Public/Permissions/Get-MailboxPerms.ps1
|
Function Get-MailboxPerms { ## <# .SYNOPSIS By default, creates permissions reports for all mailboxes with SendAs, SendOnBehalf and FullAccess delegates. Switches can be added to isolate one or more reports Creates individual reports for each permission type (unless skipped), and a report that combines all CSVs in chosen directory. The combined report will be called, AllPermissions.csv If same Report Path is chosen, existing files will be overwritten. CSVs headers: "Object","UPN","Granted","GrantedUPN","Permission" .EXAMPLE Get-MailboxPerms -ReportPath C:\pScripts -Verbose .EXAMPLE Get-MailboxPerms -ReportPath C:\pScripts -SkipFullAccess -Verbose .EXAMPLE Get-MailboxPerms -ReportPath C:\pScripts -SkipSendOnBehalf -Verbose .EXAMPLE Get-MailboxPerms -ReportPath C:\pScripts -SkipSendAs -SkipFullAccess -Verbose .EXAMPLE Get-MailboxPerms -ReportPath C:\pScripts -PowerShell2 -ExchangeServer "ExServer01" -Verbose ***ONLY PS2: When running from PowerShell 2 (Exchange 2010 Server)*** ***FIRST***: Be sure to dot-source the function with the below command (change the path): Get-ChildItem -Path "C:\scripts\Posh365\" -filter *.ps1 -Recurse | % { . $_.fullname } It is normal to see errors when running the above command, as some of the functions (that aren't needed here) do not support PS2 #> [CmdletBinding(SupportsShouldProcess = $true)] param ( [Parameter(Mandatory = $true)] [System.IO.FileInfo] $ReportPath, [Parameter()] [switch] $SkipSendAs, [Parameter()] [switch] $SkipSendOnBehalf, [Parameter()] [switch] $SkipFullAccess, [Parameter()] [switch] $SkipFolderPerms, [Parameter()] [switch] $PowerShell2, [Parameter()] [string] $ExchangeServer ) Try { import-module activedirectory -ErrorAction Stop -Verbose:$false } Catch { Write-Host "This module depends on the ActiveDirectory module." Write-Host "Please download and install from https://www.microsoft.com/en-us/download/details.aspx?id=45520" throw } $RootPath = $env:USERPROFILE + "\ps\" $KeyPath = $Rootpath + "creds\" $User = $env:USERNAME Get-PSSession -ErrorAction SilentlyContinue | Where-Object { ($_.name -eq "OnPremExchage" -or $_.name -like "Session for implicit remoting module at*") -and ($_.availability -ne "Available" -and $_.State -ne "Opened")} | ForEach-Object {Remove-PSSession $_.id} if ($PowerShell2) { Write-Warning "**************************************************************************************************" Write-Warning " You have selected -PowerShell2 which indicates that you are running this from PowerShell 2 " Write-Warning "If you haven't already, make sure to dot-source the functions with this command (change the Path):" Write-Warning " Get-ChildItem -Path `"C:\scripts\Posh365\`" -filter *.ps1 -Recurse | % { . `$_.fullname } " Write-Warning " It is normal to see errors when running the above command " Write-Warning "**************************************************************************************************" if (!$ExchangeServer) { Write-Warning "********************************************************************************************" Write-Warning " Re-Run the command specifying the -ExchangeServer parameter " Write-Warning "ex. Get-MailboxPerms -ReportPath C:\pScripts -PowerShell2 -ExchangeServer `"ExServer01`"" Write-Warning " Script is terminating " Write-Warning "********************************************************************************************" throw } if (Get-PSSession -ErrorAction SilentlyContinue | Where-Object { ($_.name -eq "OnPremExchage" -or $_.name -like "Session for implicit remoting module at*") -and ($_.availability -ne "Available" -and $_.State -ne "Opened")}) { Connect-Exchange -ExchangeServer $ExchangeServer -ViewEntireForest -NoPrefix -NoMessageForPS2 } } else { while (!