#############################################################################
#
# This script runs Get-MailboxFolderPermission for a valid mailbox specified
# by the user.  It displays the folder-level permissions on screen and also
# dumps them to a text file.
#
# Created by jtedoff@microsoft.com
# Last modified 5/24/2014
#
#############################################################################

# This function collects a mailbox from the user. It checks that the mailbox exists and that the input results in only one mailbox.

Function GetMailbox
{
$mb = Read-Host "Alias of mailbox to retrieve folder permissions?"

$check = Get-Mailbox -Identity $mb -erroraction silentlycontinue
If ($check){
 $chk = $check.count
 If ($chk -and $chk -gt 1){
  Write-Host ""
  Write-Host "Please specify only one mailbox" -ForeGroundColor Yellow
  Write-Host ""
  GetMailbox
  }
  Else {
  Enumerate
  }
 }
 Else {
 Write-Host ""
 Write-Host "This is not a valid mailbox alias, please retry" -ForeGroundColor Red
 Write-Host ""
 GetMailbox
 }
}

# This function runs Get-MailboxFolderStatistics for the mailbox found in GetMailbox. It then takes the output and reformats it for a foreach loop that runs Get-MailboxFolderPermission for each folder path found

Function Enumerate
{
 Write-Host ""
 Write-Host "Analyzing mailbox" $check -ForeGroundColor Green
 Write-Host ""

$file = ("." + $check.alias + "-" + $check.DisplayName + ".txt")

$mbfs = Get-MailboxFolderStatistics -Identity $check.Identity

$flist = $mbfs.folderpath

$flist | foreach {$chg = $_ -replace "/" , ""
 $pchg = ($check.alias + ":" + $chg)
 $go = Get-MailboxFolderPermission -Identity $pchg -erroraction silentlycontinue
 If ($go) {
  Write-Host ""  
  Write-Host "Folder permission for" $pchg -ForegroundColor Green
  $pchg | Out-File $file -append
  $go
  $go | Out-File $File -append
 }
 Else {}
 }

}

# After the functions are defined the script calls the first one

GetMailbox

https://blogs.technet.com/b/exchange/archive/2012/06/14/everything-you-need-to-know-about-exchange-backups-part-2.aspx

https://blogs.technet.com/b/exchange/archive/2012/07/09/everything-you-need-to-know-about-exchange-backups-part-3.aspx

#Script to check mailboxes for fullaccess rights for NT AUTHORITYSELF
#Written by jtedoff@microsoft.com 4/21/2012

$logfile = "c:selfrightstest.log"
if (test-path $logfile) {remove-item $logfile}

function WriteLog
{
 PARAM($msg)
 END
 {
 Add-Content -Path $logfile -encoding ASCII -value $msg
 }
}

#Modify the next line to narrow the scope of the Get-Mailbox results
#For example, set it to -> $mailboxes = Get-Mailbox -server <servername> -resultsize unlimited <- to only check mailboxes on a particular server

$mailboxes = Get-ExchangeServer | ?{$_.ServerRole -like "*mailbox*"} | Get-Mailbox -resultsize unlimited

WriteLog "Checking for FullAccess rights for NT AUTHORITYSELF"

$mailboxes | foreach {
 $perms = get-mailboxpermission $_.identity | ?{$_.user -like "NT AUTHORITYSELF" -and $_.accessrights -like "*fullaccess*"}
 if ($perms) {
  Write-Host "Mailbox for $_" -nonewline
  Write-Host " OK" -foregroundcolor green

   }
 else { $erruser = $_.Identity
  Write-Host "FullAccess right for NT AUTHORITYSELF not detected on the mailbox for " -foregroundcolor red -nonewline
  Write-Host $_.Identity -foregroundcolor red -backgroundcolor white
  WriteLog "FullAccess right for NT AUTHORITYSELF not detected on the mailbox for $erruser"
  }
 }

Here's an output example where one user doesn't in fact have SELF rights over their mailbox:

The scenario was that somehow the MAPI folder permissions on hundreds of public folders got duplicated when an out-of-sync DC passed incorrect data to Exchange as replicas got added to the organization.  Whatever the cause we wound up with a folder that would have, for example, a permission list like this:

Name:             Role:
Default           None
John Smith        Owner
John Smith        Owner
Merle Biggs       Author
Merle Biggs       Author
Anonymous         Reviewer

The effective result was that users who should have had access the folder didn't have it.  Now we knew that if we deleted the duplicate ACE's then access was restored.  The problem was that there were hundreds of folders affected and we needed a way to go through and remove the duplicates automatically.

