I'm setting up a new Exchange 2013 org.  Everything is pretty fresh, only a few mailboxes have been added for testing.

I've added this permission, to provide full access to all the mailboxes in the database:

Get-MailboxDatabase -identity Mailbox Database | Add-ADPermission -user netadmin -AccessRights GenericAll -ExtendedRights Receive-As, Send-As
.
I've verified the permission in ADSI Edit.

I have verified the permission in the recipient's mailbox delegation properties. 

However, while logged into OWA using the admin account, if I try to open another user's mailbox from OWA, I just get a sad face that says "Something went wrong :( " .

Any ideas? I've tried resetting the owa virtual directory...reset IIS, rebooted several times, no luck.

Thanks

• Proposed as answer by Zi FengMicrosoft contingent staff, Moderator Monday, February 25, 2013 7:12 AM
• Unproposed as answer by Zi FengMicrosoft contingent staff, Moderator Monday, February 25, 2013 7:12 AM

When you say mailbox delegation properties, that's in the EAC, under user properties? Like in the EMC of E2K10, where you could right-click on the mailbox and check both "Full" and "Send As" permissions?

Just wondering, because there are permissions that can be assigned to delegates in Outlook too (there's a tab about delegation).

Hi

Is that ok when you set to single mailbox?

If ok, please try

Get-Mailbox -database Mailbox Database | Add-ADPermission -user netadmin -AccessRights GenericAll -ExtendedRights Receive-As, Send-As

Cheers

Hi

Is that ok when you set to single mailbox?

If ok, please try

Get-Mailbox -database Mailbox Database | Add-ADPermission -user netadmin -AccessRights GenericAll -ExtendedRights Receive-As, Send-As

Cheers

This is the cmd that I run every so often when I want access to an account, this will add the permission to all mailboxes

I have a Security Group in AD called "ExchangeViewAll", which my user is a member of.

get-mailbox | Add-MailboxPermission -User Exchangeviewall -AccessRights FullAccess -InheritanceType All

I also got the /owa/auth/errorfe.aspx?httpCode=500, but after a few minutes (most likely when AD replicated the permissions), I was able to access the accounts without issue

• Edited by Brenny87 Thursday, March 14, 2013 1:57 AM

Don't forget, but default, Domain Admins have 'deny' access from 'Send As'. You can change this in ADSIedit. Not sure if these Exchange admins are also Domain Admins in your setup.

I'm having the same problem - has anyone found a solution?

Mike - that's interesting, I hadn't noticed Domain and Enterprise Admins have deny permissions set.  It would seem that the deny permissions do not take precedence over allow permission on Exchange 2010 - we have domain admin accounts that have been granted the send and receive as permissions - and the permissions work.

Maybe Exchange 2013 is enforcing permission properly?

• Edited by DJL Wednesday, May 08, 2013 5:39 PM

I'm having the same problem as well.

I have run both

Get-MailboxDatabase -identity mailbox Database 1686610167 | Add-ADPermission -user kirk -AccessRights GenericAll
Get-MailboxDatabase -identity "mailbox Database 1686610167" | Add-ADPermission -user kirk -ExtendedRights Receive-As, Send-As

 I can get to some mail boxes but not most of them.

I have tried to add rights in EAC as well and that does not seem to change my ability to open a mail box.

Just to add...

I've tried adding an account that isn't affected by Deny permissions (i.e the user isn't a member of Domain or Enterprise Admins etc).  The account can access mailboxes on Exchange 2010 but it still can't access mailboxes on Exchange 2013.

Subscribed I need an answer to this to, was working flawless in Exchange 2007, but since migrating to 2013.

I have the same issue and tried the steps above as well no go!  HR and CIO  need access to everyones MBX.

Sombody resolve the problem?

• Edited by Step_BLR Saturday, April 05, 2014 2:21 PM

I just add the permissions directly to the mailboxes these days:

Get-Mailbox -ResultSize unlimited -Database "dbname" | Add-MailboxPermission -AccessRights FullAccess -User "Group or Username"

• Edited by DJL Sunday, April 06, 2014 11:15 AM

...BUMP....

I am having the same issue with Full Access permissions in Exchange 2013. When assigned to the database they do not work. When assigned directly to a mailbox they do work.

This all worked fine in Exchange 2010.

It works fine for me in Exchange 2013.

I suspect the problem might be for you (and others in this topic) that the account you are working with is a member of a group (e.g. Organization Management) that has an explicit Deny entry set at the Exchange Org level and is inherited by all child objects.  If this is the case what happens down at the mailbox level is, I believe, that there will be both a Deny ACE (inherited from Exchange Org) and the Allow ACE (inherited from the database level).  An inherited Deny ACE will beat an inherited Allow ACE.  In this scenario the only way to assign the Full Access would be to set it explicitly on the mailbox, as this would override the inherited Deny ACE.

Tony,

I understand and agree with what you have said. I can't remove myself from Domain Admins which has the Deny ACE and at the same time I don't want to have to add permissions to each individual mailbox when it is created (which is what I am doing in the interim).

I guess the long term solution I am looking for is removing the Deny ACE for Domain Admins....but is that safe? Anyone tried it?