Exchange PowerShell mailbox rights issue

Question

Exchange PowerShell mailbox rights issue

Step to IT 125

Please tell me how the "Deny" parameter works in the Exchange "MailboxPermission" cmdlet. For example, I check the permissions on the "test-mailbox" and see some groups there where the "Deny" parameter is set to "True". However, access is available from these groups. I tried another option: I added full rights to the mailbox for another account with the "Deny" = "True" parameter, but nothing changed, access has not disappeared. How does it work?

And the second question is where I can view and edit the current inherited mailbox permissions ("IsInherited" = "True")?

0 comments

2 answers

Your answer

Answer 1

Anonymous

Please check this ：Exchange Mailbox Rights
https://community.spiceworks.com/topic/34358-exchange-mailbox-rights

(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

Regards

SF

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Step to IT 125 Reputation points

2023-12-08T19:08:48.4166667+00:00

Thanks for your reply!

Yes, there is such an entry there, but it is one of the few (it contains the entry of the administrator who installed the server).

ADSI -> Configuration -> CN=Configuration,DC=domain,DC=loc -> CN=Services -> CN=Microsoft Exchange -> CN=*YourExchOrgName* -> Right Click -> Properties -> Attribute "msExchAdmins"

Value: SID,10

For example: S-1-5-21-1234567890-0987654321-123456789-1234,10

However, other groups that are created by default when installing the server are not specified there. I would like to understand this too. Various resources write about another ADSI container - NC

Even when you run the "Get-OrganizationConfig | Get-ADPermission" cmdlet, you can see that there are inherited rights from a higher level. Is this from ADSI? But where can I find them in ADSI, and if necessary, delete them there or add something?

Also, regarding "Deny" I still haven’t found anything new :(
Anonymous

2023-12-13T09:09:41.6033333+00:00

Sorry for the delay. The MS doc doesn't seem to go into too much depth on this, except that Permissions are inherited from the mailbox database and/or Active Directory, and Some permissions are inherited from some role groups in AD and Exchange organization such as Administrator, Domain Admins, Organization Management.

The msExchAdmins attribute appears to be the attribute used to grant Exchange administrator permissions and is only included at the Exchange organization level. Regarding the NC container, it is a container in Active Directory that contains all naming contexts.

<<However, other groups that are created by default when installing the server are not specified there.

Do you mean

?

Regards

SF
Step to IT 125 Reputation points

2023-12-25T10:18:25.2266667+00:00

Sorry for replying so late.

Yes, I measn this OU with exchange default grops. I want to understand from where the rights are initially pulled up.

Also, I want to understand, how work "deny" permission because I try these, but I still had access.

Answer 2

Anonymous

Hello @Step to IT

In your case, it's possible that the groups you are seeing with the "Deny" parameter set to "True" have also been granted other permissions that allow them to access the mailbox.

Here is an explanation about Deny:

User's image

<<where I can view and edit the current inherited mailbox permissions ("IsInherited" = "True")?

If you only want to view inherited permissions use:

Get-MailboxPermission -Identity <MailboxIdentity> | Where-Object { $_.IsInherited -eq $true }

Or run the following command to view all the current permissions for a mailbox:

Get-MailboxPermission -Identity <MailboxIdentity>

Regards

SF

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Step to IT 125 Reputation points

2023-12-07T17:07:47.9733333+00:00
Here is an explanation about Deny

I looked at the information on this page. Just here in the screenshot you can see how it says that "deny permissions override allow permissions". I expected a similar action as in other Microsoft products (the same NTFS rights).

Get-MailboxPermission -Identity <MailboxIdentity>

I got all access rights with this cmdlet, which is why the question arose.

My question is, where do these rights come from? Where can I see the "parent"?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Exchange PowerShell mailbox rights issue

2 answers

Your answer