)

# Output to Icecast (dial-up safe)
output.icecast(
%mp3(
bitrate=24,
samplerate=22050,
stereo=false
),
host=”localhost”,
port=8000,
password=”SOURCE_PASSWORD_HERE”,
mount=”/low.mp3″,
music
)

You can test the config manually: liquidsoap /srv/radio/radio.liq and you should see an output like:

Connecting mount /low.mp3
Source connected

Add / remove music (live, no restart)

Just copy files into:

/srv/radio/music

• Run Liquidsoap automatically (systemd service)

sudo nano /etc/systemd/system/radio.service

[Unit]
Description=Icecast Radio (Liquidsoap)
After=network-online.target icecast2.service
Wants=network-online.target

[Service]
User=icecast
Group=icecast
ExecStart=/usr/bin/liquidsoap /srv/radio/radio.liq
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

Then enable it using:

sudo systemctl daemon-reload
sudo systemctl enable –now radio.service

• Confirm the stream is LIVE on Icecast

curl -I http://127.0.0.1:8000/low.mp3

You want to see HTTP/1.0 200 OK (or 200).

From your PC:

Open: http://YOUR_SERVER_IP:8000/low.mp3 in VLC or browser.

• Install an HTML audio player page

sudo apt install -y apache2
sudo ufw allow 80/tcp

sudo nano /var/www/html/player.html

<!doctype html>
<html>
<head>
<meta charset=”utf-8″>
<title>DialRadio</title>
</head>
<body>
<h1>DialRadio (24 kbps)</h1>

<audio controls preload=”none”>
<source src=”http://VM_LAN_IP:8000/low.mp3″ type=”audio/mpeg”>
Your browser does not support audio.
</audio>

<p>Click Play to start the stream.</p>
</body>
</html>

• Apache Redirects

Goal: to redirect from: http://<your server IP> to: http://<your server IP>/player.html

sudo nano /etc/apache2/sites-available/000-default.conf

Inside <VirtualHost *:80>, add:

RedirectMatch ^/$ /player.html

Example:

<VirtualHost *:80>
DocumentRoot /var/www/html

RedirectMatch ^/$ /player.html
</VirtualHost>

Save and restart:

sudo systemctl restart apache2

Now enjoy listening to your own radio station by accessing: http://<your server IP> !

Using PnP:

Connect-PnPOnline -Url https://pbnet.sharepoint.com/teams/ASSETS1 `
  -ClientId "dfbd77ff-be64-XXX-XXX-17a62a02fd29" `
  -Tenant "pbnet.onmicrosoft.com" `
  -CertificatePath "C:\SPOPNP\pnpappcert.pfx" `
  -CertificatePassword (ConvertTo-SecureString "XXXXXXXXXX" -AsPlainText -Force)

$Web = Get-PnPWeb
$Web.Lists.EnsureSiteAssetsLibrary()
Invoke-PnPQuery

Using CSOM (no MFA):

Add-Type -Path "C:\CSOM\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\CSOM\Microsoft.SharePoint.Client.Runtime.dll"
 
 
# SharePoint site and credentials
$siteUrl = "https://a830edad9050849testasset.sharepoint.com/sites/SITEASSETS1"
$username = "admin@a830edad9050849testasset.onmicrosoft.com"
 
# Get credentials
$securePassword = Read-Host -Prompt "Enter your password" -AsSecureString
$credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $securePassword)
 
# Connect to SharePoint
$context = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl)
$context.Credentials = $credentials
 
# Get the list and root folder
$t = $context.Web.Lists.EnsureSiteAssetsLibrary()
$context.Load($t)
 
$context.ExecuteQuery()

Using CSOM with MFA (you can use my DLL set from: https://www.pbnet.ro/tools_dl/CSOM-27JAN2020.zip

#Loading Assemblies
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.SharePoint.Client.dll")
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.SharePoint.Client.Runtime.dll")
[System.Reflection.Assembly]::LoadFile("C:\CSOM\\Microsoft.SharePoint.Client.Publishing.dll")
#download https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/3.19.8 
[System.Reflection.Assembly]::LoadFile("C:\CSOM\Microsoft.IdentityModel.Clients.ActiveDirectory.dll")
#download https://www.nuget.org/packages/SharePointPnPCoreOnline/3.26.2010
[System.Reflection.Assembly]::LoadFile("C:\CSOM\OfficeDevPnP.Core.dll")

$siteURL="https://pbnet.sharepoint.com/teams/ASSETS1"
 $authManager = new-object OfficeDevPnP.Core.AuthenticationManager;
$context = $authManager.GetWebLoginClientContext($siteUrl);

# Get the list and root folder
$t = $context.Web.Lists.EnsureSiteAssetsLibrary()
$context.Load($t)
 
$context.ExecuteQuery()

Or, another way to re-provision the Assets library would be by Enabling the WikiPageHomePage feature on the site collection

Using PnP:

#Disable WikiPageHomePage
Disable-PnPFeature -Identity 00bfea71-d8fe-4fec-8dad-01c19a6e4053
#Enable WikiPageHomePage
Enable-PnPFeature -Identity 00bfea71-d8fe-4fec-8dad-01c19a6e4053

Enjoy!

It is clientless because no plugins or client software are required.

Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser.

Below I’m going to discuss how to install Guacamole and it’s TOTP module (aka login with 2FA) on Ubuntu 24.04.3 LTS.

Understanding the pieces:

guacamole-server (aka guacd) = native daemon that speaks RDP/VNC/SSH, must be built from source.

guacamole web app = a .war deployed to Tomcat (we’ll use Tomcat 9).

Auth = we’ll use MariaDB (JDBC extension).
Guacamole 1.6.0 provides the WAR + JDBC extension prebuilt; only guacamole-server is compiled.

Packages & build dependencies

sudo apt update
sudo apt install -y build-essential autoconf automake libtool-bin \
  libcairo2-dev libjpeg-turbo8-dev libpng-dev uuid-dev libssl-dev \
  libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
  libpango1.0-dev libssh2-1-dev libtelnet-dev libvncserver-dev \
  libwebsockets-dev libpulse-dev libvorbis-dev libwebp-dev \
  freerdp3-dev wget curl fonts-dejavu-core

Build and start guacd (guacamole-server 1.6.0)

cd /usr/src
sudo wget https://downloads.apache.org/guacamole/1.6.0/source/guacamole-server-1.6.0.tar.gz
sudo tar xzf guacamole-server-1.6.0.tar.gz
cd guacamole-server-1.6.0

# The systemd dir below is correct for Ubuntu; the FreeRDP flag keeps things lenient.
sudo ./configure --with-systemd-dir=/etc/systemd/system --enable-allow-freerdp-snapshots
sudo make -j"$(nproc)"
sudo make install
sudo ldconfig

# Register and start the service
sudo systemctl daemon-reload
sudo systemctl enable --now guacd
systemctl status guacd --no-pager

Install Java and Tomcat 9 (not Tomcat 10)

Note: Guacamole 1.x targets the javax servlet APIs (Tomcat 9). Tomcat 10 switched to jakarta and isn’t supported yet.

# Java (LTS)
sudo apt install -y openjdk-17-jdk

# Create a dedicated tomcat user
sudo useradd -m -U -d /opt/tomcat -s /bin/false tomcat

# Download & install Tomcat 9 (set the latest 9.0.x available)
TOMCAT_VER=9.0.108
cd /tmp
wget https://dlcdn.apache.org/tomcat/tomcat-9/v${TOMCAT_VER}/bin/apache-tomcat-${TOMCAT_VER}.tar.gz
sudo mkdir -p /opt/tomcat
sudo tar xzf apache-tomcat-${TOMCAT_VER}.tar.gz -C /opt/tomcat --strip-components=1
sudo chown -R tomcat:tomcat /opt/tomcat

# Tell Tomcat where GUACAMOLE_HOME lives
sudo bash -c 'cat >/opt/tomcat/bin/setenv.sh <<EOF
export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
export GUACAMOLE_HOME=/etc/guacamole
EOF'
sudo chmod +x /opt/tomcat/bin/setenv.sh

# Systemd unit for Tomcat 9
sudo tee /etc/systemd/system/tomcat.service >/dev/null <<'EOF'
[Unit]
Description=Apache Tomcat 9
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat
UMask=0007
Environment=CATALINA_BASE=/opt/tomcat
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid
ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now tomcat
systemctl status tomcat --no-pager

