Exchange 2013 Give domain Admin access to all users inbox

Question

In the old 2007 exchange server we had domain admin access to everyones mailbox so we could open anyones email box using outlook client.
But in 2013 exchange the mailbox delegation does not give us the option to add a "group" to the full access area, old allows to add a "user" who has a mailbox setup in exchange. I see there is Exchange Server group listed under Full Access
, but it does not work added our domain Admin user to that group rebooted exchange and the test machine but did not work.
Only option that works to allow mounting of xyz users mailbox via abc admin user is to actually add that abc admin user to the xyz mailbox under mailbox delegation > Full Access.
Is  there a work around this, so we can simply have a group ABCD with user ABC or DEF etc. etc. so they can access everyones mailbox instead of going in and changing all users mailbox delegation one by one for the new user etc. ?

Answer 1

Have you tried using the Exchange Management Shell?
Get-Mailbox | Add-MailboxPermission -User Name_of_Group -AccessRights FullAccess -InheritanceType All
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
I did i tried get-mailboxpermission and other than NT Authority and the end user the Deny was set to True for all inheritance rights. I tried your command, added user to the group i wanted under Enterprise OU in AD and restarted transport on exchange and
logged in on the test machine again.
Still no go, the user I am trying to add when using get-mailboxpermission shows up as Denied for fullaccess so is that overriding the group permissions ?
RunspaceId      : 2xxxxxxx0
AccessRights    : {FullAccess}
Deny            : True
InheritanceType : All
User            : domain\abc
Identity        : domain/Users/xyzuser
IsInherited     : False
IsValid         : True
ObjectState     : Unchanged
And for the group i just added with the above abc user inside it:
RunspaceId      : 2xxxxxxxxx0
AccessRights    : {FullAccess}
Deny            : False
InheritanceType : All
User            : domain\newgroupadded
Identity        : domain/Users/xyzuser
IsInherited     : False
IsValid         : True
ObjectState     : Unchanged
So is the users deny is causing this ? Not really sure why ABC domain admin/enterprise admin is the only one listed as no deny, there are other mailbox users that do not show up, I am assuming I have to create a new user a domain local user and that might
work ? I wanted the Domain/Enterprise Manager/admin to have access so we would not have to keep toggling between users just to access someones inbox.
Also further down the list of mailboxpermission i see the user abc (the user i want to add to the group to have access) is listed with Full access and Deny flag is set to False instead of True.
So have two entries for user abc one with deny flag set to true and one with deny flag to false.
AccessRights    : {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}
Deny            : False
InheritanceType : All