Manage full access permissions on mailboxes in Exchange 2010

 

This is the updated version with a few additions and corrections based on both comments and new features added by Microsoft since my first post.

Grant permissions on a single mailbox

Use the following command to grant access to just one mailbox:

Note: the User parameter can in fact be either users or groups, the parameter name “User” is a bit misleading!

Example:

Or If I want to add the security Group Group2:

 

Grant permissions on all mailboxes

Use the following command to grant access to all mailboxes:

Example:

Note: In the screenshot below I received a message saying that Administrator already have access to the mailbox Test (Yellow text message).

Grant permissions on mailboxes using Where

We might as well add a where to the command while we are at it. With this command we grant access to all mailboxes in a specific OU:

Example:

Remove permissions on a single mailbox

Quite simple, just change Add to Remove:

Example:

Remove permissions on all mailboxes

Well you have probably figured this one out already, but I will show it to you anyway:

Example:

Note: As you can se below, using this command will remove the users full access to its own mailbox. That is not good, this command should be used with care…

How to configure the rights assignment to apply on new mailboxes automatically

This can be done using one of three methods, you can add permissions using EMS or ADSIEdit.

Using EMS method 1 (recommended)

With this method we grant permissions on the databases container in the configuration Naming context using the following PowerShell command:

If we brake this up a bit we can se that the Identity is in fact the Distinguished Name of the Databases container:

The InheritedObjectType parameter specifies what kind of object inherits this access control entry, in this case it is only Exchange Mailbox Databases:

Then we grant Receive-As permissions. Granting Receive As and  Send As permission to a mailbox database, the user can log on to all mailboxes within that database, and send mail from those mailboxes:

And finally we set the inheritance type to Descendents:

Example:

Using EMS method 2

With method two we use a pipe to set the permission on each mailbox database with the following command:

Example:

Granting Receive As and Send As permission to a mailbox database, the user can log on to all mailboxes within that database, and send mail from those mailboxes.

Using ADSIEdit

There are also the ADSIEdit way of addressing the problem. I will give you a description on what you need to do but I STRONGLY recommend you to have a look at Michaels post instead. That said, here you go…

Open ADSIEdit, Right click ADSIEdit and choose Connect to.

Select the Configuration Naming Context and click Ok.

Navigate to Configuration/Services/Microsoft Exchange/<OrganisationName>/Administrative Groups/Exchange Administrative Group (FYDIBOHF23SPDLT).

Right Click the Databases folder and choose Properties.

Click on the Security tab and click Add.

Enter the users or groups that you want to add and then click Ok.

Make sure that the added users or groups is selected, check the Allow box for Full control for each user or group, then click Ok to close the window and now we are finished with ADSIEdit.

This adds permissions to all databases. If you want to edit the permissions for a specific database you can open theDatabases folder and open Properties for the database you want to configure.

A final note: Full Access or Receive As permissions are granted next time the Microsoft Exchange Information Store service caches the permissions and updates the cache. To grant the permissions immediately, stop and then restart the Microsoft Exchange Information Store service.