Scenario: Currently you have mailboxes that have explicit full access to a shared mailbox. Instead of giving full access permission at the root mailbox level, you want an automated way to define the full access permission to a mail enabled security group. You would like the distribution group populated with those mailboxes who had the explicit full access permission at the root mailbox level and then to remove those users explicit permission at the root mailbox level. What you will be left with is a populated mail enabled security group with full permissions to a shared mailbox.
One of the biggest benefits for this is that you can assign a user as a manager/owner of the distribution group who does not need Exchange permission. They can then modify the membership of the group, thus giving or taking away full permission to other users for the shared mailbox without a call to the help desk.
Solution: The script below will create a mail enabled security group which will be prefixed with ‘grp-‘, add the membership of the group for those users explicitly defined with full access to the shared mailbox and send-as permissions, add the group as having full control to the shared mailbox, and then remove the users explicit full access permission from the shared mailbox.
All you need is to either query, or import from a csv file, a list of shared mailboxes. If you use a csv file, make sure the column header is labeled Name.
#This script replaces a users explicit full access permission to a mailbox with a Mail Enabled Security Group that will have full access permission.
#This script will automatically gather those explicit users with full access permissions and put them into the mail enabled security group.
#This script give also make a specific user managedby permissions for the group.
#Import service accounts from CSV
$SvcMbx = Import-csv C:tempsvcmbx.csv
#Loop through each Service Mailbox
$SvcMbx | %{
#Define Variables
$N = $_.Name
$g = "GRP-"+$N
Write-Host "Now starting this service mailbox:$N"
#Gather FullMailbox permission with Explicit Access
$explicitmembers = (Get-MailboxPermission $N | Where {($_.IsInherited -eq $false) -and ($_.User -notlike '*Authority*') -and ($_.AccessRights -like "FullAccess")}).user
#Create the Mail Enabled Security Group and add the manager(s) of the group. Then lock the group down so it cannot accept messages except from the manager.
Write-Host "Creating the AD Universal Security Group"
New-ADGroup -name $g -GroupScope Universal -Path "OU=TestGroups,DC=domain,DC=com" -DisplayName $g
Write-Host "Waiting for Replication"
Sleep 30
Write-Host "Provision the AD group as a Mail enabled Security Group"
Enable-DistributionGroup $g
Write-Host "Waiting for Replication"
Sleep 30
Write-Host "Configuring the Mail Enabled Security Group:$g"
Set-distributionGroup $g -managedby "jdoe1" -bypasssecuritygroupmanagercheck -acceptmessagesonlyfrom "jdoe1"
#Populate the explicit mailboxes that have permission to the service mailbox to the new mail enabled distribution group
Write-Host "Populating the Mail Enabled Security Group: Group:$g"
$explicitmembers | %{
Add-DistributionGroupMember $g -member $_.RawIdentity -bypasssecuritygroupmanagercheck
}
#Add the mail enabled security group to the service mailbox with full permission and automapping set to false
Write-Host "Adding $g with Full Permission and Send As permission to $n"
Add-mailboxpermission $n -user $g -accessrights fullaccess -automapping $false
Add-ADPermission $n -user $g -extendedRights 'Send-As'
#Remove the users explicit access to the service mailbox
Write-host "Removing the users Explicit access to $n"
$explicitmembers | %{
Remove-mailboxPermission $n -user $_.RawIdentity -accessrights FullAccess -confirm:$false
}
}
Ex-Shell 