Extract users from AD group and add them to Mailbox

Question

I want to make a powershell script to extract an AD group and add the members to a specific mailbox. In that group is a group that i dont want to extract (doNotExtract). That is what i have so far:

Import-Module ActiveDirectory
$csv = @"
Mailbox,GroupName
Mailbox1,Group1
"@ | ConvertFrom-Csv

$ExcludedUsers = Get-ADGroupMember -Identity "doNotExtract" -Recursive | Select-Object -ExpandProperty SamAccountName

$csv | ForEach-Object {
    $mailbox = $_.Mailbox

    Get-ADGroupMember -Identity $_.GroupName -Recursive |

    Where-Object { ($ExcludedUsers -notcontains $_.SamAccountName) -and ($_.objectclass -eq 'user') } |
    ForEach-Object {
        Add-MailboxPermission -Identity $mailbox -User $_.SamAccountName -AccessRights FullAccess -InheritanceType All
    }
}

In the AD group are the following objects:

doNotExtract
User1
User2

I then start the script in the exchange management shell. But then it adds only User1 and User2 doesnt gets fullaccess on Mailbox1.

And i cant find the problem in the script...

Mmmm sometimes i should just make a break and look at it again :3 As you said "User2" IS in the group "doNotExtract". Thanks! — Gaterde, Mar 03 '17 at 11:23

score 1 · Accepted Answer · answered Mar 03 '17 at 11:30

1

In this case, the error was that the User2 was also in the donotextract group.

answered Mar 03 '17 at 11:30

4c74356b41

69,186
6
100
141

score 0 · Answer 2 · edited Mar 03 '17 at 11:55

0

I have experienced with Exchange Online that using SamAccountName doesn't always work smoothly. Have you tried using UserPrincipalName as input for Add-MailboxPermission instead of SamAccountName?

I was also wondering why you extract members of an AD group and give them full access to a mailbox? Why don't you instead give the AD group itself full access to the mailbox?

edited Mar 03 '17 at 11:55

Mark Wragg

22,105
7
39
68

answered Mar 03 '17 at 10:41

because he doesn't want group inside that group to have access?? – 4c74356b41 Mar 03 '17 at 10:44
Azure isnt able to import ad groups... So when I want to move exchange to azure I have to do it this way :( But thanks for the tip. I'll try it :) – Gaterde Mar 03 '17 at 11:18

score 0 · Answer 3 · answered Mar 03 '17 at 11:31

0

As @4c74356b41 mentioned User2 was in the group "doNotExtract". It then doesnt adds him to the Mailbox because this group is excluded.

answered Mar 03 '17 at 11:31

Gaterde

779
1
7
25

Extract users from AD group and add them to Mailbox

3 Answers3