Prepare GUACAMOLE_HOME and deploy the 1.6.0 WAR

# Config directories used by Guacamole/Tomcat
sudo mkdir -p /etc/guacamole/{extensions,lib}

# Basic properties so the webapp can reach guacd
sudo tee /etc/guacamole/guacamole.properties >/dev/null <<'EOF'
guacd-hostname: 127.0.0.1
guacd-port: 4822
EOF

# Deploy the 1.6.0 web app
sudo wget -O /opt/tomcat/webapps/guacamole.war \
  https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-1.6.0.war

# Restart Tomcat to unpack the WAR
sudo systemctl restart tomcat

Install MariaDB and the JDBC auth extension

# DB server
sudo apt install -y mariadb-server

# Create DB and user (change the password!)
DB_PASS='ChangeMe_Secure!'
sudo mysql -e "CREATE DATABASE guacamole_db DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;"
sudo mysql -e "CREATE USER 'guacamole_user'@'localhost' IDENTIFIED BY '${DB_PASS}';"
sudo mysql -e "GRANT ALL PRIVILEGES ON guacamole_db.* TO 'guacamole_user'@'localhost'; FLUSH PRIVILEGES;"

# JDBC extension (MySQL/MariaDB flavor)
cd /usr/src
sudo wget https://downloads.apache.org/guacamole/1.6.0/binary/guacamole-auth-jdbc-1.6.0.tar.gz
sudo tar xzf guacamole-auth-jdbc-1.6.0.tar.gz
sudo cp guacamole-auth-jdbc-1.6.0/mysql/guacamole-auth-jdbc-mysql-1.6.0.jar /etc/guacamole/extensions/

# Initialize the schema
cd guacamole-auth-jdbc-1.6.0/mysql
sudo bash -lc "cat schema/*.sql | mysql -u root guacamole_db"

# JDBC driver (Connector/J 8.4 LTS JAR)
sudo wget -O /etc/guacamole/lib/mysql-connector-j-8.4.0.jar \
  https://repo1.maven.org/maven2/com/mysql/mysql-connector-j/8.4.0/mysql-connector-j-8.4.0.jar

# Point Guacamole at the database
sudo tee -a /etc/guacamole/guacamole.properties >/dev/null <<EOF

# --- JDBC auth (MariaDB/MySQL) ---
mysql-hostname: 127.0.0.1
mysql-port: 3306
mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: ${DB_PASS}
# Explicit driver class for Connector/J 8+
mysql-driver: com.mysql.cj.jdbc.Driver
EOF

# Bounce services
sudo systemctl restart guacd tomcat

Log in and secure it

• rowse to: http://<server>:8080/guacamole

• Default admin (created by the schema): guacadmin / guacadmin → change it immediately (Settings → Preferences), then create your own admin and delete guacadmin.

Now, let’s install and the TOTP Module:

Download + verify (from Apache archive)

cd /tmp
curl -fL -o guacamole-auth-totp-1.6.0.tar.gz \
  https://archive.apache.org/dist/guacamole/1.6.0/binary/guacamole-auth-totp-1.6.0.tar.gz
curl -fsSL -o guacamole-auth-totp-1.6.0.tar.gz.sha256 \
  https://archive.apache.org/dist/guacamole/1.6.0/binary/guacamole-auth-totp-1.6.0.tar.gz.sha256

# must say: “guacamole-auth-totp-1.6.0.tar.gz: OK”
sha256sum -c guacamole-auth-totp-1.6.0.tar.gz.sha256

Install the extension jar

tar -xzf guacamole-auth-totp-1.6.0.tar.gz
sudo install -D -m 0644 guacamole-auth-totp-1.6.0/guacamole-auth-totp-1.6.0.jar \
  /etc/guacamole/extensions/guacamole-auth-totp-1.6.0.jar

ls -l /etc/guacamole/extensions

Restart Tomcat (not guacd) and check logs

sudo systemctl restart tomcat
# Confirm GUACAMOLE_HOME and TOTP load:
grep -i 'GUACAMOLE_HOME is' /opt/tomcat/logs/catalina.out | tail -n1
egrep -i 'Extension "TOTP Authentication"|totp' /opt/tomcat/logs/catalina.out | tail -n2

If it loaded, you’ll see something like:

Extension “TOTP Authentication” (totp) loaded.

