In “HOW TO: Grant Full Mailbox Access permission“, we saw how to assign and view mailbox permissions, including Full Access. Here’s how you can get a list of mailboxes with explicitly-assigned (i.e. not inherited) Full Access permissions.
You can specify a single mailbox and retrieve the permissions assigned on it by using the Get-MailboxPermission cmdlet. Alternatively, you can use the Get-Mailbox cmdlet to retrieve all or a subset of mailboxes, and then pipe the results to the Get-MailboxPermission cmdlet. Instead of running this against all mailboxes in the Organization, it makes sense to filter it against a sub-set of mailboxes.
Filtering mailboxes returned by Get-Mailbox
Mailboxes returned by the Get-Mailbox command can be filtered using -Server, -Database, -RecipientTypeDetails, and -OrganizationalUnit parameters. You can also use the -Filter parameter and specify an OPATH filter, which allows you to granularly filter the mailboxes that are returned by the Get-Mailbox cmdlet, based on a number of filterable properties.
In this example, we use the -Server parameter to filter mailboxes on a particular server, and pipe it to the Get-MailboxPermission command:
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission
This produces a long list of permissions – inherited and assigned explicitly to the mailbox(es).
Let’s filter the above to reveal only the explicitly assigned permissions:
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { $_.IsInherited -eq $false }
The output shows all explicitly-assigned permissions, including the permissions assigned to the mailbox owner (NT AUTHORITY\SELF). Not quite what we want! Let’s filter out permissions assigned to the mailbox owner:
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }
Now we have a list of all mailboxes with explicitly assigned permissions.
We can filter this further to list only the ones that have Full Access permission assigned:
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }
Similarly, you can filter users that have other mailbox permissions assigned:
- SendAs
- DeleteItem
- ReadPermission
- ChangePermission
- ChangeOwner
- ExternalAccount
List users with SendAs permission assigned
The following code lists mailboxes with the SendAs permission assigned. Unlike the mailbox permission, is an Active Directory permission. Use the Get-ADPermssion cmdlet to retrieve Active Directory Permisions.
Get-Mailbox -ResultSize unlimited | Get-ADPermission | Where {$_.ExtendedRights -like “Send-As” -and $_.User -notlike “NT AUTHORIT\SELF” -and $_.Deny -eq $false} | ft Identity,User,IsInherited -AutoSize
{ 42 comments… read them below or add one }
Nice job on this report. Keep em coming! The power of the EMS is very cool.
Scott B
Thanks!
FYI – I had to do a | format-list at the end of the command to get anyting readable. (I have a long domain name any “almost always” the default format “sucks” for me.
SendAs is not a permission on the mailbox so you cannot filter it
It is a mailbox permission/”AccessRight”, that can be assigned using Add-MailboxPermission, and viewed using Get-MailboxPermission.
Also look at HOW TO: Assign SendAs right using Exchange shell.
How would you revoke such rights through the shell?
Can be revoked using Remove-MailboxPermission.
how would you search for a particular user who has full manager rights?
I love this blog! Great info
Thanks for the tutorial Bharat
Found your post whilst searching on Google
This might sound silly but how do you expand the EMS window? I've used the commands recommended in the tutorial with great success (Thank you, by the way.) But the window is so small that I can't read all the information presented. If I click the maximize button in the corner of the window, it just makes the window taller & I need it to be wider. I've tried to drag the side of the window to make it wider & that didn't work either. I feel pretty stupid even asking but the things that I know to maximize the window aren't working.
Anyone have any thoughts?
Hi guys, to maximise the window, create a shortcut on your desktop to EMS, then right click it and select properties and layout.
I have a couple of challenges for someone feeling brave…
I need to list all the mailboxes a particular user has full access permissions to and export it to a CSV using export-csv.
I also need to be able to list all the mailboxes showing who has full access to it. Again this will need to be presented in a CSV file.
Any ideas?
That last command is wrong. The command is Get-ADPermission. Singular.
