DLConversionV2

2.9.7.0

set-OnPremDLPermissions.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
 <#
    .SYNOPSIS
 
    Resets the permissions for the on premises DL.
 
    .DESCRIPTION
 
    Resets the permissions for the on premises DL.
 
    .PARAMETER allOnPremSendAs
 
    All of the send as permissions for other objects on prem.
 
    .PARAMETER allOnPremFullMailboxAccess
 
    All of the full mailbox access permissions for other objects on prem.
 
    .PARAMETER allOnPremFolderPermissions
 
    All of the mailbox folder permissions.
 
    .PARAMETER all
 
    .OUTPUTS
 
    None
 
    .EXAMPLE
 
    set-onPremDLPermissions -allOnPremSendAs $onPremSendAs -allOnPremFullMailboxAccess $onPremFullMailboxAccess -allOnPremFolderPermissions $folderPermissions
 
    #>
    Function set-OnPremDLPermissions
    {
        [cmdletbinding()]

        Param
        (
            [Parameter(Mandatory = $true)]
            [AllowEmptyCollection()]
            [array]$allOnPremSendAs=$NULL,
            [Parameter(Mandatory = $true)]
            [AllowEmptyCollection()]
            [array]$allOnPremFullMailboxAccess=$NULL,
            [Parameter(Mandatory = $true)]
            [AllowEmptyCollection()]
            [array]$allOnPremFolderPermissions=$NULL,
            [Parameter(Mandatory = $TRUE)]
            [string]$groupSMTPAddress
        )

       #Output all parameters bound or unbound and their associated values.

       write-functionParameters -keyArray $MyInvocation.MyCommand.Parameters.Keys -parameterArray $PSBoundParameters -variableArray (Get-Variable -Scope Local -ErrorAction Ignore)

        [string]$isTestError="No"

        #Declare function variables.

        #Start processing the recipient permissions.
       
        Out-LogFile -string "********************************************************************************"
        Out-LogFile -string "START set-OnPremDLPermissions"
        Out-LogFile -string "********************************************************************************"

        #Determine if send as is populated and if so reset permissiosn.

        if ($allOnPremSendAs -ne $NULL)
        {
            $isTestError = "No"
            out-logfile -string "There are objects that have send as rights - processing."

            foreach ($permission in $allOnPremSendAs)
            {
                out-logfile -string ("Processing permission identity = "+$permission.identity)
                out-logfile -string ("Processing permission trustee = "+$permission.user)

                try {
                    add-adPermission -identity $permission.identity -user $permission.user -AccessRights ExtendedRight -ExtendedRights "Send As" -confirm:$FALSE -errorAction Stop
                }
                catch {
                    out-logfile -string "Unable to add the recipient permission send as on premises."
                    $isTestError = "Yes"
                    out-logfile -string $_
                    $errorMessageDetail = $_
                }
            }

            if ($isTestError -eq "Yes")
            {
                out-logfile -string "Error adding migrated mail contact to send as permissions on premises."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Send As Permission"
                    errorMessage = "Unable to add the migrated distribution list mail contact with send as permissions to groups sourced on onPremRecipientSendAs."
                    errorMessageDetail = $errorMessageDetail
                }
    
                out-logfile -string $isErrorObject
    
                $global:OnPremReplacePermissionsErrors+=$isErrorObject
            }
            elseif ($isTestError -eq "No")
            {
                out-logfile -string "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective."
                out-logfile -string "Mail contacts are not security principals therefore the permission will not continue to work on premises."
                out-logfile -string "Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Send As Permission"
                    errorMessage = "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective." 
                    errorMessageDetail = "Mail contacts are not security principals therefore the permission will not continue to work on premises. Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."
                }
    
                out-logfile -string $isErrorObject
    
                $global:OnPremReplacePermissionsErrors+=$isErrorObject
            }
        }
        else 
        {
            out-logfile -string "There are no send as permissions to process."    
        }

        
    
        

        if ($allOnPremFullMailboxAccess -ne $NULL)
        {
            $isTestError = "No"

            out-logfile -string "There are objects that have full mailbox access rights - processing."

