{"id":1541,"date":"2015-02-05T19:26:30","date_gmt":"2015-02-05T19:26:30","guid":{"rendered":"http:\/\/microsoftgeek.com\/?p=1541"},"modified":"2015-02-05T19:26:52","modified_gmt":"2015-02-05T19:26:52","slug":"manage-full-access-permissions-on-mailboxes-in-exchange-2010","status":"publish","type":"post","link":"https:\/\/microsoftgeek.com\/?p=1541","title":{"rendered":"Manage full access permissions on mailboxes in Exchange 2010"},"content":{"rendered":"

Manage full access permissions on mailboxes in Exchange 2010<\/h1>\n

 <\/p>\n

This is the updated version with a few additions and corrections based on both comments and new features added by Microsoft since my first post.<\/p>\n

Grant permissions on a single mailbox<\/h3>\n

Use the following command to grant access to just one mailbox:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Add-MailboxPermission -Identity “” -User <UserorGroupIdentity> -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n<\/div>\n

Note: the User parameter can in fact be either users or groups, the parameter name \u201cUser\u201d is a bit misleading!<\/p>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Add-MailboxPermission -Identity “Test” -User Administrator -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"FullAccess1\"<\/p>\n

Or If I want to add the security Group Group2:<\/p>\n

\u00a0<\/a><\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Add-MailboxPermission -Identity “Test” -User Group2 -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"fullaccess01\"<\/p>\n

Grant permissions on all mailboxes<\/h3>\n

Use the following command to grant access to all mailboxes:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Add-MailboxPermission -User <UserorGroupIdentity> -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Add-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Note: In the screenshot below I received a message saying that Administrator already have access to the mailbox Test (Yellow text message).<\/p>\n

\"FullAccess2\"<\/p>\n

Grant permissions on mailboxes using Where<\/h3>\n

We might as well add a where to the command while we are at it. With this command we grant access to all mailboxes in a specific OU:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Where { $_.OrganizationalUnit -eq \u201c\u201d } | Add-MailboxPermission -User <UserorGroupIdentity> -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Where { $_.OrganizationalUnit -eq \u201csundis.local\/Test\/Users\u201d } | Add-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"FullAccess3\"<\/p>\n

<\/h5>\n

Remove permissions on a single mailbox<\/h3>\n

Quite simple, just change Add to Remove:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Remove-MailboxPermission -Identity “” -User <UserorGroupIdentity> -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Remove-MailboxPermission -Identity “Test” -User Administrator -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"FullAccess4\"<\/p>\n

Remove permissions on all mailboxes<\/h3>\n

Well you have probably figured this one out already, but I will show it to you anyway:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Remove-MailboxPermission -User <UserorGroupIdentity> -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailbox | Remove-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Note: As you can se below, using this command will remove the users full access to its own mailbox. That is not good, this command should be used with care\u2026<\/p>\n

\"FullAccess5\"<\/p>\n

How to configure the rights assignment to apply on new mailboxes automatically<\/h3>\n

This can be done using one of three methods, you can add permissions using EMS or ADSIEdit.<\/p>\n

Using EMS method 1 (recommended)<\/h4>\n

With this method we grant permissions on the databases container in the configuration Naming context using the following PowerShell command:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Add-AdPermission -Identity \u201cCN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<DomainName>,DC=<TopDomain>\u201d -User <UserorGroupIdentity> -InheritedObjectType msExchPrivateMDB -AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As -inheritanceType Descendents<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

If we brake this up a bit we can se that the Identity is in fact the Distinguished Name of the Databases container:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

\u201cCN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<DomainName>,DC=<TopDomain>\u201d<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

The InheritedObjectType parameter specifies what kind of object inherits this access control entry, in this case it is only Exchange Mailbox Databases:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

-InheritedObjectType msExchPrivateMDB<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Then we grant Receive-As permissions. Granting Receive As and \u00a0Send As permission to a mailbox database, the user can log on to all mailboxes within that database, and send mail from those mailboxes:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

-AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

And finally we set the inheritance type to Descendents:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

-inheritanceType Descendents<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Add-AdPermission -Identity \u201cCN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=sundis,DC=local\u201d -User test8 -InheritedObjectType msExchPrivateMDB -AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As<\/p>\n

-inheritanceType Descendents<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"fullaccess10\"<\/p>\n

Using EMS method 2<\/h4>\n

With method two we use a pipe to set the permission on each mailbox database with the following command:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailboxdatabase | Add-ADPermission -User <UserorGroupIdentity> -AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Example:<\/p>\n

\n\n\n<\/colgroup>\n\n\n
\n

Get-Mailboxdatabase | Add-ADPermission -User test3 -AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\"fullaccess03\"<\/p>\n

Granting Receive As and Send As permission to a mailbox database, the user can log on to all mailboxes within that database, and send mail from those mailboxes.<\/p>\n

Using ADSIEdit<\/h4>\n

There are also the ADSIEdit way of addressing the problem. I will give you a description on what you need to do but I STRONGLY recommend you to have a look at Michaels post instead. That said, here you go\u2026<\/p>\n

Open ADSIEdit, Right click ADSIEdit and choose Connect to.<\/p>\n

\"fullaccess02\"<\/p>\n

Select the Configuration Naming Context and click Ok.<\/p>\n

\"fullaccess04\"<\/p>\n

Navigate to Configuration\/Services\/Microsoft Exchange\/<OrganisationName>\/Administrative Groups\/Exchange Administrative Group (FYDIBOHF23SPDLT).<\/p>\n

\"fullaccess05\"<\/p>\n

Right Click the Databases folder and choose Properties.<\/p>\n

\"fullaccess06\"<\/p>\n

Click on the Security tab and click Add.<\/p>\n

\"fullaccess07\"<\/p>\n

Enter the users or groups that you want to add and then click Ok.<\/p>\n

\"fullaccess08\"<\/p>\n

Make sure that the added users or groups is selected, check the Allow box for Full control for each user or group, then click Ok to close the window and now we are finished with ADSIEdit.<\/p>\n

\"fullaccess09\"<\/p>\n

This adds permissions to all databases. If you want to edit the permissions for a specific database you can open theDatabases folder and open Properties for the database you want to configure.<\/p>\n

A final note: Full Access or Receive As permissions are granted next time the Microsoft Exchange Information Store service caches the permissions and updates the cache. To grant the permissions immediately, stop and then restart the Microsoft Exchange Information Store service.<\/p>\n","protected":false},"excerpt":{"rendered":"

Manage full access permissions on mailboxes in Exchange 2010   This is the updated version with a few additions and corrections based on both comments and new features added by Microsoft since my first post. Grant permissions on a single mailbox Use the following command to grant access to just one mailbox: Add-MailboxPermission -Identity “” […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-1541","post","type-post","status-publish","format-standard","hentry","category-exchange-2010"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1541","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1541"}],"version-history":[{"count":3,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1541\/revisions"}],"predecessor-version":[{"id":1544,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/1541\/revisions\/1544"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}