Over the past few years Microsoft has been pushing PowerShell as a means of managing almost everything. In fact, with the rise of viruses and cyberattacks, Microsoft is reducing the number of points of compromise available to attackers. Increasingly, admin tasks and even whole servers are removing the GUI (buttons/options) and moving those functions to PowerShell.
With that in mind a lot of technicians are building their own list of “Most popular commands” so here is a good basis to get you started.
Assign Mailbox Permissions
• Assign “Full Access” permissions for a Mailbox
PowerShell command Syntax
Add-MailboxPermission <Identity> -User <Identity> -AccessRights FullAccess -InheritanceType All
PowerShell command Example
Add-MailboxPermission John -User Suzan -AccessRights FullAccess -InheritanceType All
• Assign “Send As” Permissions for a Mailbox
PowerShell command Syntax
Add-RecipientPermission <Identity> -AccessRights SendAs -Trustee <Identity>
PowerShell command Example
Add-RecipientPermission John -AccessRights SendAs -Trustee Suzan
Adjustments & Improvements
To avoid the need for confirmation, we can add the option: “-Confirm:$False”
Add-RecipientPermission John -Trustee Suzan -AccessRights SendAs -Confirm:$False
• Assign “Send As” Permissions for a ALL Mailbox’s (BulkMode)
PowerShell command Syntax
$MBXS = Get-Recipient -RecipientType UsermMilbox ForEach ($MBX in $MBXS)
{
Add-RecipientPermission $MBX.name -AccessRights SendAs –Trustee <User Principal Name> -Confirm:$False
}
Get-RecipientPermission | Where {($_.Trustee -ne 'nt authorityself') -and ($_.Trustee -ne 'Null sid')} }
PowerShell command Example
$MBXS = Get-Recipient -RecipientType UsermMilbox ForEach ($MBX in $MBXS)
{
Add-RecipientPermission $MBX.name -AccessRights SendAs –Trustee John@o365info.com -Confirm:$False
}
Get-RecipientPermission | Where {($_.Trustee -ne 'nt authorityself') -and ($_.Trustee -ne 'Null sid')} }
• Assign “Send As” Permissions for recipient for each member in a distribution group
PowerShell command Syntax
$DL = Get-DistributionGroupMember
Foreach ($item in $DL)
{
Add-RecipientPermission $item.name -AccessRights SendAs
–Trustee <Identity> -Confirm:$False
}
PowerShell command Example
$DL = Get-DistributionGroupMember DL-01
Foreach ($item in $DL)
{
Add-RecipientPermission $item.name -AccessRights SendAs –Trustee Suzan -Confirm:$False}
• Assign “Send As” Permissions for each member in a distribution group for a specific recipient
PowerShell command Syntax
$DL = Get-DistributionGroupMember
Foreach ($item in $DL)
{
Add-RecipientPermission <Identity> -AccessRights SendAs
–Trustee $item.name -Confirm:$False
}
PowerShell command Example
$DL = Get-DistributionGroupMember DL-01
Foreach ($item in $DL)
{
Add-RecipientPermission Suzan -AccessRights SendAs –Trustee $item.name -Confirm:$False}
• Assign “Send on Behalf” Permissions for a Mailbox
PowerShell command Syntax
Set-Mailbox <Identity> -GrantSendOnBehalfTo <Identity>
PowerShell command Example
Set-Mailbox -Identity John -GrantSendOnBehalfTo Suzan
• Assign “Full Access” permissions for all Mailboxes (BulkMode)
PowerShell command Syntax
Get-Mailbox -ResultSize unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'} | Add-MailboxPermission -User <Identity> -AccessRights FullAccess -InheritanceType All
PowerShell command Example
Get-Mailbox -ResultSize unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'} | Add-MailboxPermission -User John -AccessRights FullAccess -InheritanceType All
Assign Full Access Permissions and AutoMap
• Assign “Full Access” permissions to Distribution Group + AutoMap
PowerShell command Syntax
$DL = Get-DistributionGroupMember <Distribution Group> | Select-Object -ExpandProperty Name
ForEach ($Member in $DL )
{
Add-MailboxPermission -Identity <Identity> -User $S -AccessRights FullAccess -InheritanceType All
}
PowerShell command Example
$DL = Get-DistributionGroupMember "Assistants Group" | Select-Object -ExpandProperty Name
ForEach ($Member in $DL )
