批量移除离职用户邮箱权限时遇空值转换错误求助

问题背景 #

需要批量移除CSV文件中离职用户的邮箱权限，手动操作效率过低，编写PowerShell脚本后持续报错Cannot convert value "" to type，错误提示User参数无法将空值转换为Microsoft.Exchange.Configuration.Tasks.SecurityPrincipalIdParameter类型，无法定位空值传递原因。

报错脚本 #

$users = Import-Csv C:\users\__xxxxxxxx\Downloads\mailbox_cleanup_090624.csv
$mailboxes = Get-Mailbox -Filter 'customattribute3 -eq "[yyy]"' 

foreach($user in $users){
    $user_in_mailboxes = foreach($mailbox in $mailboxes){ Get-MailboxPermission $mailbox -User $user}

    foreach($user_in_mailbox in $user_in_mailboxes) {
        Remove-MailboxPermission $user_in_mailbox -User $user -AccessRights Fullaccess -Confirm:$false
        Remove-RecipientPermission $user_in_mailbox -AccessRights SendAs -Trustee $user -Confirm:$false
    }
}

错误详情 #

Write-ErrorMessage : Cannot process argument transformation on parameter 'User'. Cannot convert value "" to type 
"Microsoft.Exchange.Configuration.Tasks.SecurityPrincipalIdParameter". Error: "Parameter values of type 
Microsoft.Exchange.Configuration.Tasks.SecurityPrincipalIdParameter can't be empty. Specify a value, and try again. 
(Parameter 'identity')"
At C:\Users\__xxxxxxxxx\AppData\Local\Temp\tmpEXO_uwaajssr.23n\tmpEXO_uwaajssr.23n.psm1:1205 char:13
+             Write-ErrorMessage $ErrorObject
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-MailboxPermission], ParameterTransformationException
    + FullyQualifiedErrorId : [Server=PH7PR19MB6852,RequestId=85f202a1-8c41-a70c-2540-72dc0cd30369,TimeStamp=Fri, 06 Sep 20 
   24 20:58:11 GMT],Write-ErrorMessage

正常单用户操作脚本 #

$user = 'zzzz'
$mailboxes = Get-Mailbox -Filter 'customattribute3 -eq "[yyy]"' | Get-MailboxPermission -User $user
$mailboxes

foreach($mailbox in $mailboxes) {
    Remove-MailboxPermission $mailbox -User $user -AccessRights Fullaccess -Confirm:$false
    Remove-RecipientPermission $mailbox -AccessRights SendAs -Trustee $user -Confirm:$false
    }

问题原因 #

1. CSV数据解析错误：Import-Csv读取的对象中，未指定具体用户标识字段（如UPN、邮箱地址），直接传递整个CSV对象给-User参数，导致Exchange无法解析为有效用户标识，最终出现空值错误。
2. CSV内容异常：CSV文件中存在空的用户记录，导入后生成了空值的用户对象。

解决方案 #

步骤1：确认CSV文件结构 #

确保CSV包含明确的用户标识列，比如列名为UserPrincipalName或SamAccountName，内容为离职用户的UPN或域账号名。可先运行以下命令验证数据：

Import-Csv C:\users\__xxxxxxxx\Downloads\mailbox_cleanup_090624.csv | Select-Object *

步骤2：修改脚本，正确传递用户标识 #

调整脚本提取CSV中的用户标识字段，增加空值校验，优化权限查询逻辑：

$csvPath = "C:\users\__xxxxxxxx\Downloads\mailbox_cleanup_090624.csv"
# 导入CSV，替换为实际用户标识列名
$users = Import-Csv -Path $csvPath
$mailboxes = Get-Mailbox -Filter 'customattribute3 -eq "[yyy]"'

foreach ($user in $users) {
    # 提取用户标识，根据CSV列名修改
    $userId = $user.UserPrincipalName
    
    # 跳过空值用户
    if ([string]::IsNullOrWhiteSpace($userId)) {
        Write-Warning "发现空用户记录，已跳过"
        continue
    }

    # 获取该用户拥有权限的邮箱
    $userPermissions = $mailboxes | Get-MailboxPermission -User $userId -ErrorAction SilentlyContinue

    foreach ($perm in $userPermissions) {
        # 移除完全访问权限
        Remove-MailboxPermission -Identity $perm.Identity -User $userId -AccessRights FullAccess -Confirm:$false
        # 移除发送权限
        Remove-RecipientPermission -Identity $perm.Identity -Trustee $userId -AccessRights SendAs -Confirm:$false -ErrorAction SilentlyContinue
    }
}

额外优化建议 #

• 添加-ErrorAction SilentlyContinue避免单个用户/权限不存在导致脚本中断
• 增加日志输出，记录每个用户的处理结果
• 测试阶段可注释掉Remove-*命令，先用Write-Output验证待处理的权限条目

内容的提问来源于stack exchange，提问作者Cisco Abril