0

I have a management scope and management role assignment set up which allow a service account to impersonate Exchange mailboxes belonging to users in a specified distribution list. I set up the management scope to evaluate whether a user was in the appropriate distribution list using the following Powershell:

New-ManagementScope -Name "ImpersonationScope" -RecipientRestrictionFilter {MemberOfGroup -eq "CN=Impersonated,CN=Users,DC=example,DC=com"}

All of that works as expected, but only considers users who are direct members of the Impersonated list. If I add a new distribution list to the Impersonated list, the service account will not be able to impersonate mailboxes belonging to users on this new list (unless that user is also in Impersonated).

I have determined that I can support multiple groups by either creating multiple scope + role assignment pairs as well as including multiple MemberOfGroup -eq predicates chained together with -or operators but would prefer a way to resolve nested groups.

Is there a way I can alter that expression to evaluate a user's group hierarchy recursively?

2 Answers 2

0

I'm not terribly familiar with the Exchange cmdlets or Exchange in general, but the basic AD cmdlets like Get-ADUser have a option called LDAPFilter which can be used instead of the standard Filter option.

Using LDAPFilter, you can use the LDAP_MATCHING_RULE_IN_CHAIN OID to query nested group memberships like this:

Get-ADUser -LDAPFilter "(memberOf:1.2.840.113556.1.4.1941:=CN=Impersonated,CN=Users,DC=example,DC=com)"

which will return all nested and direct members of that group.

You might be able to use the results of a query like that inside your RecipientRestrictionFilter.

3
  • Thanks Ryan, I see that your command yields exactly what I'm looking for but I'm not sure I understand how to incorporate it into the RecipientRestrictionFilter. I figured since your command is returning users, I could simply use your LDAP filter string in place of my group name and replace the MemberOfGroup relation with Name but I was still unable to impersonate users under nested groups. How would I need to alter my expression to use the results from that query inside the RecipientRestrictionFilter? I'm still new to Powershell so I'm afraid I might be missing something obvious here. Sep 2, 2015 at 15:37
  • What other filter options do you have available within RecipientRestrictionFilter? If you have something like MemberDn or Name, you might be able to store the results of the Get-ADUser query in an array and then use the "-in" operator like "MemberDn -in $myarray" Sep 2, 2015 at 17:56
  • Quite a few actually: link. Admittedly I had forgotten there were so many so I will need to read up and try a few more with your LDAP filter... I would think the array suggestion would work, however I neglected to mention the Impersonated group will not be static – I believe the management scope needs to resolve the current set of users each time an attempt at mailbox impersonation is made. Ideally I would not require end users to alter the management scope when nested groups are added or change. Sep 2, 2015 at 19:58
0

I believe that all new groups have to be mail enabled to allow for exchange permissions to apply to them, can you ensure that the new group you are adding is mail enabled distribution group, this can be done with security groups also.

The cmdlet is Enable-DistributionGroup

1
  • Thanks Nick, I believe you are correct about requiring a mailbox in order to Exchange permissions to be applicable, but in this case the distribution groups did have mailboxes assigned to them. Sep 2, 2015 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .