Using security groups to grant Full Mailbox Permissions

Hi, I've of course found several articles discussing granting full mailbox permissions to universal security groups in Exchange 2010, however, most of them are outdated and provide contradicting information.
So I figured I'd ask here to generate a more 'current' discussion of this and get the real answers.
If I do the following:
1. Create a shared mailbox
2. Create a Universal Security group (USG)
3. Add User X to the USG
4. Grant the USG Full Access Permissions to the shared mailbox
Q1: Will the shared mailbox automatically show up in User X's mailbox? I've read posts/articles claiming both NO and YES to this question. Some say you have to still go through the 'open additional mailboxes' setting in Outlook.
Q2: According to the below thread, this is actually still a bug in Exchange 2010 in that when you assign Full Access to a Universal Group, it is supposed to auto-populate, but doesn't. Further, there are claims that USG replication takes a good 12-24 hours
before showing up in the user's Outlook. Some say you actually need to restart the Information Store before it will take affect. This is in stark contrast to granting full access to an individual user account, which takes affect immediately.
So what is the real truth here when using USGs to grant Full Access?
https://social.technet.microsoft.com/Forums/exchange/en-US/9840fd13-daf8-45aa-ab35-4a827f1ba1e0/exchange-2010-unable-to-assign-full-access-permissions-using-a-security-group?forum=exchangesvrgenerallegacy
Thanks,

Hi squishmike,
Thank you for your question.
Q1: Will the shared mailbox automatically show up in User X's mailbox? I've read posts/articles claiming both NO and YES to this question. Some say you have to still go through the 'open additional mailboxes' setting in Outlook.
A: By my testing, we still go through the ‘open addition mailbox’ setting in outlook when we open outlook with new profile.
Q2: According to the below thread, this is actually still a bug in Exchange 2010 in that when you assign Full Access to a Universal Group, it is supposed to auto-populate, but doesn't. Further, there are claims that USG replication takes a good 12-24
hours before showing up in the user's Outlook. Some say you actually need to restart the Information Store before it will take affect. This is in stark contrast to granting full access to an individual user account, which takes affect immediately.
So what is the real truth here when using USGs to grant Full Access?
A: Question 1 has been answered it. It will show share mailbox by ‘open additional mailbox’, we will add shared mailbox manually.
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim

Similar Messages

Can I grant permission to write in specific attributes using security groups

Hi
I Created GPO that write the computer name in the one of the user attribute "comment attribute " when he logged on
then i went to OU and grant self delegate permissions to allow the users of that OU to write on "comment attribute
but this did not work for the users how have been disabled form inheritance
so instead of grant delegate permissions to the OU
Can I grant permission to write in specific attribute "comment attribute " using security groups "Domain User "??

Hi,
Open Active Directory Users and Computers.
On the View menu, select Advanced Features.
Right-click the object for which you want to assign, change, or remove permissions, and then click Properties.
On the Security tab, click Advanced to view all of the permission entries that exist for the object.
To assign new permissions on an object or attribute, click Add.
Type the name of the group, computer, or user that you want to add, and then clickOK.
In the Permission Entry for ObjectName dialog
box, on the Object and Properties tabs,
select or clear the Allow or Deny check
boxes, as appropriate.
http://technet.microsoft.com/en-us/library/cc757520(v=ws.10).aspx
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

Which AD Attributes are use to store Send-As, Full-Access permissions and Calendar permissions?

Hello All,
Please, could someone tell me Which AD Attributes are use to store Send-As, Full-Access permissions and Calendar permissions?
Regards
José Osorio

Hi Jose,
Based on my test, the value of attribute msExchDelegateListLink points to Full Access permission while the
publicDelegates indicates Send on behalf permission.
As for Send as permission, it is the permission in the Access Control List which is a list of permissions attached to an object. Just like:
Thanks,
Winnie Liang
TechNet Community Support

Security Groups when in 'Project Server Permissions Mode' - Project Online

Hi All,
We have Project Online up and running, by default the PWA instance we added to O365 was in "SharePoint Permissions" Mode, we changed to "Project Server Permissions" Mode because of some complex security we need to configure. For some
reason (different from Project Server 2013) Project Online creates a number of Security Groups by default that seem to be duplicates. For example for Administrators there are:
- Administrators
- Administrators for Project Web App
- Web Administrators (Project Web App Synchronized)
For Project Managers:
- Project Managers
- Project Managers (Project Web App Synchronized)
- Project Managers for Project Web App
And there is something similar for all the groups (compared to Project Server 2013):
I have looked online, with no luck, for some guidance on what all these groups are and if I can delete some of them without causing PWA to crash.
If anyone out there can point me in the right direction / send me some documentation or links it will be greatly appreciated!
Thanks!
Jorge

Hi Jorge, I had the same thing on two different tenants within the last week - one today. I will just clean up the SharePoint groups manually. The ones with the descriptions are the correct Project Server permission mode groups... Hopefully Microsoft will
fix this soon, you could raise a support ticket on your office 365 tenant - support is pretty quick! Paul
Paul Mather | Twitter |
http://pwmather.wordpress.com | CPS

Use AD Security Groups for SharePoint database permissions

In our SharePoint environment we have around 30 content databases. Each of these content databases need a few application pool accounts added to there permissions for various service applications etc. Currently all the accounts are added individually,
but this can be a little error prone. Is there a reason why we could just pop all the required accounts in an AD security group and add that database permissions in SQL?

