This show PowerShell script can be run from the Exchange Management Shell to grab the value from ManagedBy and write it back to the security descriptor. It’s a little messy, especially as there’s no way to check on the AD level if the box is ticked except by the security descriptor.

Function Get-Groups {
  $domainSearcher = New-Object DirectoryServices.DirectorySearcher
  $domainSearcher.Filter = ("(&(objectClass=group)(mail=*)(managedBy=*))")
  [Void]$domainSearcher.PropertiesToLoad.Add("managedby")
  [Void]$domainSearcher.PropertiesToLoad.Add("name")

  $objSearcher.FindAll() `
    | Select-Object `
      @{n="GroupName";e={$_.Properties.name}}, `
      @{n="ManagedBy";e={ ([ADSI]("LDAP://" + `
        $_.Properties.managedby)).Get("userPrincipalName") }}
}

Get-Groups | %{
  Add-ADPermission -Identity $_.GroupName -User $_.ManagedBy `
    -AccessRights WriteProperty -Properties "member" }

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.