Exchange 2016批量移除共享邮箱权限及恢复脚本需求

一、通过CSV批量移除权限 #

步骤1：准备CSV文件 #

创建名为RemovePermissions.csv的文件，包含共享邮箱标识和需要移除权限的用户两列，示例格式如下：

SharedMailbox,User
SalesShared,user1@domain.com
SalesShared,user2@domain.com
SupportShared,user3@domain.com

步骤2：执行批量移除命令 #

在Exchange Management Shell中运行以下脚本，遍历CSV完成批量操作：

Import-Csv .\RemovePermissions.csv | ForEach-Object {
    # 移除常规邮箱权限
    Remove-MailboxPermission -Identity $_.SharedMailbox -User $_.User -AccessRights FullAccess,ExternalAccount,DeleteItem,ReadPermission,ChangePermission,ChangeOwner -InheritanceType All -Confirm:$false
    # SendAs权限需单独用Remove-RecipientPermission处理（不属于邮箱权限范畴）
    Remove-RecipientPermission -Identity $_.SharedMailbox -Trustee $_.User -AccessRights SendAs -Confirm:$false
}

提示：可添加-WhatIf参数预览操作，确认无误后再移除该参数执行实际操作。

二、权限回滚方案（批量恢复权限） #

回滚的核心是提前导出权限备份，操作步骤如下：

步骤1：导出权限备份 #

在执行移除操作前，将目标共享邮箱的权限导出到CSV文件：

# 导出单个共享邮箱的常规权限
Get-MailboxPermission -Identity "Sharedmailbox" | Where-Object { $_.User -notlike "NT AUTHORITY\SELF" } | Select-Object @{Name='SharedMailbox';Expression={"Sharedmailbox"}},User,AccessRights,InheritanceType | Export-Csv .\MailboxPermissionsBackup.csv -NoTypeInformation

# 导出单个共享邮箱的SendAs权限
Get-RecipientPermission -Identity "Sharedmailbox" | Where-Object { $_.Trustee -notlike "NT AUTHORITY\SELF" } | Select-Object @{Name='SharedMailbox';Expression={"Sharedmailbox"}},Trustee,AccessRights | Export-Csv .\SendAsPermissionsBackup.csv -NoTypeInformation

如果需要批量导出多个共享邮箱的权限，可先准备包含共享邮箱列表的CSV（列名MailboxName），再运行：

Import-Csv .\SharedMailboxes.csv | ForEach-Object {
    $mailbox = $_.MailboxName
    # 导出常规权限
    Get-MailboxPermission -Identity $mailbox | Where-Object { $_.User -notlike "NT AUTHORITY\SELF" } | Select-Object @{Name='SharedMailbox';Expression={$mailbox}},User,AccessRights,InheritanceType | Export-Csv .\AllMailboxPermissionsBackup.csv -Append -NoTypeInformation
    # 导出SendAs权限
    Get-RecipientPermission -Identity $mailbox | Where-Object { $_.Trustee -notlike "NT AUTHORITY\SELF" } | Select-Object @{Name='SharedMailbox';Expression={$mailbox}},Trustee,AccessRights | Export-Csv .\AllSendAsPermissionsBackup.csv -Append -NoTypeInformation
}

步骤2：导入备份恢复权限 #

需要回滚时，运行以下脚本从备份CSV恢复权限：

# 恢复常规邮箱权限
Import-Csv .\AllMailboxPermissionsBackup.csv | ForEach-Object {
    Add-MailboxPermission -Identity $_.SharedMailbox -User $_.User -AccessRights $_.AccessRights -InheritanceType $_.InheritanceType -Confirm:$false
}

# 恢复SendAs权限
Import-Csv .\AllSendAsPermissionsBackup.csv | ForEach-Object {
    Add-RecipientPermission -Identity $_.SharedMailbox -Trustee $_.Trustee -AccessRights $_.AccessRights -Confirm:$false
}

内容的提问来源于stack exchange，提问作者Tommy