(Test-Path ($RootPath + "$($user).EXCHServer"))) { Select-ExchangeServer } $ExchangeServer = Get-Content ($RootPath + "$($user).EXCHServer") if (Get-PSSession -ErrorAction SilentlyContinue | Where-Object { ($_.name -eq "OnPremExchage" -or $_.name -like "Session for implicit remoting module at*") -and ($_.availability -ne "Available" -and $_.State -ne "Opened")}) { Connect-Exchange -ExchangeServer $ExchangeServer -ViewEntireForest -NoPrefix } } New-Item -ItemType Directory -Path $ReportPath -ErrorAction SilentlyContinue if (-not $SkipFolderPerms -and ($SkipSendAs -and $SkipSendOnBehalf -and $SkipFullAccess)) { $DomainNameHash = Get-DomainNameHash Write-Verbose "Importing Active Directory Users and Groups that have at least one proxy address" $AllADUsers = Get-ADUsersandGroupsWithProxyAddress -DomainNameHash $DomainNameHash Write-Verbose "Caching hash table. LogonName as Key and Values of DisplayName & UPN" $ADHash = $AllADUsers | Get-ADHash Write-Verbose "Caching hash table. DN as Key and Values of DisplayName, UPN & LogonName" $ADHashDN = $AllADUsers | Get-ADHashDN Write-Verbose "Caching hash table. CN as Key and Values of DisplayName, UPN & LogonName" $ADHashCN = $AllADUsers | Get-ADHashCN } Write-Verbose "Retrieving all Exchange Mailboxes" $allBoxes = Get-Mailbox -ResultSize unlimited $allMailboxes = $allBoxes | Select -expandproperty distinguishedname if (-not $SkipSendAs) { Write-Verbose "Getting SendAs permissions for each mailbox and writing to file" $allMailboxes | Get-SendAsPerms -ADHashDN $ADHashDN -ADHash $ADHash | Select Object, UPN, PrimarySMTPAddress, Granted, GrantedUPN, GrantedSMTP, Checking, GroupMember, Type, Permission | Export-csv (Join-Path $ReportPath "SendAsPerms.csv") -NoTypeInformation -Encoding UTF8 } if (-not $SkipSendOnBehalf) { Write-Verbose "Getting SendOnBehalf permissions for each mailbox and writing to file" $allMailboxes | Get-SendOnBehalfPerms -ADHashCN $ADHashCN -ADHashDN $ADHashDN| Select Object, UPN, PrimarySMTPAddress, Granted, GrantedUPN, GrantedSMTP, Checking, GroupMember, Type, Permission | Export-csv (Join-Path $ReportPath "SendOnBehalfPerms.csv") -NoTypeInformation -Encoding UTF8 } if (-not $SkipFullAccess) { Write-Verbose "Getting FullAccess permissions for each mailbox and writing to file" $allMailboxes | Get-FullAccessPerms -ADHashDN $ADHashDN -ADHash $ADHash | Select Object, UPN, PrimarySMTPAddress, Granted, GrantedUPN, GrantedSMTP, Checking, GroupMember, Type, Permission | Export-csv (Join-Path $ReportPath "FullAccessPerms.csv") -NoTypeInformation -Encoding UTF8 } if (-not $SkipFolderPerms) { Write-Verbose "Getting Folder Permissions for each mailbox and writing to file" $allBoxes | Get-MailboxFolderPerms | Select DisplayName, PrimarySMTPAddress, UserPrincipalName, Folder, AccessRights, User | Export-csv (Join-Path $ReportPath "FolderPerms.csv") -NoTypeInformation -Encoding UTF8 } $AllPermissions = $null $Report = $ReportPath.ToString() $Report = $Report.TrimEnd('\') + "\*" $AllPermissions = Get-ChildItem -Path $Report -Include "SendAsPerms.csv", "SendOnBehalfPerms.csv", "FullAccessPerms.csv" -Exclude "AllPermissions.csv" | % { Import-Csv $_ } $AllPermissions | Export-Csv (Join-Path $ReportPath "AllPermissions.csv") -NoTypeInformation -Encoding UTF8 Write-Verbose "Combined all CSV's into a single file named, AllPermissions.csv" } |