Giving service account access to all mailboxes on an Exchange 2007 server

re: Giving service account access to all mailboxes on an Exchange 2007 server

Joel Stidley — Fri, 16 Jan 2009 04:28:16 GMT

You will need to run it again. You could setup a Scheduled Task to run the script periodically rather than having to do it manually.

re: Giving service account access to all mailboxes on an Exchange 2007 server

fantom — Thu, 07 Aug 2008 09:01:20 GMT

The command works great but how do I apply it to all new users without running it again ? - Thanks

Get-mailboxserver <servername> | add-adpermission –user <service account> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

re: Giving service account access to all mailboxes on an Exchange 2007 server

fantom — Thu, 07 Aug 2008 08:58:08 GMT

The command below works great but how do I have the permmision applied to all new users without running it again ?

Thanks.

Get-mailboxserver <servername> | add-adpermission –user <service account> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

re: Giving service account access to all mailboxes on an Exchange 2007 server

john — Fri, 05 Jan 2007 16:30:27 GMT

It accepts this command:

get-publicfolderdatabase | add-adpermission -user <service account> -ExtendedRights ms-exch-create-top-level-public-folder -AccessRights ReadProperty,GenericExecute

Tested that in the shell and it gives back that the service account has

those 3 permissions (without deny) on the database.

but sadly enough.. the serviceaccount STILL can't create top level public folders in outlook when I remove him from the {exchange organization admins} group.

So it is obviously not replicating the permissions down to the PF tree. (I restarted the information store)

sadly enough

re: Giving service account access to all mailboxes on an Exchange 2007 server

john — Fri, 05 Jan 2007 16:16:39 GMT

That's interesting! (can't say it's an improvement over 2003 though)

anyway

To find the PF DN there must me a smart way available which we can pipe into the command.

searching..

re: Giving service account access to all mailboxes on an Exchange 2007 server

Joel Stidley — Fri, 05 Jan 2007 16:05:03 GMT

I got this from a contact at Microsoft:

add-adpermission –id <DN of the PF hierarcy> -user <service account> -ExtendedRights ms-exch-create-top-level-public-folder -AccessRights ReadProperty,GenericExecute.

This can also be done using ADSI Edit.

The DN would be something like: CN=Public Folders,CN=Folder Hierarchies,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=YourExchangeOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=YourDomain,DC=com

re: Giving service account access to all mailboxes on an Exchange 2007 server

john — Fri, 05 Jan 2007 08:44:19 GMT

Thanks again, but that command does not change the status quo.

It finishes fine and grants the permission to the service account but the service account can not create a new top level public folder unless he is made member of the exchange organization administrators group in the AD.

I see the same behavior with the event sink that I am trying to install on this e2k7.

The eventsink script triggers ok on the onsave event of the service account's outlook calendar and passes the url over to the sink handler (com+) but when that tries to open a record to that user item it's also Access Denied. However, running the sink handler in debug mode, logged on as the service account works ok.

re: Giving service account access to all mailboxes on an Exchange 2007 server

Joel Stidley — Fri, 05 Jan 2007 06:28:40 GMT

That command will work below the root, try this at the root:

Add-PublicFolderAdministrativePermission

\ -user <service account> -AccessRights AllExtendedRights

re: Giving service account access to all mailboxes on an Exchange 2007 server

john — Thu, 04 Jan 2007 23:42:47 GMT

Thanks! however on my 32 bits test version of 2007 it refuses to do that with a { Failed to commit the change on object "\" because Access is denied. } message.

re: Giving service account access to all mailboxes on an Exchange 2007 server

Joel Stidley — Thu, 04 Jan 2007 20:29:49 GMT

In order to allow an email enabled account to be able to create a root folder you can run this:

Add-PublicFolderClientPermission -Identity "\" -User <service account> -AccessRights CreateItems

re: Giving service account access to all mailboxes on an Exchange 2007 server

john — Thu, 04 Jan 2007 15:32:55 GMT

Thanks for the info, however this does not give the <service account> user the required permissions to create top level public folders. Any idea how to do that?