            try {
                foreach ($permission in $allOnPremFullMailboxAccess)
                {
                    out-logfile -string ("Processing permission identity = "+$permission.identity)
                    out-logfile -string ("Processing permission trustee = "+$permission.user)
                    out-logfile -string ("Processing permission access rights = "+$permission.AccessRights)

                    add-MailboxPermission -identity $permission.identity -user $permission.user -accessRights $permission.accessRights -confirm:$FALSE -errorAction Stop
                }
            }
            catch {
                out-logFile -string "Unable to add the full mailbox access permission in Office 365."
                out-logfile -string $_
                $isTestError="Yes"
                $errorMessageDetail=$_
            }

            if ($isTestError -eq "Yes")
            {
                out-logfile -string "Error processing full mailbox access rights on premises (migrated mail contact) for migrated DL."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Full Mailbox Access Permission"
                    errorMessage = "Unable to add the migrated distribution list with full mailbox access permissions to resource. Manaul add required."
                    errorMessageDetail = $errorMessageDetail
                }

                out-logfile -string $isErrorObject

                $global:onPremReplacePermissionsErrors+=$isErrorObject
            }
            elseif ($isTestError -eq "No")
            {
                out-logfile -string "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective."
                out-logfile -string "Mail contacts are not security principals therefore the permission will not continue to work on premises."
                out-logfile -string "Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Full Mailbox Access Permission"
                    errorMessage = "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective." 
                    errorMessageDetail = "Mail contacts are not security principals therefore the permission will not continue to work on premises. Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."
                }
    
                out-logfile -string $isErrorObject
    
                $global:OnPremReplacePermissionsErrors+=$isErrorObject
            }
        }
        else 
        {
            out-logfile -string "There are no full mailbox access permissions to process."    
        }

        if ($allOnPremFolderPermissions -ne $NULL)
        {
            out-logfile -string "Processing mailbox folder permissions on Premises."

            foreach ($permission in $allOnPremFolderPermissions)
            {
                $isTestError = "No"
                
                try {
                    out-logfile -string ("Processing permission identity = "+$permission.identity)
                    out-logfile -string ("Processing permission trustee = "+$permission.user)
                    out-logfile -string ("Processing permissions folder = "+$permission.folderName)
                    out-logfile -string ("Processing permission access rights = "+$permission.AccessRights)

                    add-MailboxFolderPermission -identity $permission.identity -user $permission.user -accessRights $permission.AccessRights -confirm:$FALSE -errorAction Stop
                }
                catch {
                    out-logFile -string "Unable to add mailbox folder permissions on premises for migrated mail contact."
                    out-logfile -string $_
                    $isTestError="Yes"
                    $errorMessageDetail=$_
                }
            }

            if ($isTestError -eq "Yes")
            {
                out-logfile -string "Unable to add mailbox folder permissions on premises for migrated mail contact.."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Mailbox Folder Permission"
                    errorMessage = "Unable to add the migrated distribution list with mailbox folder permissions to resource. Manaul add required."
                    errorMessageDetail = $errorMessageDetail
                }

                out-logfile -string $isErrorObject

                $global:onPremReplacePermissionsErrors+=$isErrorObject
            }
            elseif ($isTestError -eq "No")
            {
                out-logfile -string "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective."
                out-logfile -string "Mail contacts are not security principals therefore the permission will not continue to work on premises."
                out-logfile -string "Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."

                $isErrorObject = new-Object psObject -property @{
                    permissionIdentity = $permission.Identity
                    attribute = "Mailbox Folder Permission"
                    errorMessage = "Administrator Notice: The mitrated mail contact was sucessfully added but the permission is not effective." 
                    errorMessageDetail = "Mail contacts are not security principals therefore the permission will not continue to work on premises. Mail contact added only to faciliate the migration of other distribution lists that may depend on the discovery of this object."
                }
    
                out-logfile -string $isErrorObject
    
                $global:OnPremReplacePermissionsErrors+=$isErrorObject
            }
        }
        else 
        {
            out-logfile -string "There are no full mailbox access permissions to process."  
        }

        Out-LogFile -string "END set-OnPremDLPermissions"
        Out-LogFile -string "********************************************************************************"
    }