# EXCAL-ARIGHTS

[![Donate][link-icon-coffee]][link-paypal-me] [![Website][link-icon-website]][link-website]

[link-icon-coffee]: https://img.shields.io/badge/%E2%98%95-Buy%20me%20a%20cup%20of%20coffee-991481.svg
[link-paypal-me]: https://www.paypal.me/EndMove/2.5eur
[link-icon-website]: https://img.shields.io/badge/%F0%9F%92%BB-My%20Web%20Site-0078D4.svg
[link-website]: https://www.endmove.eu/

__Current version : *1.1.1*__

## Description

ExCal-ARights is a script to automate the change of permissions on Microsoft Exchange Server calendars. This script allows you to define your own configuration (see [Use->Configuration](#configuration)). Moreover, any action performed by ExCal-ARights is recorded so that you can confirm and view the changes after application.

You can also choose to quit the script before starting the change of permissions. As well as previewing the permissions of all calendars before and after the change. The permissions preview does not consider the configuration filters, it previews all users.

## Requierements

To use this script you need the following software and libraries. See the installation section for more information.

* Windows `>= v7` ;
* Windows ExecutionPolicy `== Unrestricted` (default status on windows) ;
* PowerShell `>= v5.2` ;
* PowerShell's `ExchangeOnlineManagement` module `>= v2.0.5` ;
* Administrator account on the Exchange server.

### Installation

To install Windows 11 see the requirement at https://www.microsoft.com/en-us/windows/windows-11-specifications (check minimum version above). To install powershell 7 use the command below in your Pshell (check minimum version above).

```ps1
iex "& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI"
```

To install the powershell `ExchangeOnlineManagement` module execute the command below in Pshell.

```ps1
Install-Module -Name ExchangeOnlineManagement
```

Windows Policy Tips :

```ps1
Get-ExecutionPolicy                 # get the current policy
Get-ExecutionPolicy -List           # get the current policies on the all device

Set-ExecutionPolicy Unrestricted    # set the policy to unrestricted
Set-ExecutionPolicy Restricted      # set the policy to restricted
```

## Use

Clone or download and extract this repository from its archive. Open the `configs.ps1` script and configure it. Then run the `run-script.ps1` file and follow the indications. 

After the process you should find a log file with the process details.

### Exchange Server Structure

Regardons ici à quoi resemble la structure d'un server Exchange au niveau de la répartition des dossiers et permissions d'accès par utilisateur.

1. Is the first level and represents a user. ```[*1]```
2. Is the second level and represents a folder in our case a calendar. This level can contain several items (folders). ```[*2]```
3. Is the third level and represents the authorizations assigned to a specific user to the folder by the 1st level owner user. ```[*3]```
   * "**Default**" user represents the authorizations for all persons for which the authorizations have not been defined manually.
   * "**Anonymous**" user should have *None* permission (authorizations for anyone outside the organization). 

```
Exchange_Server:
├───User-1              [*1]
│   └───Calandar        [*2]
│       ├───Default     [*3]
│       └───Anonymous
├───User-2
│   └───Agenda
│       ├───Default
│       ├───Anonymous
│       └───User-3
└───User-3
    ├───Agenda-2
    │   ├───Default
    │   ├───Anonymous
    │   └───User-1
    └───Calandar
        ├───Default
        ├───Anonymous
        ├───User-1
        ├───User-2
        └───User-3
```

### Configuration

#### New permission

This variable allows you to configure the permission that will replace the current permission (if the current permission fires the trigger). You can find [here](https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission?view=exchange-ps#parameters) the list of permissions on the Microsoft website.

```ps1
$Permission = "Reviewer"
```

#### Trigger permission

This variable is used to define the list of permissions that should be changed. We call this list of permissions the list of triggers.

```ps1
$PermissionsTrigger = @("LimitedDetails", "AvailabilityOnly")
```

#### Folder to process

This variable defines the list of caller names to be processed. If a user has more than one calendar in this list, all calendars in the list will be impacted.

In the structure we are on the ``*2nd`` level.

```ps1
$CalandarFolders = @("Agenda", "Calendar", "Calendrier", "Kalender")
```

#### User to exclude

This variable defines a list of email aliases of users whose calendars should be ignored (in short, the calendars of these people will not be checked or processed). An alias is that part of the email address (``contact``@endmove.eu).

In the structure we are at the ``*1st`` level.

```ps1
$IgnoreAlias = @("jeremi.nihart", "contact.endmove")
```

#### Permission of user to skip

This variable defines a list of user names whose authorizations that the 1st level users have defined in their own calendars must be ignored.

In the structure we are on the ``*3rd`` level.

```ps1
$IgnoreUsers = @("Anonymous", "Nihart Jérémi", "Jone Michel")
```

#### Admin Exchange account

This variable defines the email of an administrator account with edit and write permissions on the Microsoft Exchange server.

```ps1
$AdminAccount = "admin@endmove.eu"
```

#### Logs file name

This variable defines the name of the log file. The `$Time` variable contains the complete date and time.

```ps1
$LogFile = "logs-$time.log"
```

#### Script name

This variable is used to define the name of the script, in our case ExCal-ARights.

```ps1
$ScriptName = "EXCAL-ARIGHTS"
```