Removeinherited mailbox permission

Question

It has been noticed a couple of service account permissions are inherited to many accounts. Could you help to let me know how to remove the below accounts

I ran this command and found that the service account permissions are added to DB, exchange server .
Get-MailboxDatabase | Get-ADPermission -user “ServiceAccountName”

Get-ExchangeServer | Get-ADPermission -user “ServiceAccountName”

Answer 1

So it worked in the third command and failed the second and first command?

Get-MailboxDatabase | Get-ADPermission -User Domain\UserName | Remove-ADPermission -AccessRights GenericAll -InheritanceType All -Confirm:$false

Get-ExchangeServer | Get-ADPermission -User Domain\UserName | Remove-ADPermission -AccessRights GenericAll -InheritanceType All -Confirm:$false

Get-OrganizationConfig | Get-ADPermission -User Domain\UserName | Remove-ADPermission -AccessRights GenericAll -InheritanceType All -Confirm:$false

Open adsi.edit and negative to Configuration [dc.yourdomain.local], CN=Configuration,DC=yourdomain,DC=local, CN=Services, CN=Microsoft Exchange, CN=First Organization, CN=Administrative Groups, CN=Exchange Administrative Group(FYDIBOHF23SPDLT), check the database and server 's property-security, is the user listed there?

Answer 2

Hi @Austin Sundar ,

You can use the below commands,

Get-MailboxDatabase <NameoftheDatabase> | Remove-ADPermission -User <Username> -AccessRights GenericAll –InheritanceType All
Get-ExchangeServer <NameoftheExchangeServer> | Remove-ADPermission -User <Username> -AccessRights GenericAll –InheritanceType All

https://learn.microsoft.com/en-us/powershell/module/exchange/remove-adpermission?view=exchange-ps#parameters

Since these permissions are Inherited, it is also important to check if the ServiceAccount is part of any Administrative groups like Domain/Schema/Enterprise Admins or Exchange Administrative roles like Organization management, Recipient management, etc and if yes, its better to remove the roles, wait for the AD replication and check the permissions again.

https://learn.microsoft.com/en-us/exchange/permissions/permissions?view=exchserver-2019#role-groups-and-role-assignment-policies

If the above suggestion helps, please click on "Accept Answer" and upvote it