Enable-MailDynamicGroup.ps1
|
<#
.SYNOPSIS This function enables the dynamic group for hybird mail flow. .DESCRIPTION This function enables the dynamic group for hybird mail flow. .PARAMETER GlobalCatalogServer The global catalog to make the query against. .PARAMETER routingContactConfig The original DN of the object. .PARAMETER originalDLConfiguration The original DN of the object. .PARAMETER isRetry This specifies if the operation is being retried after a failure. .OUTPUTS None .EXAMPLE enable-mailDynamicGroup -globalCatalogServer GC -routingContactConfig contactConfiguration -originalDLConfiguration DLConfiguration #> Function Enable-MailDyamicGroup { [cmdletbinding()] Param ( [Parameter(Mandatory = $true)] [string]$globalCatalogServer, [Parameter(Mandatory = $true)] $routingContactConfig, [Parameter(Mandatory = $true)] $originalDLConfiguration, [Parameter(Mandatory = $false)] $isRetry=$FALSE ) #Output all parameters bound or unbound and their associated values. write-functionParameters -keyArray $MyInvocation.MyCommand.Parameters.Keys -parameterArray $PSBoundParameters -variableArray (Get-Variable -Scope Local -ErrorAction Ignore) [string]$isTestError="No" #Declare function variables. $functionEmailAddress=$NULL #Start function processing. Out-LogFile -string "********************************************************************************" Out-LogFile -string "BEGIN Enable-MailDyamicGroup" Out-LogFile -string "********************************************************************************" #Log the parameters and variables for the function. #Create the dynamic distribution group. #This is very import - the group is scoped to the OU where it was created and uses the two custom attributes. #If the mail contact is ever moved from the OU that the DL originally existed in - hybrid mail flow breaks. try{ out-logfile -string "Creating dynamic group..." if ($isRetry -eq $false) { $tempOUSubstring = Get-OULocation -originalDLConfiguration $originalDLConfiguration new-dynamicDistributionGroup -name $originalDLConfiguration.name -alias $originalDLConfiguration.mailNickName -primarySMTPAddress $originalDLConfiguration.mail -organizationalUnit $tempOUSubstring -domainController $globalCatalogServer -includedRecipients AllRecipients -conditionalCustomAttribute1 $routingContactConfig.extensionAttribute1 -conditionalCustomAttribute2 $routingContactConfig.extensionAttribute2 -displayName $originalDLConfiguration.DisplayName } else { $tempOUSubstring = Get-OULocation -originalDLConfiguration $routingContactConfig new-dynamicDistributionGroup -name $originalDLConfiguration.name -alias $originalDLConfiguration.Alias -primarySMTPAddress $originalDLConfiguration.windowsEmailAddress -organizationalUnit $tempOUSubstring -domainController $globalCatalogServer -includedRecipients AllRecipients -conditionalCustomAttribute1 $routingContactConfig.extensionAttribute1 -conditionalCustomAttribute2 $routingContactConfig.extensionAttribute2 -displayName $originalDLConfiguration.DisplayName } } catch{ out-logfile -string $_ $isTestError="Yes" return $isTestError } #All of the email addresses that existed on the migrated group need to be stamped on the new group. if ($isRetry -eq $FALSE) { foreach ($address in $originalDLConfiguration.proxyAddresses) { out-logfile -string ("Adding proxy address = "+$address) #If the address is not a mail.onmicrosoft.com address - stamp it. #Otherwise skip it - this is because the address is stamped on the mail contact already. if (!$address.contains("mail.onmicrosoft.com")) { out-logfile -string "Address is not a mail.onmicrosoft.com address." try{ set-dynamicdistributionGroup -identity $originalDLConfiguration.mail -emailAddresses @{add=$address} -domainController $globalCatalogServer } catch{ out-logfile -string $_ $isTestError="Yes" return $isTestError } } else { out-logfile -string "Address is a mail.onmicrosoft.com address - skipping." } } } else { foreach ($address in $originalDLConfiguration.emailAddresses) { out-logfile -string ("Adding proxy address = "+$address) #If the address is not a mail.onmicrosoft.com address - stamp it. #Otherwise skip it - this is because the address is stamped on the mail contact already. if (!$address.contains("mail.onmicrosoft.com")) { out-logfile -string "Address is not a mail.onmicrosoft.com address." try{ set-dynamicdistributionGroup -identity $originalDLConfiguration.windowsEmailAddress -emailAddresses @{add=$address} -domainController $globalCatalogServer } catch{ out-logfile -string $_ $isTestError="Yes" return $isTestError } } else { out-logfile -string "Address is a mail.onmicrosoft.com address - skipping." } } } #The legacy Exchange DN must now be added to the group. if ($isRetry -eq $FALSE) { $functionEmailAddress = "x500:"+$originalDLConfiguration.legacyExchangeDN out-logfile -string $originalDLConfiguration.legacyExchangeDN out-logfile -string ("Calculated x500 Address = "+$functionEmailAddress) try{ set-dynamicDistributionGroup -identity $originalDLConfiguration.mail -emailAddresses @{add=$functionEmailAddress} -domainController $globalCatalogServer } catch{ out-logfile -string $_ $isTestError="Yes" return $isTestError } } else { out-logfile -string "X500 added in previous operation since it already existed on the group." } #The script intentionally does not set any other restrictions on the DL. #It allows all restriction to be evaluated once the mail reaches office 365. #The only restriction I set it require sender authentication - this ensures that anonymous email can still use the DL if the source is on prem. if ($isRetry -eq $FALSE) { if ($originalDLConfiguration.msExchRequireAuthToSendTo -eq $NULL) { out-logfile -string "The sender authentication setting was not set - maybe legacy version of Exchange." out-logfile -string "The sender authentication setting value FALSE in this instance." try { set-dynamicdistributionGroup -identity $originalDLConfiguration.mail -RequireSenderAuthenticationEnabled $FALSE -domainController $globalCatalogServer } catch { out-logfile -string $_ $isTestError="Yes" return $isTestError } } else { out-logfile -string "Sender authentication setting is present - retaining setting as present." try { set-dynamicdistributionGroup -identity $originalDLConfiguration.mail -RequireSenderAuthenticationEnabled $originalDLConfiguration.msExchRequireAuthToSendTo -domainController $globalCatalogServer } catch { out-logfile -string $_ $isTestError="Yes" return $isTestError } } } else { try{ set-dynamicDistributionGroup -identity $originalDLConfiguration.windowsEmailAddress -RequireSenderAuthenticationEnabled $originalDLConfiguration.RequireSenderAuthenticationEnabled -domainController $globalCatalogServer } catch{ out-logfile -string "Unable to update require sender authentication on the group." out-logfile -string $_ -isError:$TRUE } } #Evaluate hide from address book. if ($isRetry -eq $FALSE) { if (($originalDLConfiguration.msExchHideFromAddressLists -eq $TRUE) -or ($originalDLConfiguration.msExchHideFromAddressLists -eq $FALSE)) { out-logfile -string "Evaluating hide from address list." try { set-dynamicdistributionGroup -identity $originalDLConfiguration.mail -HiddenFromAddressListsEnabled $originalDLConfiguration.msExchHideFromAddressLists -domainController $globalCatalogServer } catch { out-logfile -string $_ $isTestError="Yes" return $isTestError } } else { out-logfile -string "Hide from address list settings retained at default value - not set." } } else { try { set-dynamicdistributionGroup -identity $originalDLConfiguration.windowsEmailAddress -HiddenFromAddressListsEnabled $originalDLConfiguration.HiddenFromAddressListsEnabled -domainController $globalCatalogServer } catch { out-logfile -string $_ $isTestError="Yes" return $isTestError } } Out-LogFile -string "END Enable-MailDyamicGroup" Out-LogFile -string "********************************************************************************" } |