Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland

Microsoft Exchange – Set Address Book Policy to multiple users based on group membership

MicrosoftE xchange

One of the common tasks of Exchange Administrator is to add Exchange Address Book Policy to a user. Depending on needs of organization there may be a need to add address book policies based on their group membership which often are inside other groups. Below solution helps to solve this task. In our case this little script runs every 24 hours making sure the group membership is updated in Global Address Book properly. There's also an updated version of this article, with newer, updated code that can be found here.

Solution

Administrator needs 2 methods to be able to set address book properly:

function Get-GroupMembershipRecursive ($group) {
    $SubGroup = @{}
    $AllMembers = @()
    if(!$group)
    {
        $group = Read-Host "Please enter the groups display name"
    }
    if ($group.Contains("'"))
    {
        $group = $group.Replace("'",'"')
    }
    if ($group -eq "/?")
    {
        Write-Host "Usage:"
        Write-Host ""
        Write-Host "Get-GroupMembershipRecursive -group <group name>"
        Write-Host ""
        Write-Host "or Get-GroupMembershipRecursive <group name>"
        Write-Host "Returns an object containing multiple values."
        break
    }

    $validate = Get-Group $group
    if ($validate.RecipientTypeDetails.ToString() -match "mail")
    {
        $searchGroup = Get-DistributionGroupMember $group
        #write-host 1.1 $searchGroup
        if ($searchGroup)
        {    
            foreach ($member in $searchGroup)
            {
                $membertype = $member.RecipientTypeDetails
                #if($membertype -match "Group")
                if ($membertype -match "MailUniversalSecurityGroup" -or $membertype -match "MailUniversalDistributionGroup")
                {
                    $samname = $member.SamAccountName.ToString()
                    if ($SubGroup.ContainsKey($samname) -eq $true)
                    {
                        Write-Output "^ already seen group member (stopping to avoid loop)"
                    }
                     else
                    {
                        #write-host 1.6 $samname " or " $member.DisplayName
                        $SubGroup.Add($samname,$member.DisplayName.ToString())
                    }
                }    
                else
                {
                    if($member.PrimarySmtpAddress -and $member.RecipientTypeDetails -notcontains "group")
                    {
                        $obj = new-object psObject
                        $obj | Add-Member -membertype noteproperty -Name GroupMember -Value $member.name
                        $obj | Add-Member -MemberType noteproperty -Name Group -Value $group 
                        $obj | Add-Member -MemberType noteproperty -Name SubGroup -Value $group
                        $obj | Add-Member -MemberType NoteProperty -Name RecipientType -Value $member.RecipientType
                        $obj | Add-Member -MemberType NoteProperty -Name PrimarySmtpAddress -Value $member.PrimarySmtpAddress
                        $AllMembers += $obj
                    }                    
                }
            }
        }
        else
        {
            $UnknownGroup.add($group,1)
        }
        if($SubGroup.Values.Count -gt 0)
        {
            #write-host 1.5 $SubGroup.Values.Count
            foreach ($subGroup in $SubGroup.values)
            {
                #DisplayMembers $subGroup
                #write-host 1.4 $subgroup "or " $SubGroup.Values 
                $searchGroup = Get-DistributionGroupMember $subGroup
                #write-host 1.2
                foreach ($member in $searchGroup) {                
                        $obj = new-object psObject
                        $obj | Add-Member -membertype noteproperty -Name GroupMember -Value $member.name
                        $obj | Add-Member -MemberType noteproperty -Name Group -Value $group 
                        $obj | Add-Member -MemberType noteproperty -Name SubGroup -Value $subGroup
                        $obj | Add-Member -MemberType NoteProperty -Name RecipientType -Value $member.RecipientType
                        $obj | Add-Member -MemberType NoteProperty -Name PrimarySmtpAddress -Value $member.PrimarySmtpAddress
                        $AllMembers += $obj
                }

            }
        }
        if ($UnknownGroup.Keys.Count -gt 0)
        {
            foreach ($LostGroup in $UnknownGroup.keys)
            {
                $obj = new-object psObject
                $obj | Add-Member -membertype noteproperty -name GroupMember -Value "Cannot enumerate group"
                $obj | Add-Member -MemberType noteproperty -Name Group -Value $group 
                $obj | Add-Member -MemberType noteproperty -Name SubGroup -Value $LostGroup
                $obj | Add-Member -MemberType NoteProperty -Name RecipientType -Value ""
                $obj | Add-Member -MemberType NoteProperty -Name PrimarySmtpAddress -Value ""
                $AllMembers += $obj
            }
            $UnknownGroup.Clear()
        }    
    }    
    else
    {
        Write-Output "$group does not appear to be mail enabled."
    }
    Write-Output $AllMembers
}
function SetAddressBookPolicy ([string] $AddressBookPolicy, [string] $SetOnGroup) {

    $members = Get-GroupMembershipRecursive $SetOnGroup
    #$members | ft GroupMember, Group, SubGroup, RecipientType, PrimarySmtpAddress -AutoSize
    foreach ($member in $members) {

           if ($member.RecipientType -eq "UserMailbox") {
                Set-Mailbox $member.PrimarySmtpAddress -AddressBookPolicy $AddressBookPolicy
           }
    }
}

Usage of those methods:

SetAddressBookPolicy -AddressBookPolicy "<addres_book_policy>" -SetOnGroup "<distribution_group"

Get-GroupMembershipRecursive method is supportive method to make sure that each member of group within group will also get the Address Book Policy applied. Remember to use following commands to make sure the Global Address List, Address Lists and Offline Address Book are all up to date.

Get-GlobalAddressList | Update-GlobalAddressList
Get-AddressList | Update-AddressList
Get-OfflineAddressBook | Update-OfflineAddressBook

Notes

Please be aware that the script doesn't actually display anything during setting of address book policy. Only warning are displayed if the address book is already assigned to the mailbox.

Related Posts

Leave a comment

You must be logged in to post a comment.