If you run the cmdlet
Set-DistributionGroup "Sales Team" -GrantSendOnBehalfTo jonestom
you will overwrite the current contents of that distribution group’s GrantSendOnBehalfTo
list. Oops.
One of my colleagues, a very old Exchange hand and a new PowerSheller, asked me if there was a simpler way to add one mailbox owner ($trustee
) to the GrantSendOnBehalfTo
attribute of another Exchange mailbox or distribution group ($target
) than having to get both items, extract $trustee.distinguishedname
and the current value of $target.GrantSendOnBehalfTo
(and save it to another variable, $currentTrustees
), append the trustee’s distinguished name to the current list of trustees ($currentTrustees += $trustee.DistinguishedName
), then finally replace the old value of $target.GrantSendOnBehalfTo
with $currentTrustees
(Set-DistributionGroup $target -GrantSendOnBehalfTo $currentTrustees
)
Yes, there is, at least as of Exchange 2010 SP1.
Set-DistributionGroup "Sales Team" -GrantSendOnBehalfTo @{add='domainA\jonestom','domainB\smithjane'}
Removing an unwanted trustee works the same way:
Set-DistributionGroup "Sales Team" -GrantSendOnBehalfTo @{remove='domainA\jonestom'}
Because combining these operations often does not end well, here is a cmdlet I made for the help desk to replace a departing colleague with his successor:
function Replace-DLGrantSendOnBehalfTo { Param($oldTrustee, $newTrustee, $targetDistributionGroup ) Set-DistributionGroup $targetDistributionGroup -GrantSendOnBehalfTo @{add=$newTrustee} Set-DistributionGroup $targetDistributionGroup -GrantSendOnBehalfTo @{remove=$oldTrustee} }
For greater efficiency, it can be part of a pipeline, preceded by the names of the target distibution groups and surrounded by a foreach statement. A similar cmdlet can be made for mailboxes. There is probably a way to make it more generic; I might add that later.
The only article I’Ve seen that showed the @{add=$foo}, @{remove=$bar} way to modify this: http://blogs.technet.com/b/manjubn/archive/2012/10/02/grantsendonbehalfto-permissions-for-mailbox-overwrites-existing-permission.aspx
An article that shows the longer way around I described at the beginning, but gives a good explanation of the difference between GrantSendOnBehalfTo and SendAs permissions in Exchange: http://exchangeserverpro.com/exchange-2010-grant-send-behalf-permissions-distribution-group
NICE. Good examples and thanks for the extra links.
LikeLike