Active Directory / Exchange: Convert User + Email into Only Shared Email

Question

I want to convert an exchange user account / email to just a shared email with an access group.

Scenario:

I have a windows active directory network with a user account called "mydomain\bob". I can log into computers and Outlook Web App (OWA) because I created an email when I made it: [email protected]

However, I want to treat "bob" as a shared email, normally this should be pretty easy I assume, but to make it more difficult, I cannot delete the user account (and start with just an email) because I need to preserve all emails (unless I could somehow export them all and then import). So in PowerShell I did: "Set-Mailbox bob -Type:Shared"

I also don't want anybody to be able to log into a computer with "mydomain\bob", I only want them to get into Outlook Web App. How can I remove the "bob" account from the "bob" email on the exchange server without deleting "bob"?

I'm following this tutorial on making a shared email in OWA and I have a group called "Mail Access Group" that I want to add people to, to give them mail access, but this command fails:

[PS] C:\Windows\system32>Add-ADPermission 'bob' -User:'Mail Access Group' -ExtendedRights:Send-As -AccessRights:ReadProperty, WriteProperty -Properties:'Personal Information'
There are multiple objects matching the identity "bob". Please specify an unique value.
    + CategoryInfo          : NotSpecified: (0:Int32) [Add-ADPermission], ManagementObjectAmbiguousException
    + FullyQualifiedErrorId : 509FB2E4,Microsoft.Exchange.Management.RecipientTasks.AddADPermission

Update

I managed to temporarily change the "Name" field and and it allowed me to run the command. I disabled the account originally related to the email (on the domain server), and the email is still active. However, I can't seem to add the mailbox via OWA under any of the users in the access group.

Answer 1

Solution

1. Change the email group to Shared.
2. Make sure that changing the email group to shared, disabled the uer account. If not, disable.
3. In order to run the "Add-ADPermission" command to allow group access permissions, temporarily change the email account's "Name" field in the GUI admin, run the command.
4. Wait a few hours for propagation (of course you will also have to add users to the access group).