Home

Difficult to find which distribution group was assigned to which shared mailbox

%3CLINGO-SUB%20id%3D%22lingo-sub-1186852%22%20slang%3D%22en-US%22%3EDifficult%20to%20find%20which%20distribution%20group%20was%20assigned%20to%20which%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1186852%22%20slang%3D%22en-US%22%3E%3CP%3E%3CFONT%3EI%20have%20hundred%20of%20distribution%20groups%20which%20functional%20as%20delegation%20groups%20for%20manage%20full%20access%20and%20send%20as%20permission%20for%20shared%20mailboxes.%20Is%20there%20any%20available%20powershell%20script%20or%20any%20which%20are%20able%20to%3CBR%20%2F%3Efind%20or%20identify%20which%20distribution%20was%20assigned%20to%20which%20shared%20mailbox%3F%20Unfortunately%20from%20the%20original%20available%20exchange%20powershell%20commandlets%20like%20Get-MailboxPermission%20and%20Get-RecipientPermission%20I%20could%20not%20build%20any%20usable%20scripts%20for%20my%20problem.%20May%20I%20should%20use%20Outlook%20Rest%20API%20or%20EWS%20instead%20of%20powershell%20script%3F%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1186852%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1187575%22%20slang%3D%22en-US%22%3ERe%3A%20Difficult%20to%20find%20which%20distribution%20group%20was%20assigned%20to%20which%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1187575%22%20slang%3D%22en-US%22%3E%3CP%3EWell%20what%20constitutes%20a%20%22useful%20script%22%20in%20your%20scenario%3F%20Basically%20you%20have%20to%20iterate%20over%20each%20mailbox%20and%20get%20the%20list%20of%20permissions%2C%20then%20display%20the%20full%20set%20in%20some%20shape%20or%20form.%20Here's%20a%20sample%20script%3A%26nbsp%3B%3CA%20style%3D%22color%3A%20%230066cc%3B%20font-family%3A%20Verdana%2CArial%2CHelvetica%2Csans-serif%3B%20font-size%3A%2010px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20underline%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%20href%3D%22https%3A%2F%2Fwww.quadrotech-it.com%2Fblog%2Foffice-365-permissions-inventory-full-access%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20https%3A%2F%2Fwww.cogmotive.com%2Fblog%2Fpowershell-scripts%2Foffice-365-permissions-inventory-full-access%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1191177%22%20slang%3D%22en-US%22%3ERe%3A%20Difficult%20to%20find%20which%20distribution%20group%20was%20assigned%20to%20which%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1191177%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%2C%20Yes%20I%20know%20this%20solution%20but%20I%20have%20a%20lot%20of%20stale%20delegation%20groups%20and%20need%20to%20know%20exactly%20which%20groups%20are%20in%20still%20used%20and%20have%20function%20and%20which%20not.%20Maybe%20I%20should%20query%20the%20all%20production%20shared%20mailboxes%20and%20collects%20their%20groups%20in%20a%20csv%20what%20you%20described.%20After%20that%20another%20script%20import%20this%20csv%20and%20would%20check%20data%20and%20create%20new%20csv%20with%20the%20really%20live%20shared%20mailboxes%20and%20their%20groups%2C%20thus%20the%20rest%20are%20the%20stale.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1191369%22%20slang%3D%22en-US%22%3ERe%3A%20Difficult%20to%20find%20which%20distribution%20group%20was%20assigned%20to%20which%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1191369%22%20slang%3D%22en-US%22%3E%3CP%3EWell%20how%20do%20you%20tell%20which%20is%20%22live%22%20and%20which%20is%20%22stale%22%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1192829%22%20slang%3D%22en-US%22%3ERe%3A%20Difficult%20to%20find%20which%20distribution%20group%20was%20assigned%20to%20which%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1192829%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3CFONT%3EWe%20have%20hybrid%20Exchange%20and%20basically%20used%20synced%20AD%20accounts%20and%20synced%20on-premise%20distributiongroups%20(delegation%20groups)%20for%20the%20shared%20mailbox%20setup.%20When%20the%20shared%20mailbox%20and%20its%20AD%20account%20deactivated%20the%20associate%20distribution%20groups%20or%20named%20delegation%20groups%20remained%20and%20were%20not%20deactivated%20as%20the%20shared%20mailbox.%20These%20delegation%20groups%20are%20what%20I%20call%20or%20named%20stale%20delegation%20groups%20and%20there%20are%20hundred.%3CBR%20%2F%3EMy%20basic%20problem%20I%20would%20need%20to%20write%20a%20powershell%20script%20which%20one%20by%20one%20goes%20through%20the%20existing%20synced%20groups%20and%20examines%20whether%20there%20is%20a%20corresponding%20live%20shared%20mailbox.%3CBR%20%2F%3ESo%20I%20would%20need%20the%20complete%20invers%20method%20of%20the%20%22Get-MailboxPermission%20%22primarysmtpaddress%22%20%7C%20where%20%7B((%24_.IsInherited%20-eq%20%24false)%20-and%20(%24_.AccessRights%20-like%20%22*FullAccess*%22)%20-and%20(%24_.User%20-notlike%20%22NT%20Authority%5CSELF%22)%20-and%20(%24_.Deny%20-eq%20%24false))%7D%20%7C%20select%20-expand%20User%22%20and%20%22Get-RecipientPermission%20%22primarysmtpaddress%22%20%7C%20where%20%7B((%24_.IsInherited%20-eq%20%24false)%20-and%20(%24_.AccessRights%20-like%20%22*SendAs*%22)%20-and%20(%24_.Trustee%20-notlike%20'NT%20Authority%5CSELF')%20-and%20(%24_.AccessControlType%20-eq%20'Allow'))%7D%20%7C%20select%20-expand%20Trustee%22%20powershell%20query.%20Actually%20I%20need%20a%20powershell%20query%20where%20the%20input%20should%20be%20the%20primarysmtp%20address%20of%20the%20delagation%20group.%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I have hundred of distribution groups which functional as delegation groups for manage full access and send as permission for shared mailboxes. Is there any available powershell script or any which are able to
find or identify which distribution was assigned to which shared mailbox? Unfortunately from the original available exchange powershell commandlets like Get-MailboxPermission and Get-RecipientPermission I could not build any usable scripts for my problem. May I should use Outlook Rest API or EWS instead of powershell script?

4 Replies
Highlighted

Well what constitutes a "useful script" in your scenario? Basically you have to iterate over each mailbox and get the list of permissions, then display the full set in some shape or form. Here's a sample script:  https://www.cogmotive.com/blog/powershell-scripts/office-365-permissions-inventory-full-access

Highlighted

@Vasil Michev, Yes I know this solution but I have a lot of stale delegation groups and need to know exactly which groups are in still used and have function and which not. Maybe I should query the all production shared mailboxes and collects their groups in a csv what you described. After that another script import this csv and would check data and create new csv with the really live shared mailboxes and their groups, thus the rest are the stale.

Highlighted

Well how do you tell which is "live" and which is "stale"?

Highlighted

@Vasil Michev We have hybrid Exchange and basically used synced AD accounts and synced on-premise distributiongroups (delegation groups) for the shared mailbox setup. When the shared mailbox and its AD account deactivated the associate distribution groups or named delegation groups remained and were not deactivated as the shared mailbox. These delegation groups are what I call or named stale delegation groups and there are hundred.
My basic problem I would need to write a powershell script which one by one goes through the existing synced groups and examines whether there is a corresponding live shared mailbox.
So I would need the complete invers method of the "Get-MailboxPermission "primarysmtpaddress" | where {(($_.IsInherited -eq $false) -and ($_.AccessRights -like "*FullAccess*") -and ($_.User -notlike "NT Authority\SELF") -and ($_.Deny -eq $false))} | select -expand User" and "Get-RecipientPermission "primarysmtpaddress" | where {(($_.IsInherited -eq $false) -and ($_.AccessRights -like "*SendAs*") -and ($_.Trustee -notlike 'NT Authority\SELF') -and ($_.AccessControlType -eq 'Allow'))} | select -expand Trustee" powershell query. Actually I need a powershell query where the input should be the primarysmtp address of the delagation group.

Related Conversations