{
Add-MailboxPermission -Identity "FL1 Room1" -User $S -AccessRights FullAccess -InheritanceType All
}
Additional reading: Auto-mapping shared mailboxes in Exchange 2010 SP1 with Outlook 2010 and Outlook 2007
• Assign “Full Access” permissions for all Mailboxes (BulkMode) and Disable AutoMap
PowerShell command Syntax
Get-Mailbox -ResultSize unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'} | Add-Mailboxpermission -User <Identity> -AccessRights FullAccess -InheritanceType All –Automapping $False
PowerShell command Example
Get-Mailbox -ResultSize unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'} | Add-Mailboxpermission -User John -AccessRights FullAccess -InheritanceType All –Automapping $False
• Assign “Full Access” permissions for Specific User and Disable AutoMap
PowerShell command Syntax
Add-MailboxPermission <Identity> -User <Identity> -AccessRights FullAccess -InheritanceType All –AutoMapping $False
PowerShell command Example
Add-MailboxPermission John -User Suzan -AccessRights FullAccess -InheritanceType All –AutoMapping $False
Display permissions for a Mailbox
• Display “Full Access” Permissions for a Mailbox
PowerShell command Syntax
Get-MailboxPermission <Identity>
PowerShell command Example
Get-MailboxPermission John
Adjustments & Improvements
For improving the quality of the output we can use an additional PowerShell parameter that will “clean” the unnecessary information:
Get-MailboxPermission John | Where { ($_.IsInherited -eq $False) -and -not ($_.User -like “NT AUTHORITYSELF”) } | Select Identity,user,AccessRights
• Display “Send As” permission for a Mailbox
PowerShell command Syntax
Get-RecipientPermission <Identity>
PowerShell command Example
Get-RecipientPermission John
Adjustments & Improvements
For improving the quality of the output we can use an additional PowerShell parameter that will “clean” the unnecessary information:
Get-RecipientPermission John | Where { ($_.IsInherited -eq $False) -and -not ($_.Trustee -like “NT AUTHORITYSELF”) } | Select Trustee,AccessControlType,AccessRights
• Display “Send On Behalf” Permissions for Mailbox
PowerShell command Syntax
Get-Mailbox <Identity>
PowerShell command Example
Get-Mailbox John
Adjustments & Improvements
For improving the quality of the output we can use an additional PowerShell parameter that will “clean” the unnecessary information:
Get-RecipientPermission John | Where { ($_.IsInherited -eq $False) -and -not ($_.Trustee -like “NT AUTHORITYSELF”) } | Select Trustee, AccessControlType, AccessRights
• View all “Send As permissions” you’ve configured in your organisation
PowerShell command Syntax
Get-RecipientPermission | where {($_.Trustee -ne 'nt authorityself') -and ($_.Trustee -ne 'Null sid')} | select Identity,Trustee,AccessRights
• Display a list of recipient’s that have FULL ACCESS permission on other recipients
PowerShell command Syntax
$a = Get-Mailbox $a |Get-MailboxPermission | Where { ($_.IsInherited -eq $False) -and -not ($_.User -like “NT AUTHORITYSELF”) -and -not ($_.User -like '*Discovery Management*') } | Select Identity, user, AccessRights
Revoke Permissions
• Revoke “Full Access” Permissions
PowerShell command Syntax
Remove-MailboxPermission <Identity> -User <Identity> -AccessRights FullAccess
PowerShell command Example
Remove-MailboxPermission John -User Suzan -AccessRights FullAccess
Adjustments & Improvements
To avoid the need for confirmation, we can add the option: “-Confirm:$False”
Remove-MailboxPermission John -User Suzan -AccessRights FullAccess -Confirm:$False
• Revoke “Send As” Permissions
PowerShell command Syntax
Remove-RecipientPermission <Identity> -AccessRights SendAs -Trustee <Identity>
PowerShell command Example
Remove-RecipientPermission John -AccessRights SendAs -Trustee Suzan
Adjustments & Improvements
To avoid the need for confirmation, we can add the option: “-Confirm:$False”
Remove-RecipientPermission John -AccessRights SendAs -Trustee Suzan -Confirm:$False
