Assign rights to helpdesk to give SendAs permissions

There are multiple ways to assign Recipient Administration permissions to the helpdesk users. Some of them are:

1. Add them to "Recipient Management" RoleGroup directly using Exchange Shell. This will assign them the two important Roles "Mail Recipients" and "Mail Recipient Creation"
2. Add them to "Recipient Management" Active Directory Group. This group is already added to the "Recipient Management" RoleGroup.
3. If you have a mixed environment (2007/2010) then the old "Exchange Recipient Administrators" group is already a member of "Recipient Management" group.

However the catch is that they still will not be able to give SendAs permissions to the users on shared mailboxes.

The cmdlet that is required to give SendAs permissions is Add-ADPermission. This cmdlet is available in "Active Directory Permissions" Role. Do not worry because this role has only the below cmdlets:

Remove-ADPermission
Get-User
Get-SecurityPrincipal
Get-RoleGroup
Get-Group
Get-DomainController
Get-ADPermission
Add-ADPermission

As you can see that all of them are Get cmdlets and only Remove-ADPermission and Add-ADPermissions cmdlets so it is safe to add Helpdesk to this Management Role. Further more the switches that can be used with the Add and Remove AD Permission cmdlet are also restricted.

Now you have identified the RoleGroup and the Role to be assigned to the helpdesk to enable them to give SendAs permissions also. One you have done this, you need to asign the Role to the RoleGroup. We will choose the built-in Role Group "Mail Recipients". I have chosen this RoleGroup because it already contains most of the Roles required by the heldpesk to perform Mail User management.

To assign a Role to a Role Group, we use New-ManagementRoleAssignement cmdlet. Here is the syntax in this case

New-ManagementRoleAssignment -Name "Active Directory Permissions-Recipient Management" -SecurityGroup "Recipient Managemen" -Role "Active Directory Permissions"

The standard naming convention for creating management Role Assignment is as above only.

Once you have done the above then the Recipient Managament Role Groups will have the following Roles assigned:

Distribution Groups
Mail Enabled Public Folders
Mail Recipient Creation
Mail Recipients
Message Tracking
Migration
Move Mailboxes
Recipient Policies
Active Directory Permissions

The last Role has been assigned by the New-ManagementRoleAssignment cmdlet above. This will enable the helpdesk to do the complete management of the recipients including granting SendAs permissions.

------------ End of Document ------------------------
Tags: Exchange Server, Power Shell
Published Date: 20100805

How to delete an email from a mailbox using Exchange Shell

There have been times when a user has sent an email to a big DL and wants it to be recalled. We all know that Exchange recall feature is not much effective. However in Exchange 2007 you can scan all mailboxes and delete the email from them. The best way is to narrow your search as much as possible.

However remember that you need an account which has full access to the mailbox from which you want to delete the email. The BES service account generally has that permissions. You will have to "Run As" the EMS with this account.

Below are two examples of such command.

Get-Mailbox -Server SERVER_NAME -resultsize unlimited | Where-Object {$_.OrganizationalUnit -like "Mydomain.corp/OU/OU/OU*"} | Export-Mailbox -SubjectKeywords "Some keywords from the subject line" -DeleteContent -StartDate 10/08/2009 -IncludeFolders "\Inbox"

The above command finds all mailboxes from a particular server and which are in a particular OU. It then users the Export-Mailbox command to delete the mails as per the specified criteria.

StartDate is use to delete the emails that are after the specified date. You can also use EndDate to specify the range.

Include Folders further narrows the search and reduces the scan time considerably.

Get-Mailbox -Server SERVER_NAME -resultsize unlimited | Export-Mailbox -SenderKeywords "Sender's SMTP address" -DeleteContent -StartDate 10/08/2009 -IncludeFolders "\Inbox"

You can also delete emails from a specific sender using the above command.

Please be careful to test this command before running in production environment as you may end up deleting emails from users mailbox that they need if any wrong criteria is chosen.

------------ End of Document ------------------------
Tags: PowerShell, Exchange Server
Published Date: 20100107

Remove all DL membership from a user

As part of account termination process, it is often required that the user should be removed from all DLs. This is generally a manual process because of the way AD stores Group Membership information. However you can use Quest Management Shell and achieve the task in one line.

Import-Csv c:\My_UserNames.csv | foreach {(Get-QADUser $_.DisplayName).memberof | Get-QADGroup | Remove-QADGroupMember -Member $_.DisplayName}

The above line will read all names from a CSV. It will then find the DLs that the user is a member-of and call Remove-QADGroupMember to remove the member from the specified DLs. This command will run on all the DLs that a user is a member-of. 'foreach' will cause the entire command to run for all the users listed in the csv file.

We need to pipe it to Get-QADGroup because .memberOf spits the DN of the DLs and Remove-QADGroupMember will not take the DN as the identity for the DL.

------------ End of Document ------------------------
Tags: Active Directory, PowerShell, Exchange Server
Published Date: 20091231

Change multiple user password using command line

Quest QAD shell provides a very useful interface to do this often required task. The beautiful part is that you do not need to provide the password as a Secure string.

Set-QADUser –Identity –UserPassword -UserMustChangePassword $True

The above command will set the password for User to the one specified in this command.

Import-Csv UserList.csv | foreach {Set-QADUser -Identity $_.UserName -Password $_.UserPassword -UserMustChangePassword $True}

The above command will read the UserName and UserPassword from and excel sheet UserList.csv and will set them accordingly. You need to keep the row headers as UserName and UserPassword in the CSV. The most important feature here is that you can have a different password for each individual user in the sheet.

------------ End of Document ------------------------
Tags: Active Directory, PowerShell,
Published Date: 20091118