Things To Know About GBPR.vbs

The GBPR.vbs script groups mailboxes according to the relationships defined by the permissions that mailbox owners have granted to other users and mailboxes. One problem you might run into is that any two people in an organization can be linked through transitive association. In large organizations, the script generates a massive relationship matrix as it compares these associations and can sometimes cause an Out of Memory runtime error. You can usually resolve this problem by running the script on a machine with more memory. At extremely large sites, I've had to run the script on a server that has 2GB of memory.

To prevent this problem in the first place, you can set a boundary on which permissions the script considers when determining an association. Listing A shows an excerpt from GBPR.vbs that tells the script which roles to consider when evaluating an MBInfo file. You can remove roles from consideration by commenting out selected lines. In the excerpt, the script doesn't consider the Reviewer, Contributor, or Non-editing Author roles. If you need to consider one of these roles, simply remove the apostrophe (') at the beginning of each applicable line. If you don't want the script to consider a role, add an apostrophe to comment out the appropriate line.

To give you an idea how these changes can affect processing, running the script as shown in Listing A in a site with more than 4400 mailboxes produced 40 groups, with the largest group having 1700 members. Running the script with all roles enabled produced 36 groups, with 2531 members in the largest group.

Another way to govern group size and processing requirements is to limit the number of mailboxes being processed. Permissions are usually granted within site boundaries, so run the script on a site-by-site basis.

As I mention in the main article, Exchange Administrator output can include domain security groups in the Primary Windows NT Account and Obj-Users fields, and MBInfo output often includes domain distribution groups (DGs) in its object-permissions pairs. GBPR.vbs doesn't process relationships that involve permissions granted to groups. If you need to assess groups, you'll need to modify the script to expand group memberships before it begins processing relationships.

GBPR.vbs also doesn't consider custom permission sets. The number of custom-permissions permutations that might be found in MBInfo output is too great for the script to consider each and every combination, so it considers only the standard permissions profiles listed in Web Table 1 in the main article.