#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : A shared mailbox or delegate access is missing, read-only, or will not send
    Fix   : Check the permission and give it time
    Source: https://jbtecwiz.com/support/win-office-shared-mailbox

    Run as     : Exchange Online PowerShell, as an administrator
    Expect     : 1 hour
    Risk       : low
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    The mailbox is not appearing. Confirm the grant is actually there before
    touching the client.

    HOW TO UNDO IT
    Remove-MailboxPermission withdraws the access again. Removing and
    re-adding does not affect the mailbox contents.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    'example.com'   # a placeholder domain
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

# This fix is documented as needing an elevated session.
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host ''
    Write-Host '  This fix needs an elevated PowerShell.' -ForegroundColor Yellow
    Write-Host '  Close this window, right-click PowerShell, Run as administrator,'
    Write-Host '  and run the script again.'
    Write-Host ''
    exit 3
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  A shared mailbox or delegate access is missing, read-only, or will not send' -ForegroundColor White
Write-Host '  Check the permission and give it time' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: low   Reversible   1 hour'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Connect to Exchange Online and read the permission as it currently stands.' -Command {
    Connect-ExchangeOnline
    Get-MailboxPermission -Identity shared@example.com | Where-Object { $_.User -notlike 'NT AUTHORITY*' } | Select-Object User, AccessRights, IsInherited
}

Invoke-Step -Number 2 -Do 'Wait before doing anything else. A newly granted permission can take up to an hour to reach the client, and automapping only takes effect when Outlook next starts.' -Why 'This is the step that gets skipped and it is the answer most of the time. A great deal of effort goes into fixing mailboxes that were going to appear on their own within the hour.' -Manual

Invoke-Step -Number 3 -Do 'Restart Outlook completely -- not just close the window.' -Command {
    Get-Process OUTLOOK -ErrorAction SilentlyContinue | Stop-Process -Force
}

Invoke-Step -Number 4 -Do 'If it still has not appeared, check whether automapping was disabled when the permission was granted.' -Command {
    Get-MailboxPermission -Identity shared@example.com | Format-List User, AccessRights, *auto*
}

Invoke-Step -Number 5 -Do 'To change automapping, the permission has to be removed and re-added -- there is no switch to toggle it in place.' -Command {
    Remove-MailboxPermission -Identity shared@example.com -User person@example.com -AccessRights FullAccess -Confirm:$false
    Add-MailboxPermission -Identity shared@example.com -User person@example.com -AccessRights FullAccess -AutoMapping:$true
}

Write-Rule "  Confirm it worked"
Show-Prose 'The shared mailbox appears in the folder list after an Outlook restart and its contents can be read.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-shared-mailbox' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Remove-MailboxPermission withdraws the access again. Removing and re-adding does not affect the mailbox contents.' 'DarkGray'
Write-Rule