HOW TO: List mailboxes with Full Mailbox Access permission assigned

In “HOW TO: Grant Full Mailbox Access permission“, we saw how to assign and view mailbox permissions, including Full Access. Here’s how you can get a list of mailboxes with explicitly-assigned (i.e. not inherited) Full Access permissions.

You can specify a single mailbox and retrieve the permissions assigned on it by using the Get-MailboxPermission cmdlet. Alternatively, you can use the Get-Mailbox cmdlet to retrieve all or a subset of mailboxes, and then pipe the results to the Get-MailboxPermission cmdlet. Instead of running this against all mailboxes in the Organization, it makes sense to filter it against a sub-set of mailboxes.

In this example, we use the -Server parameter to filter mailboxes on a particular server, and pipe it to the Get-MailboxPermission command:

Get-Mailbox -Server “e12postcard” | Get-MailboxPermission

This produces a long list of permissions – inherited and assigned explicitly to the mailbox(es).

Let’s filter the above to reveal only the explicitly assigned permissions:

Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { $_.IsInherited -eq $false }

The output shows all explicitly-assigned permissions, including the permissions assigned to the mailbox owner (NT AUTHORITY\SELF). Not quite what we want! Let’s filter out permissions assigned to the mailbox owner:

Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }

Now we have a list of all mailboxes with explicitly assigned permissions.

We can filter this further to list only the ones that have Full Access permission assigned:

Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }

Similarly, you can filter users that have other mailbox permissions assigned:

• SendAs
• DeleteItem
• ReadPermission
• ChangePermission
• ChangeOwner
• ExternalAccount

List users with SendAs permission assigned

The following code lists mailboxes with the SendAs permission assigned. Unlike the FullAccess mailbox permission, SendAs is an Active Directory permission. Use the Get-ADPermssion cmdlet to retrieve Active Directory Permisions.

Get-Mailbox -ResultSize unlimited | Get-ADPermission | Where {$_.ExtendedRights -like “Send-As” -and $_.User -notlike “NT AUTHORIT\SELF” -and $_.Deny -eq $false} | ft Identity,User,IsInherited -AutoSize

Tagged as: Exchange 2007, Exchange Shell, Mailbox, Security