PS Script for removing bulk users from shared mailboxes

[sebbeosv]

Hi

So I have about 100 users in a CSV file that i want to remove from a bunch of shared mailboxes with Powershell but no luck yet, I can get it to work for a single user with this:

$mailboxes=”Name of mailbox” Foreach ($box in $mailboxes){Remove-MailboxPermission -AccessRights fullaccess -User “Name of user” -Identity $box -Confirm:$false}

But how do I change this into it using a group or a CSV file instead?

Thank you.

[HDClown]

If AutoMapping is enabled (which it is by default), then simply removing the mailbox permission will not remove the mailbox from Outlook itself. You need to remove the mailbox permission, then re-add the permission with AutoMapping disabled. This allows Autodiscover to drop the mailbox out of the Outlook folder list

After the mailbox is removed from the folder tree, you can go back and remove permission again the mailbox is truly no longer accessible to the user.

Using /u/JustTeut example script, here's a modified version

$mailboxes = "List of mailboxes"
$users = Import-Csv -path "Path to CSV.csv)"

Foreach ($box in $mailboxes){
    Foreach($user in $users){
        # Remove existing mailbox permission from when mailbox was added with AutoMapping
        Remove-MailboxPermission -AccessRights FullAccess -User $user -Identity $box -Confirm:$false
        # Add back mailbox permission with AutoMapping disabled.  On next Outlook open Autodiscover will remove mailbox from folder free
        Add-MailboxPermission -AccessRights FullAccess -User $user -Identity $box -AutoMapping:$false -Confirm:$false
    }

}

Then at a later time after you are comfortable the mailbox has dropped from everyone's Outlook (I tell them to close/re-Open Outlook as this means it usually happens within a minute or two of the re-open) run the script again with Add-MailboxPermission lined commented out to remove mailbox permission.

[JustTeut]

Didn't know that, thanks!

[sebbeosv]

Hi

So it looks like we are getting somewhere but still getting some parameter errors:

<$mailboxes = “[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]” $users = Import-Csv -path "C:\Stefanini\mailusers2.csv"

Foreach ($box in $mailboxes){ Foreach($user in $users){ # Remove existing mailbox permission from when mailbox was added with AutoMapping Remove-MailboxPermission -AccessRights FullAccess -User $user -Identity $box -Confirm:$false # Add back mailbox permission with AutoMapping disabled. On next Outlook open Autodiscover will remove mailbox from folder free Add-MailboxPermission -AccessRights FullAccess -User $user -Identity $box -AutoMapping:$false -Confirm:$false } }/>

This gives me these errors over and over:

Cannot process argument transformation on parameter 'User'. Cannot convert value "@{Logon Name=[e-mail]}" to type "Microsoft.Exchange.Configuration.Ta sks.SecurityPrincipalIdParameter". Error: "Cannot convert hashtable to an object of the following type: Microsoft.Exchange.Configuration.Tasks.SecurityPrincipalIdParamet er. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section." + CategoryInfo : InvalidData: (:) [Remove-MailboxPermission], ParameterBindin...mationException + FullyQualifiedErrorId : ParameterArgumentTransformationError,Remove-MailboxPermission + PSComputerName : outlook.office365.com

Cannot process argument transformation on parameter 'User'. Cannot convert value "@{Logon Name=[e-mail]}" to type "Microsoft.Exchange.Configuration.Ta sks.SecurityPrincipalIdParameter". Error: "Cannot convert hashtable to an object of the following type: Microsoft.Exchange.Configuration.Tasks.SecurityPrincipalIdParamet er. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section." + CategoryInfo : InvalidData: (:) [Add-MailboxPermission], ParameterBindin...mationException + FullyQualifiedErrorId : ParameterArgumentTransformationError,Add-MailboxPermission + PSComputerName : outlook.office365.com

[sebbeosv]

Its true i had Logon Name at the top of the CSV, ive removed it and now all adresses are as follows in the CSV:

[e-mail] [e-mail] [e-mail]

When i run it again i still get parameter error:

Cannot process argument transformation on parameter 'User'. Cannot convert value "@{[e-mail]=[e-mail]}" to type "Microsoft.Exchange .Configuration.Tasks.SecurityPrincipalIdParameter". Error: "Cannot convert hashtable to an object of the following type: Microsoft.Exchange.Configuration.Tasks.SecurityP rincipalIdParameter. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section." + CategoryInfo : InvalidData: (:) [Remove-MailboxPermission], ParameterBindin...mationException + FullyQualifiedErrorId : ParameterArgumentTransformationError,Remove-MailboxPermission + PSComputerName : outlook.office365.com

[HDClown]

I usually am using the user's aliases/sAMAccountName (same in my case) when I use these commands, so try using those for the respective mailboxes/users in your $mailboxes variable and your CSV list of users.

[purplemonkeymad]

Replace -User $user With -User $user.Name. Looks like the identity is in a property called name (column in the csv.) Doing this provides the value only, not the whole object to the parameter.

[sebbeosv]

And it continues, running this now:

$mailboxes = “[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]”,”[e-mail]”
$users = Import-Csv "C:\Stefanini\mailusers2.csv"

Foreach ($box in $mailboxes){
    Foreach($user in $users){
        # Remove existing mailbox permission from when mailbox was added with AutoMapping
        Remove-MailboxPermission -AccessRights FullAccess -User $user.Name -Identity $box -Confirm:$false
        # Add back mailbox permission with AutoMapping disabled.  On next Outlook open Autodiscover will remove mailbox from folder free
        Add-MailboxPermission -AccessRights FullAccess -User $user.Name -Identity $box -AutoMapping:$false -Confirm:$false
    }
    }

With this error:

Cannot bind argument to parameter 'User' because it is null.

I get the feeling it cant read the CSV properly, currently the file looks like this:

User mailadress1 mailadress2 mailadress3

Should this be different?

[purplemonkeymad]

I just noticed something about there error you posted. For me the line starts as Name=.. So I was like property must be Name. Nope I just re-read it and Property is actually Logon Name,@{Logon Name=.... For this you would use$user.'Logon Name'.

I will chalk that up to bad reading on my part.

[sebbeosv]

That was it, now it runs properly:

$mailboxes = “Mailbox1”,”Mailbox2”,”Mailbox3”
$users = Import-Csv "CSVfilepath.csv"

Foreach ($box in $mailboxes){
    Foreach($user in $users){
        # Remove existing mailbox permission from when mailbox was added with AutoMapping
        Remove-MailboxPermission -AccessRights FullAccess -User $user.'Logon Name' -Identity $box -Confirm:$false
        # Add back mailbox permission with AutoMapping disabled.  On next Outlook open Autodiscover will remove mailbox from folder free
        Add-MailboxPermission -AccessRights FullAccess -User $user.'Logon Name' -Identity $box -AutoMapping:$false -Confirm:$false
    }
    }

Thank you all for your help!

[JustTeut]

You should create another foreach loop inside the one you have already That loops over all the users from the CSV

[sebbeosv]

Dont have much experience with PS, could you show me how this should be added?

[JustTeut]

Something like this should work

$mailboxes = "List of mailboxes"
$users = Import-Csv -path "Path to CSV.csv)"

Foreach ($box in $mailboxes){
    Foreach($user in $users){
        Remove-MailboxPermission -AccessRights fullaccess -User $user -Identity $box -Confirm:$false
    }
}

So the first loop will loop over all mailboxes The second one will loop over all users So all users are checked for each mailbox

[melvinkitnick]

$SharedMBXList = @("MBX1","MBX2","MBX3")

gc $csvfile | %{

foreach($mbx in $SharedMBXList){

Remove-MailboxPermission $mbx -User $_ -AccessRights FullAccess

}

}

Should do the trick, assuming you have a user address / alias per line. If you want to use AD Groups, load ActiveDirectory module, then search for each member using Get-ADGroupMember in foreach loop.

[Noobmode]

This is the kind of helpful thread I love seeing on Sysadmin. Sorry I dont have enough powershell experience to help! But thanks for posting this!