Home / server / Questions / 364534
Accepted
Windows Ninja
Asked: 2012-02-29 08:01:23 +0800 CST

If an AD user is disabled and another user has full access to their mailbox, will they still be able to access the mailbox?

  • 772

In Exchange 2010, if an AD user is disabled but another user has access to their mailbox, will they still be able to access the mailbox or does that user need to remain enabled for this functionality to work?

exchange-2010

2 Answers

  1. Best Answer

    If you disable a user in AD, their mailbox still exists and you should still be able to access the mailbox because AD simply controls the authentication, but the permissions to the mailbox will still exist. At least, that was how it was in 2003. I haven't had the opportunity to work with 2010, but I assume the functionality would be similar in this regard and easily testable.

    enter image description here

    You can also connect the mailbox to someone else's account. I'm going to link you to this technet article that can give you some ideas on what will be easiest for you; technet article!

    There are three operations you can perform on a disabled mailbox:

    Connect it to an existing user account in Active Directory Restore it to a new or existing user account in Active Directory Permanently delete it from the Exchange mailbox database

    A side note to this is this applies to disabled AD accounts as well.

    • 21

  2. In response to LunizWVU's question that he posited in the comment thread about the best practices to allow a manager to see a user's mailbox after they've been disabled, one of the best ways to handle this is to give the manager user rights to open the other user's mailbox. Below is an excerpt from http://technet.microsoft.com/en-us/magazine/ff381460.aspx:

    Adding full access permissions

    

Syntax 
Add-MailboxPermission -Identity UserBeingGrantedPermission -User UserWhoseMailboxIsBeingConfigured -AccessRights 'FullAccess' 

Usage 
Add-MailboxPermission -Identity 'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com' -User 'CPANDL\boba' -AccessRights 'FullAccess'

    Removing full access permissions

    
Syntax 
Remove-MailboxPermission -Identity 'UserBeingGrantedPermission' -User 'UserWhoseMailboxIsBeingConfigured' -AccessRights 'FullAccess' 
-InheritanceType 'All' 

Usage 
Remove-MailboxPermission -Identity 'CN=Jerry Orman, OU=Engineering,DC=cpandl,DC=com' -User 'CPANDL\boba' -AccessRights 'FullAccess' 
-InheritanceType 'All'
    • 3