2

I need some help with my script that I've come up with that I'm having some trouble getting it to work without giving an error or warning message.

So far I have this logic that gives "reviewer" permission to everyone's calendar individually to a specific mail-enabled AD security group:

$users = Get-Mailbox | Select -ExpandProperty Alias;
Foreach ($user in $users) {Add-MailboxFolderPermission $user":\Calendar" -user *GROUP1* -accessrights Reviewer};

This works fine, but we create and remove user accounts often so I need the script to run as economically as possible. This logic above will check and error on each user that already has a permission set, which can take a while and adds a lot to the error logs.

What I would like is an IF statement, or revision to the Select property in the script that can check if a user has currently no permissions set to the security group, then add the permission, so if they have the permission set already it will just skip.

Something like this:

$users = Get-Mailbox | Select -ExpandProperty Alias;
$users2 = Get-MailboxFolderPermission -Identity $users:\Calendar -User *GROUP1* IF accessrights = NULL** ???;
Foreach ($user in **$users2**) {Add-MailboxFolderPermission $user":\Calendar" -user *GROUP1* -accessrights Reviewer};
2
  • 1
    What version of Exchange are you running? Not sure that it matters much but may be helpful. Aug 30, 2019 at 2:20
  • Hi Pimp, it is exchange 2010 but will be moving to 2019 within this financial year. Hoping the commands will stay the same.
    – C-Burg
    Aug 30, 2019 at 2:27

1 Answer 1

2

Here's a way to use some conditional PowerShell logic with some arrays, loops, and variables to only run the Add-MailboxFolderPermission command if the "Group Name" does not already have access. I've also included some supporting resources for further reading on the components of the logic.

$gName = "GROUP1";
$accounts = (Get-Mailbox | Select -ExpandProperty Alias);

$accounts | % {
    $a = $_;
    $z = (Get-MailboxFolderPermission -Identity $a":\Calendar");
    $y = ($z | %{$_.User.DisplayName});
    If($y -notcontains $gName){Add-MailboxFolderPermission $a":\Calendar" -user $gName -accessrights Reviewer};
    };

Supporting Resources

4
  • @C-Burg .... As you can see within the $accounts loop the $y variable is a looped over array set data type. So within the If() function you can use the -notcontains comparison operator to only run the Add-MailboxFolderPermission command if the $y array does NOT contain the security "group" name or whatever. Those are the keys to the logic I think. Aug 30, 2019 at 3:30
  • You are definitely on another level for just being able to build these scripts like that. I'm learning a lot and will go through those supporting resources as well thanks! I tried the script and it adds the permission to users that do not have the permission set, but it will give an error for each user that has.
    – C-Burg
    Aug 30, 2019 at 4:01
  • So somehow it is still checking each user, adding the permission - error "Add-MailboxFolderPermission : An existing permission entry was found for user: GROUP1." and then go on to the next one.
    – C-Burg
    Aug 30, 2019 at 4:03
  • 1
    You are a legend, cheers bud, worked a charm.
    – C-Burg
    Sep 2, 2019 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .