Home / server / Questions / 403411
Accepted
chris
Asked: 2012-06-30 05:38:38 +0800 CST

Removing many Exchange full access permissions on a mailbox

  • 772

I'm trying to use Powershell to remove certain full access permissions on an account as part of a disable user process.

I need to remove all full access permissions on the account except for:

NT AUTHORITY\SELF and DOMAIN\svcEnterpriseVault

How can I go about doing this using the Remove-MailboxPermission cmdlet?

Thanks

Edit: I've gotten a little further with the command below, but I am having trouble passing the list of full-access users to the Remove-MailboxPermission cmdlet.

Get-MailboxPermission -Identity $TheUser | Select User | where {($_.User -notlike
 "NT AUTHORITY\SELF") -and ($_.User -notlike "DOMAIN\svcEnterpriseVault")} | Remove-MailboxPermission -Identity $TheUser -User [ALL THE USERS FROM THE GET-MAILBOX COMMAND]
scripting exchange powershell

2 Answers

  1. Best Answer

    Can you just do this? I removed the "Select User" since that is for display purposes only and used no parameters on "Remove-MailboxPermision" since it accepts input. Haven't tested though.

    Get-MailboxPermission -Identity $TheUser | where {($_.User -notlike
"NT AUTHORITY\SELF") -and ($_.User -notlike "DOMAIN\svcEnterpriseVault")} | 
Remove-MailboxPermission
    • 2

  2. Due to this site I tried to add -Identity at the end of the line, as in the line on the top. This worked for me.

    I excluded also some other users, because I don't know exactly what they do, am afraid to delete too much. I also added -confirm:$false:

    Get-MailboxPermission -Identity $TheUser | where {($_.User -notlike "NT AUTHORITY\SELF") -and ($_.User -notlike "NT AUTHORITY\SYSTEM") -and ($_.User -notlike "DOMAIN\Exchange Servers") -and ($_.User -notlike "DOMAIN\Exchange Trusted Subsystem") -and ($_.User -notlike "S-1-5-21*") -and ($_.User -notlike "DOMAIN\Domain Admins") -and ($_.User -notlike "DOMAIN\Organization Management") -and ($_.User -notlike "DOMAIN\Enterprise Admins") -and ($_.User -notlike "DOMAIN\Administrator") -and ($_.User -notlike "DOMAIN\Public Folder Management") -and ($_.User -notlike "NT AUTHORITY\Network Service") -and ($_.User -notlike "DOMAIN\Delegated Setup")} | Remove-MailboxPermission -Identity $TheUser -AccessRights FullAccess -confirm:$False
    • 0