Can we geta list of all the mailboxes that a specific user has access to( Like Full Access or Send as). for example : need to check all mailboxes in the environment and ask “does user X have access on this mailbox” … and then you will get a complete list.. Bharat can you able to find a query for this. Thanks in Advance Jobin
Hi, Microsoft now.
Did you find a way to get a list of all the mailboxes user X has full access to?
Best regards Monica
# See what mailboxes user has permissions to
Get-Mailbox -ResultSize unlimited | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and ($_.User -like “domain\Username”) -and -not ($_.User -like “NT AUTHORITYSELF”) } | format-list
How about mailboxes on Exchange 2003 – how do you find who has access to multiple mailboxes explicitly?
same question, did you ever figure this out?
Can we get a list of all the mailboxes that a specific user has access to( Like Full Access or Send as). for example : need to check all mailboxes in the environment and ask “does user X have access on this mailbox” … and then you will get a complete list..
Thanks! That’s just what I was looking for.
@Microsoft now :
For full access permissions, use the same command but add :
-and ($_.User -like “DomainUsername”)
Like this :
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and ($_.User -like “DomainUsername”) -and -not ($_.User -like “NT AUTHORITYSELF”) } |format-list
This will list all mailboxe that user X ( specified in -and ($_.User -like “DomainUsername”) ) as full access on.
Using : |format-list at the end of the command helps…
Didn’t try for the “send as” rights but my guess is it should be the same ;)
typo in last message :
forgot a “” between AUTHOROTY and SELF.
Command should read :
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and ($_.User -like “DomainUsername”) -and -not ($_.User -like “NT AUTHORITYSELF”) } |format-list
Does anyone know how to do this on exchange 2003?
Hi Vincent,
I would realy like to run jthis command but when I execute it nothing happens. It does appear to be thinking for a while, but I get no results. All I have changed in your command is the server and domain username. Is this correct? Any idea what might be going wrong?
The Identity field contains long strings because it includes the full directory path to the mailbox user, so it may get truncated on your screen. In that case you could export the output to CSV file.
Hi Suneja,
Thank you for the tips! Really saved a lot of my time!
Cheers!
-aneesh-
Hi team,
My company has a lot of exchange servers. Therefore for my site it is very tricky to get list of list of mailboxes with the list of users which have access to them.
I want to import a list of mailboxes, and due to this list it will give me the list of accesses.
Get-MailboxPermission -Import-Csv c:\temp\MBX.csv |where { ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) } |Select Identity, user, AccessRights | Export-Csv c:\temp\test111.csv
I am doing something, somewhere is a mistake, maybe somebody can take a look on it.
Hello
I have a request where a user has rebuild the machine and forgot how many mailboxes she had access to. Is there a shell command to find how many mailboxes she has access to. And this not just full access, I need to find even delegate access rights.
Thanks,
Mrugesh
Although you can list mailbox permissions as shown in this post and list folder permissions using Get-MailboxFolderPermission cmdlet, you may want to ask the user what she really *needs* access to? If users don’t remember what they have access to, it’s a good indicator that they probably don’t need access. :)
Thanks Bharat!
I thought the same and tried to bypass her but she is persistent on knowing the answer and that is the reason I came here.
I had tried the Get-MailboxFolderPermission cmdlet but I get this error message:
“There is no existing permission entry found for user: .
+ CategoryInfo : NotSpecified: (1442:Int32) [Get-MailboxFolderPermission], UserNotFoundInPermissionEntryE
xception
+ FullyQualifiedErrorId : 427FC71C,Microsoft.Exchange.Management.StoreTasks.GetMailboxFolderPermission ”
Can you help??
Hi Bharat,
I’m facing some strange issue, If I granted induvidully full access on any mailbox its working fine for me but if I granted full access via any group its doesn’t work. However I tested with lots of scenerio but no Luck.
can you help me pls ?
Regards.
Sukhdev
Really helpful, thanks a lot
Hi,
One correction in the command. As per command in Writeup :-
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }
This will list users with FMA which is NOT Inherited and also exclude “NT Authority\Self” accounts.
But, i have seen a behaviour wherein if a mailbox has following permission for example :-
Identity User AccessRights
——– —- ————
Mailbox1 User1 {FullAccess, ReadPermission}
Mailbox1 User2 {FullAccess, DeleteItem, ReadPermission, ChangePermission}
Mailbox1 User3 {Fullaccess}
The command will only list “User3” in the output and NOT User1 and User2, All the 3 mailbox permissions are NOT inherited.
To Rectify this, we have to use -LIKE parameter with a * while filtering Accessrights, changed below
Get-Mailbox -Server “e12postcard” | Get-MailboxPermission | where { ($_.AccessRights -LIKE “FullAccess*”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) }
Cheers,
After this you will be able to list all 3 users from the example
Greetings,
I like your site and will always go back to it in daily basis. I am an IT manager and looking for help. I was cleaning up our exchange server and found one of my engineers having full access to a manager’s email. Is there a way that I can find:
1- who assigned full access to the engineer?
2- When was the full access assigned?
I really appreciate your help.
Tom Sam
[email protected]
Hello! You can find out who assigned full mailbox access permission to a mailbox if you have Admin Audit Logging enabled (it’s enabled by default) and the audit logs are still available. By default, admin audit logs are retained for 90 days.
See Administator audit logging in Exchange 2013 documentation.
You can email me (bharat at suneja dot com) if you need assistance with this.
Hi,
Im interested in using something like for a cross-forest migration.
The migration itself seems to be all good – and I can use the script above to get out a csv of tall the permissions – but post migration I would be really keen to update the paths and use this as an import in the new forest.
Is that possible ?
You mean replicate the same permissions in the new forest? Sure.
Ok – would you be able to give me some advice on how to do this ?
I’m having trouble working how to get the information back in once it has been exported.
Can you provide more details?
So basically I am looking to do the same thing. I need to find all the mail files 3 users have access to. I want to export it to a CSV. This is the script I found on another site.
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission | ?{($_.AccessRights -eq “FullAccess”) -and ($_.User -like ‘prod\SVC_ITSM’) -and ($_.IsInherited -eq $false)} | Export-Csv e:\temp\test.csv
Once I run it, it takes a long time to run, then I get this error back. Please help. Thanks!
Sending data to a remote command failed with the following error message: The total data received from the remote clien
t exceeded allowed maximum. Allowed maximum is 524288000. For more information, see the about_Remote_Troubleshooting He
lp topic.
+ CategoryInfo : OperationStopped: (System.Manageme…pressionSyncJob:PSInvokeExpressionSyncJob) [], PSRe
motingTransportException
+ FullyQualifiedErrorId : JobFailure
Invoke-Command : Cannot write input as there are no more running pipelines
At C:\Users\jensej07\AppData\Roaming\Microsoft\Exchange\RemotePowerShell\maexca30.prod.ishealth.net\maexca30.prod.ishealth.net.psm1:14681 char:29
+ $scriptCmd = { & <<<< $script:InvokeCommand `
+ CategoryInfo : InvalidOperation: (:) [Invoke-Command], PSInvalidOperationException
+ FullyQualifiedErrorId : NoMoreInputWrite,Microsoft.PowerShell.Commands.InvokeCommandCommand
You’re hitting Remote PowerShell quotas. See “HOW TO SET AND CHANGE QUOTAS” in about_Remote_Troubleshooting (https://technet.microsoft.com/en-us/library/hh847850.aspx?f=255&MSPPError=-2147217396).
Does this work in Exchange 2013. I have ran
Get-Mailbox -ResultSize unlimited | Get-MailboxPermission | where { ($_.AccessRights -eq “FullAccess”) -and ($_.IsInherited -eq $false) -and ($_.User -like “Username”) -and -not ($_.User -like “NT AUTHORITYSELF”) } | format-list
However, it appears to just be returning every mailbox on the platform, the user I have tested this with only has permissions to 1 or 2 additional Mailbox’s but after running this for 5 mins the list returned was just growing and growing
{ 1 trackback }