Enjoy!

So, let’s connect using a self-signed certificate instead.

Here’s how to do it:

1. Create a self-signed certificate:

Note: you need to have the PNP.PowerShell module installed before running the below cmdlets. 

$cert = New-PnPAzureCertificate -OutPfx pnpappcert.pfx -OutCert pnpappcert.cer -CertificatePassword (ConvertTo-SecureString -String "YourStrongPassword" -AsPlainText -Force)

This command creates:

pnpappcert.pfx: the private certificate used by your script

pnpappcert.cer: the public certificate to upload to Entra ID

Note: The password is required later to use the .pfx

2. Register an app in Entra ID 

• Go to: https://entra.microsoft.com
• Navigate to “App registrations” > “New registration”

Fill in:

Name: PnPApp

Supported account types: Single tenant is OK

Redirect URI: Leave blank for now

Click Register

3. Upload the Public Certificate to the App

In the app registration panel:

Go to Certificates & secrets

Choose Certificates (Upload) → Upload pnpappcert.cer

4. Assign API Permissions

• In the app registration:

  • Go to API permissions

  • Click Add a permission

  • Choose SharePoint > Application permissions

  • Check:

    • Sites.Read.All

    • Sites.FullControl.All (if needed)

  • Click Add permissions

• Then click Grant admin consent

Note: you can grant additional permissions. Here’s a screenshot of what I used:

5. Connect using you certificate and APPId

Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/yoursite" `
  -ClientId "YOUR-APP-ID" `
  -Tenant "yourtenant.onmicrosoft.com" `
  -CertificatePath "C:\Path\To\pnpappcert.pfx" `
  -CertificatePassword (ConvertTo-SecureString "YourStrongPassword" -AsPlainText -Force)

Enjoy!

In a nutshell, this is why it happens:

The long-standing WHOIS system for looking up domain name registration details is coming to an end. Starting January 28, 2025, ICANN will officially replace WHOIS with the Registration Data Access Protocol (RDAP). But don’t worry—this change isn’t happening overnight, and most users won’t notice any immediate disruptions.

RDAP is a modern alternative to WHOIS that offers several improvements:

• better security: it provides more controlled access to domain registration data.
• international support: unlike WHOIS, RDAP supports multiple languages and character sets.
• structured data: it delivers information in a standardized format, making it easier to process.
• more control over data: RDAP allows differentiated access, meaning some users (like law enforcement) may see more details than the general public.

ICANN-accredited registrars and gTLDs have already supported RDAP since 2019, so the transition has been in the works for a while.

Source: https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en

So let’s use the RDAP service.

You will need a RDAP client. Here’s how to install it:

Requirements

• Ubuntu/Debian-based system

• git

• golang (Go language compiler)

Step-by-Step Installation

1. Install Go and Git

This installs Go from Ubuntu repositories. For newer versions, visit: https://go.dev/dl

2. Clone the OpenRDAP repository

3. Navigate to the RDAP CLI source folder

Check that main.go is present:

4. Build the rdap binary

You should now have a binary file named rdap.

Check it’s a proper Linux binary:

Expected output:

5. Move the binary to your PATH

6. Test the RDAP client

IP Network:
  Handle: NET-8-8-8-0-2
  Start Address: 8.8.8.0
  End Address: 8.8.8.255
  IP Version: v4
  Name: GOGL
  Type: DIRECT ALLOCATION
  ParentHandle: NET-8-0-0-0-0
  Status: active
  Port43: whois.arin.net
  Notice:
    Title: Terms of Service
    Description: By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use
    Link: https://www.arin.net/resources/registry/whois/tou/
  Notice:
    Title: Whois Inaccuracy Reporting
    Description: If you see inaccuracies in the results, please visit:
    Link: https://www.arin.net/resources/registry/whois/inaccuracy_reporting/
  Notice:
    Title: Copyright Notice
    Description: Copyright 1997-2025, American Registry for Internet Numbers, Ltd.
  Entity:
    Handle: GOGL
    Port43: whois.arin.net
    Remark:
      Title: Registration Comments
      Description: Please note that the recommended way to file abuse complaints are located in the following links.
      Description: To report abuse and illegal activity: https://www.google.com/contact/
      Description: For legal requests: http://support.google.com/legal
      Description: Regards,
      Description: The Google Team
    Link: https://rdap.arin.net/registry/entity/GOGL
    Link: https://whois.arin.net/rest/org/GOGL
    Event:
      Action: last changed
      Date: 2019-10-31T15:45:45-04:00
    Event:
      Action: registration
      Date: 2000-03-30T00:00:00-05:00
    Role: registrant
    vCard version: 4.0
    vCard fn: Google LLC
    vCard kind: org
    Entity:
      Handle: ABUSE5250-ARIN
      Status: validated
      Port43: whois.arin.net
      Remark:
        Title: Registration Comments
        Description: Please note that the recommended way to file abuse complaints are located in the following links.
        Description: To report abuse and illegal activity: https://www.google.com/contact/
        Description: For legal requests: http://support.google.com/legal
        Description: Regards,
        Description: The Google Team
      Link: https://rdap.arin.net/registry/entity/ABUSE5250-ARIN
      Link: https://whois.arin.net/rest/poc/ABUSE5250-ARIN
      Event:
        Action: last changed
        Date: 2024-08-01T17:54:23-04:00
      Event:
        Action: registration
        Date: 2015-11-06T15:36:35-05:00
      Role: abuse
      vCard version: 4.0
      vCard fn: Abuse
      vCard org: Abuse
      vCard kind: group
      vCard email: network-abuse@google.com
      vCard tel: +1-650-253-0000
    Entity:
      Handle: ZG39-ARIN
      Status: validated
      Port43: whois.arin.net
      Link: https://rdap.arin.net/registry/entity/ZG39-ARIN
      Link: https://whois.arin.net/rest/poc/ZG39-ARIN
      Event:
        Action: last changed
        Date: 2024-11-11T04:27:09-05:00
      Event:
        Action: registration
        Date: 2000-11-30T13:54:08-05:00
      Role: administrative
      Role: technical
      vCard version: 4.0
      vCard fn: Google LLC
      vCard org: Google LLC
      vCard kind: group
      vCard email: arin-contact@google.com
      vCard tel: +1-650-253-0000
  Link: https://rdap.arin.net/registry/ip/8.8.8.0
  Link: https://whois.arin.net/rest/net/NET-8-8-8-0-2
  Event:
    Action: last changed
    Date: 2023-12-28T17:24:56-05:00
  Event:
    Action: registration
    Date: 2023-12-28T17:24:33-05:00
  cidr0_cidrs:
    v4prefix: 8.8.8.0
    length: 24

Connect-PnPOnline -Url https://mngenvmcap495437.sharepoint.com/sites/RETENTION-TEST1 -UseWebLogin
$items = Get-PnPListItem -List "Documents"

foreach ($item in $items)

{

     Set-PnPListItem -Identity $item.Id -List "Documents" -ClearLabel

}

Enjoy!

• You go to a SharePoint document library, click on the ellipsis next to a file and select “Copy Link”

• you will get a URL like: https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh

OK, now for the funny part, how can you know from that URL, what the file name is and where it is located.

If you use my tool: https://whois.pbnet.ro/SPOLINKDECODER/ you can already get some basic information like:

For more information about the tool and what’s its logic, please see my GitHub page: https://github.com/pbnet/SharePointSharedLinkDecoder

Now here’s how to get way more information:

• Using Graph Explorer: https://developer.microsoft.com/en-us/graph/graph-explorer

1. Ensure that you have the Files.ReadWrite.All permission

2. Encode your URL in Base64 using the following PowerShell script:

$sharingUrl = "https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh"
$base64Value = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sharingUrl))
$encodedUrl = "u!" + $base64Value.TrimEnd("=").Replace("/", "_").Replace("+", "-")
Write-Host $encodedUrl

The result will be something like: u!aHR0cHM6Ly9wYm5ldC5zaGFyZXBvaW50LmNvbS86Yjovcy9CTEFCTEExL0VYWkQ0blFFUUVwTHYycFBsLWJ0Wm5rQjNGcktVWWJQN2pYQ0V2ZWVZX1dmWUE_ZT1oSkNjV2g

3. Go to Graph Explorer at: https://developer.microsoft.com/en-us/graph/graph-explorer

The syntax of the URL should be like:

https://graph.microsoft.com/v1.0/shares/<base64 shared link from PowerShell Script>/driveItem?$expand=children

