Updating the Managed By Property in Exchange 2010 Using PowerShell

I ran into an interesting problem that actually encapsulated two different problems.

I have a .csv file that has the names of Distribution Groups and the Users that need to have Managed By permissions so they can update the members of the Distribution Group. The file contents look like this:

Identity,User

Contoso.com/Distribution Lists/DG1,contoso\russ.kaufmann

Contoso.com/Distribution Lists/DG1,contoso\mother.goose

Contoso.com/Distribution Lists/DG1,contoso\jack.b.quick

Contoso.com/Distribution Lists/DG1,contoso\BigBad.Wolf

Contoso.com/Distribution Lists/DG2,contoso\russ.kaufmann

Contoso.com/Distribution Lists/DG2,contoso\BigBad.Wolf

The Identify field is the name of the distribution group. The User field is the name of the user that needs to be in the Managed By list.

Side Note: In Exchange 2003, if you needed multiple people to manage a DG, you could add one of them to the Managed By field for the DG, but you needed to add the others by using Active Directory permissions on the DG object in AD. During migrations, this is a bit of a PITA, especially if you are talking about thousands of DGs.

Problem #1 is this: If you use a simple script and read in the .csv file and then run a Set-DistributionGroup command against each name, it ends up overwriting the field. So, in the case above, if you were to run the command Set-DistributionGroup –identity DG1 –managedby russ.kaufmann, it would work fine. Then, if you use a foreach loop, it would then run the same command and use mother.goose, and so on down the list to add jack.b.quick, and then BigBad.Wolf. The result would be that the ManagedBy field would include only the BigBad.Wolf. In other words, it would overwrite, not add. There is no add option for multivalued fields when it comes to PowerShell.

Problem #2 is this: When it comes to Exchange and PowerShell, you need to be careful when it comes to using commands that run against Exchange objects and properties and commands that run against Active Directory objects and properties. There can be problems when using the two in the same script or in pipelined commands.

I took several swings at this one and failed miserably because of both problems. After lots of research and asking lots of questions, Byron Wright gave me the key to my answer. Thanks, Byron!

Here is what works:

$Data = Import-csv DLUpdateList.txt

foreach ($i in $Data) {

$DG = Get-DistributionGroup $i.identity

$MB = $DG.ManagedBy

$NewUser = get-user $i.user

$NewMB = $MB += $NewUser

Set-DistributionGroup $i.identity -managedby $NewMB -bypasssecuritygroupmanagercheck

}

Advertisements