Exch 2007 Full Access Permissions
Is there a way to set full access permissions on ALL mailboxes for exch org admins? Can we make this a default setting for all new mailboxes?
February 21st, 2008 10:24pm

Hi, If you set this permission on the server level it would include all mailboxes on that server. http://technet.microsoft.com/en-us/library/aa996343.aspx Leif
Free Windows Admin Tool Kit Click here and download it now
February 21st, 2008 10:28pm

I don't see a command to grant full access to all mailboxes. Not to mention have this set as a default for all future mailboxes. I don't want to have to manually grant exch org admins full access on a per mailbox basis.
February 21st, 2008 11:39pm

Dave, You can remove the deny "Send As" and "Receive As" permissions at the organization level via ADSIEdit. This will enable Exchagne Org Administraotrs to have full rights to mailboxes. The previous suggestion (see: Add-ADPermission) should work for access delegation to other accounts at the database level. Also, you should be able to set this on an OU and let inheritance do the rest. Here is an examplefor granting both"send as" and "receive as" rights to an AD group called "EmailPolice"on an OU. Add-ADPermission -id "OU=Users,OU=Test Org,DC=domain,DC=com" -User EmailPolice -ExtendedRights Receive-As, Send-As Of course, you could do this via ADUC / ADSIEdit if you're PowerShell averse. All newly created mailboxes will inherit these rights. I admit its a little....um...less straightforward than it used to be. But it works just fine. Hope this helps. Travis Nielsen PointBridge
Free Windows Admin Tool Kit Click here and download it now
March 18th, 2008 11:33pm

Hi,How about a way to reversethechanges ofAdd-ADPermission -id "OU=Users,OU=Test Org,DC=domain,DC=com" -User EmailPolice -ExtendedRights Receive-As, Send-As.Would it beremove-ADPermission -id "OU=Users,OU=Test Org,DC=domain,DC=com" -User EmailPolice -ExtendedRights Receive-As, Send-As
January 22nd, 2009 4:28am

Hi Try this one Add-MailboxPermission "Mailbox" -User "Trusted User" -AccessRights FullAccess Adam Aladdin
Free Windows Admin Tool Kit Click here and download it now
January 23rd, 2009 11:12am

I am trying to do this as well, and wonder if "Add-MailboxPermission "Mailbox" -User "Trusted User" -AccessRights FullAccess" addresses the request for newly created mailboxes to inherit the rights?-Steve
January 26th, 2009 9:12pm

I've used Adam's recommendation ofAdd-MailboxPermission (and Remove-MailboxPermission) for this exact purpose and it's works as advertised. While it doesn't apply the results to new mailboxes by default you can easily batch this operation in PowerShell by prefixing it with "Get-Mailbox |" e.g., Get-Mailbox |Add-MailboxPermission -User "Administrators" -Accessright "Fullaccess" You could also add this as part of a PowerShell script that you use to create new users to ensure that each new user has these permissions by default. There may be a more elegant approach to handling this globally. I know there was in Exchange 2003, but haven't researched the best approach to doing this in Exchange 2007. That said, you should make sure this is compliant with your organizations privacy and information access policies. The default permissions help enforce a separation between administration and user data; overriding this can potentially have legal ramifications. Jeremy
Free Windows Admin Tool Kit Click here and download it now
January 28th, 2009 9:49am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics