Exchange Admin without the right to assign / revoke the Full Access Permission

Question

Hello,
I would like to create Exchange Administrator who can do all mail box related administration except assign/revoke Full Access Permission and Send As Permission to other users' mail box or hims own mail box.
Exchange: MS Exchange 2007
OS: Windows 2008

Answer 1

You would have to regularly update his rights on the mailboxes - you can't grant the rights to the distribution group and have them apply to the mailboxes it contains.  This means that when someone moves from his department, you would need to immediately
have to remove his rights from that mailbox, since just basing his rights on mailboxes in the group would add more members, but never remove him from existing ones.
For instance, in your list above, Bill manages John, Paul, Jim, and Harry.  Suppose Harry moves from Bill's department, and Dave joins it.  If you just go by group membership, Dave would get added, but there's no easy way to see that Harry is no
longer in the department.  You would either have to mark this in the notes of the group ("Harry left 3/16/2015'), or you would have to immediately remove Harry from the group.  Consider if Harry was promoted to Bill's level - he wouldn't want
Bill to have rights on his mailbox just because he had them when he was Bill's direct report.
As for a script you can run each week to add the mailbox rights, that's pretty simple.  You'd use
Get-Group <group alias> | % { $_.Members } to get the list of group members, and you'd use
Add-MailboxPermission $ChkMbx -User $_.Alias -AccessRights FullAccess
to add the full mailbox access rights.  The following would be a good starting point:
Get-Group <group alias> | % { $_.Members } | % {
    Add-MailboxPermission $_.DistinguishedName -User <manager alias> -AccessRights FullAccess
I'll caveat this response - I have Exchange 2010 and don't have an Exchange 2007 system to check the commands or their syntax with.  Your mileage may vary.