Home / server / Questions / 1080898
Accepted
Michael Uray
Asked: 2021-10-19 05:01:23 +0800 CST

Apply Exchange Public Folder Permission import via Import-CliXML

  • 772

I did run into the situation that I lost all my public folder permissions which were assigned via groups.

Before the migration started from our MSEX2016 server to Office 365, all the permissions got exported to a XML file, what I think (described on this Microsoft page) happened with the following command:

Get-PublicFolder -Recurse -ResultSize Unlimited | Get-PublicFolderClientPermission | Select-Object Identity,User,AccessRights -ExpandProperty AccessRights | Export-CliXML OnPrem_PFPerms.xml

The output file "OnPrem_PFPerms.xml" has about 5 GB. That sounds a lot to me for permissions only on a about 300 GB PF structure, but maybe is its huge size cause by the complexity of the XML format. 7-Zip compression brings it down to 25 MB, means there is a lot of redundant data in it.

On our MSEX2010 which got migrated to MSEX2016 before is a "Legacy_PFPerms.xml" file with about 500 MB.

What would be the proper PowerShell command to apply all the permissions from the XML file to the public folder structure on the Office 365 / Exchange online?

I guess Import-CliXML would do the job somehow, but I am not that familiar with PowerShell to build the right command.

exchange permissions microsoft-office-365 import public-folders

3 Answers

  1. Best Answer

    Finally the following PowerShell script allowed me to apply all the permissions from the XML file to the public folder structure. Thanks to Ivan_Wang who led me to the right direction with his answer.

    $pfs = Import-Clixml -Path OnPrem_PFPerms.xml

foreach($pf in $pfs)
{
Add-PublicFolderClientPermission -Identity ("\" + $($pf.Identity.MapiFolderPath -join "\")) -User $pf.User.DisplayName -AccessRights $pf.AccessRights[0].ToString()
}

    Is is also possible to split that up in multiple PowerShell sessions to apply the changes faster since it runs pretty slow.

    1. PS session: foreach($pf in $pfs[0..2000]) ...

    2. PS session: foreach($pf in $pfs[2001..4000])...

    ...

    Do not run too many sessions at one, otherwise it will interrupt the connection to Exchange Online with the following message: The request is not serviced on the server. Your request is too frequent.

    • 2

  2. What're the properties included in the .xml file? If there are Identity and User, AccessRights, you could try:

    $pfs = Import-Clixml -Path OnPrem_PFPerms.xml
foreach($pf in $pfs)
{
Add-PublicFolderClientPermission -Identity $pf.Identity -User $pf.User -AccessRights $pf.AccessRights
}

    Based on your command above, it seems to export only the AccessRights object. If so, you may need to export the current ACL list in Exchange Online to a .csv file:

    Get-PublicFolder -Recurse -ResultSize Unlimited | Get-PublicFolderClientPermission | Select-Object Identity,User,@{n="AccessRights";e={[String]($_.AccessRights)}} -ExpandProperty AccessRights | Export-Csv pf.csv

    And assign permissions of the public folders to your users again via PowerShell(For existing permission entries, PowerShell will report a warning: An existing permission entry was found for user):

    $pfs = Import-Csv pf.csv
foreach($pf in $pfs)
{
Add-PublicFolderClientPermission -Identity $pf.Identity -User $pf.User -AccessRights $pf.AccessRights
}
    • 1

  3. If the source Exchange server is still available you can use the following to export the Public Folder client permissions to a CSV file and import them into Office 365. You'll probably need to edit the source CSV file to edit the usernames to match the Office 365 usernames for each user present in the permissions.

    Export Public Folder permissions to CSV:

    Get-PublicFolder -Recurse | Get-PublicFolderClientPermission | Select Identity, User, @{ expression={$_.AccessRights}; label='AccessRights' } | Export-Csv C:\Temp\PublicFolderClientPermission.csv

    Import Public Folder permissions from CSV:

    $Users= Import-CSV C:\Temp\PublicFolderClientPermission.csv foreach ($User in $Users){Get-PublicFolder -Identity $($User.identity) | add-publicfolderclientpermission -AccessRights $User.AccessRights -User $User.User}

    • 0