So the final URL is like: https://graph.microsoft.com/v1.0/shares/u!aHR0cHM6Ly9wYm5ldC5zaGFyZXBvaW50LmNvbS86Yjovcy9CTEFCTEExL0VYWkQ0blFFUUVwTHYycFBsLWJ0Wm5rQjNGcktVWWJQN2pYQ0V2ZWVZX1dmWUE_ZT1oSkNjV2g/driveItem?$expand=children

And there you go… you have the weburl, name of the file and name of the library:

• If you want to do this with Graph PowerShell and get the name of the file, the logic is similar to the script below:

Import-Module Microsoft.Graph.Files
Connect-MgGraph -Scopes "Files.ReadWrite.All"


# Set the sharing URL
$sharingUrl = "https://pbnet.sharepoint.com/:b:/s/BLABLA1/EXZD4nQEQEpLv2pPl-btZnkB3FrKUYbP7jXCEveeY_WfYA?e=hJCcWh"
$base64Value = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($sharingUrl))
$encodedUrl = "u!" + $base64Value.TrimEnd("=").Replace("/", "_").Replace("+", "-")

# Construct the Graph API request URL
$requestUrl = "https://graph.microsoft.com/v1.0/shares/$encodedUrl/driveItem?$expand=children"


$response=Get-MgShareDriveItem -SharedDriveItemId $encodedUrl -ExpandProperty "children"

# Output the file details
$response | Format-List

The PowerShell output will be similar to:

Enjoy!

# Define the variables for your enviroment. The first one is the link to your SharePoint Admin Portal. The second one is your administrator account User Principal Name
 
$SPAdminLink = "https://tenant-admin.sharepoint.com"
$AdminUPN = "user@domain.com"
 
# Connect to SharePoint. Replace the link with your SharePoint Admin portal
# you need to have run install-module -name Microsoft.Online.SharePoint.PowerShell to have the module installed. 
 
Connect-SPOService -Url $SPAdminLink
 
# Enable AIP Integration
 
Set-SPOTenant -EnableAIPIntegration $true
(Get-SPOTenant).EnableAIPIntegration
 
# Enable support for PDFs. Update SP Online Module if this fails. The link is https://www.microsoft.com/en-us/download/details.aspx?id=35588
 
Set-SPOTenant -EnableSensitivityLabelforPDF $true
(Get-SPOTenant).EnableSensitivityLabelforPDF
 
# Connect to AAD and enable support for labels in groups. Source: https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide
 
Install-Module AzureADPreview
AzureADPreview\Connect-AzureAD
 
$grpUnifiedSetting = (Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ)
$Setting = $grpUnifiedSetting
 
# Check if EnableMIPLabels is enabled. If nothing is displayed then you have no group settings. We'll enable it. 
 
$grpUnifiedSetting.Values
 
# Enable the feature. If it fails check out this guide: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-settings-cmdlets#create-settings-at-the-directory-level
 
$Setting["EnableMIPLabels"] = "True"
 
# Check that now it's enabled. If it's enabled you'll get
#
#Name                            Value
#----                            -----
#EnableMIPLabels                 True
 
$Setting.Values                                                                                                                                                                                                    
 
# Save 
 
Set-AzureADDirectorySetting -Id $grpUnifiedSetting.Id -DirectorySetting $Setting
 
# Now we'll import ExchangeOnlineManagement and then connect the Compliance Powershell to sync the labels
 
#You might have problems running the below part in PowerShell ISE. If you do, run them in a normal PowerShell session
#Also, ensure you have the module installed with Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName $AdminUPN
Execute-AzureAdLabelSync

Create and publish your label, then wait around 24h to have everything propagated.

If you get any error with the following cmdlet: $grpUnifiedSetting = (Get-AzureADDirectorySetting | where -Property DisplayName -Value “Group.Unified” -EQ) follow the steps in this article: Configure group settings using PowerShell – Microsoft Entra ID | Microsoft Learn

Hint:

Connect-MgGraph -TenantId 0f2434f0-d209-4e5f-9536-2bfb2dd9c2b7 -Scopes Directory.ReadWrite.All

You can get the tenantID from Entra

Enjoy!