Full Mailbox Access Permissions in Exchange Server 2007

In Exchange Server 2000/2003, we can use Active Directory Users and Computers snap-in to assign the Full mailbox access permissions. Since Exchange Server 2007 does not use ADUC for recipient management, so we cannot use ADUC for assigning full mailbox access permissions. Instead we can use Exchange Management Console or Cmdlet to assign or revoke the full mailbox permissions.

Add-MailboxPermission cmdlet can be used for assigning permissions for 1) SendAs 2)ExternalAccount 3)DeleteItem 4)ReadPermission 5) ChangePermission 6)ChangeOwner 7)FullAccess

This example assigns Full Mailbox Access permission on Richard' mailbox to another user Kathy:

Add-MailboxPermission "richard" -AccessRights FullAccess -user "kathy"

To view the permissions use:-

Get-MailboxPermission
To view permissions on a mailbox, use the Get-MailboxPermission command:-

Get-MailboxPermission "richard"

To view explicitly assigned permissions (i.e. permissions that are not inherited):

Get-MailboxPermission "richard" | where {$_.IsInherited -eq $false}

To view all security principals with Full Access permission on a mailbox:

Get-MailboxPermission "richard" | where {$_.AccessRights -like "*FullAccess*"}