PowerShell to the rescue!

We set out to clean up the permissions with a script that first captured the existing permissions on a folder and populated a variable with them.  We then cleared the entire ACL by removing every permission on the folder.  Finally we used the array of permissions originally captured and had PowerShell simply add them back to the folder they came from.  The result was that Exchange rejected duplicates when the script attempted to add them, as expected, and so the above example would be corrected to look like this:

Name:             Role:
Default           None
John Smith        Owner
Merle Biggs       Author
Anonymous         Reviewer

So how did the script work?  Here it is, with comments before each section to explain what's happening:

# The GetTreeTop function asks the user for the path to the public folder we want to work on first and puts the result into the $treetop variable
# It then checks to see if the entered path is valid and requests the user to try again if it's not

Function GetTreeTop
{
Write-Host ""
Write-Host ""
$treetop = Read-Host "Enter public folder to reset permissions on?"

#Check validity of public folder path
$check = Get-PublicFolder $treetop -erroraction silentlycontinue
If ($check){
 FindOut
 }
 Else {
 Write-Host ""
 Write-Host "Public folder name $treetop is not valid, please re-enter the path, using format -> FolderSubfolder" -foregroundcolor Red
 Write-Host ""
 GetTreeTop
 }
}

# The FindOut function asks the user if we want to operate just against the one public folder specified in GetTreeTop, or do we want to work against all the subfolders 
as well?
# Based on the Y or N answer we go to either the DoRecurse or the DontRecurse function.  If the answer isn't Y or N we ask again.

Function FindOut
{
 $recrse = Read-Host "Do you want to reset permissions on all subfolders beneath this tree? (Y/N)"
 if ($recrse -eq "Y")
 {
 DoRecurse
 }
 elseif ($recrse -eq "N")
 {
 DontRecurse
 }
 else
 {
 FindOut
 }
}

# The DontRecurse function runs Get-PublicFolderClientPermission on the folder that $treetop provides, except where the AccessRights value is "None", and puts the result 
into an array called $perm
# It then removes all the permissions on the folder
# Finally, it runs a ForEach loop with $perm as the input, so that each entry in the array goes through the Add-PublicFolderClientPermission cmdlet, and we put the same 
ACEs back that were present to begin with, minus the duplicates (since Exchange rejects them)

Function DontRecurse
{
Write-Host ""
Write-Host "Removing permissions on public folder $treetop"
Write-Host ""

$perm = get-publicfolderclientpermission $treetop | ?{$_.accessrights -ne "None"}

$perm | remove-publicfolderclientpermission $treetop -confirm:$false

Write-Host ""
Write-Host "Replacing permissions on public folder" $treetop -ForeGroundColor Green
Write-Host ""

$perm | foreach {
 add-publicfolderclientpermission -Identity $_.Identity -user $_.user -accessrights $_.accessrights
 }
Write-Host ""
Write-Host "COMPLETED"
Write-Host ""
exit
}

# The DoRecurse function is the same as the DontRecurse function, except we add create an array of public folder paths based on the original path getting fed to Get-
PublicFolder with the -recurse switch
#We then feed each path into a foreach loop, which itself has a foreach loop just like the DontRecurse function

Function DoRecurse
{
$treepath = get-publicfolder $treetop -recurse -resultsize unlimited
Write-Host ""
Write-Host "Removing permissions on public folder tree $treetop"
Write-Host ""

$treepath | foreach {
 $pf = $_.Identity
 $perm = get-publicfolderclientpermission $pf | ?{$_.accessrights -ne "None"}
 $perm | remove-publicfolderclientpermission $pf -confirm:$false
 Write-Host ""
 Write-Host "Replacing permissions on public folder" $pf -ForeGroundColor Green
 Write-Host ""
 $perm | foreach {
 add-publicfolderclientpermission -Identity $_.Identity -user $_.user -accessrights $_.accessrights
  }
 }
Write-Host ""
Write-Host "COMPLETED"
Write-Host ""
exit
}

# Once all the above functions are defined we call the one we want to execute first:

GetTreeTop