You could do that, but your service accounts shouldn't be accessing the databases directly, instead routing through the SharePoint API, which then permissions would be taken care of by SharePoint accounts (or if you have custom Service Applications, the
service app pool account).
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Unable to change members of AD security groups who have access to shared mailboxes

I have an exchange 2013 running for over a year now and never had any problems with it. Until recently.
A request came in to make a new shared mailbox. So I did just that and gave rights to a security (not mail enabled) AD group. Just like I Always do. Everything worked fine. A few hours later I did exactly the same for another request and then the people
could not access the shared mailbox. So I added my regular user to the AD group and I also couldn't (I tested it with OWA and Outlook). I tried to remove myself of one of my own shared mailboxes and the permissions wouldn't stick. When I removed the entire
group then the permissions were gone(and I could not access the shared mailbox). When I added it back I had my permissions back but still wasn't in the group. Then I tried adding a distribution group with the same result.
It seems when I add normal users directly to the permissions everything works.
When I had to restart the server a few days later. All changes were applied but I could not change it again.
i'm a bit stumped on this one. i'm out of options.

Hi Jelle,
"I did exactly the same for another request and then the people could not access the shared mailbox.", I would like to verify if you give the same Security Group rights to multiple shared mailboxes.
If the security group members can't have access to all the shared mailboxes they have rights, you can recreate a security group and grant permissions to shared mailboxes one by one to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

AD security group issues in SharePoint 2013 Integrated Mode

Hello,
Sorry if this is the wrong forum, I'm not sure if this is a SharePoint issue or a Reporting Services configuration issue (or if it should be in a SharePoint forum regardless).
I have SSRS2012 on SharePoint 2013 in integrated mode. We are doing item level permissions, which means we have an AD security group Reports-All with
Read to the Reports document library, then each actual report has unique permissions. We have a report with the ProjectManagers AD
security group on it with Read (plus some other stuff to let them manage subscriptions), and another AD security group ProjectUsers with
just Read access so they can open the reports. The data source used by this report has the AD security group I mentioned before, Reports-All,
with Read.
At a SharePoint level, things appear to work. When a user in ProjectManagers or ProjectUsers browses
to the library, they see only the 3 reports that those two security groups have permission to see (out of a lot more in the library). That means SharePoint is reading those security group memberships correctly as far as I can tell.
The issue is when a user in ProjectManagers or ProjectUsers clicks
on a report, they get a reporting server based error message, and the ULS logs have an error specific to the user trying to run the report.
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'MyDomain\MyUser' are insufficient for performing this operation. (Fault Detail is equal to Microsoft.ReportingServices.ServiceContract.RsExceptionInfo)
If I add that specific user with Read permissions to the report and the data source, they are then able to run the report without errors. It seems like some Report Server component is not liking the fact that I'm using security groups.
Has anyone seen this behavior with AD security groups? Any ideas on why my environment does not want to work properly with those even though AD security groups are working fine for other non-Reporting Services files?
Thanks,
Aaron

Hi aaronzott,
According to your description, you configured SSRS 2012 of SharePoint integrated mode. You added read permission to reports and data source to AD security group Reports-All, then added just read permission to ProjectManagers and ProjectUsers groups. When
users in ProjectManagers or ProjectUsers groups click report, the error message occurred. After you added Read permissions to the report and the data source to the groups, they can preview the report without errors.
Report definition permissions are defined through List permissions on the library that contains the report, but we can set permissions on individual reports if we want to restrict access. Set properties on a report including data source connection information,
processing options, and parameter properties. Edit Items on the library that contains the report or on the individual report. We also need to have view permissions on a shared data source (.rsds) to select it for use with the report.
For more information about Set Permissions for Report Server Operations in a SharePoint Web Application, please refer to the following document:
http://msdn.microsoft.com/en-us/library/bb326286(v=sql.110).aspx
If you have any more questions, please feel free to ask.
Thanks,
Wendy Fu
If you have any feedback on our support, please click
here.

Unable to grant full access permission

I am trying to grant full access permissions for one user to another users mailbox when I right click on the user the command does not appear to allow this. I have tried using the Add-MailboxPermission CMdlet but this is not recognised either.
My exchange knowledge is relatively limited so it may be something simple, but I would appreciate any assistance.
best regards
James

Turns out someone had saved the wrong credentials in the RDP connection and I was logging in as the wrong user.

Exchange 2010 Shared mailbox permissions gone

In Exchange2010, I created a shared mailbox yesterday, then granted several groups and individuals "full access permissions" to the Shared mailbox.
When I arrived at work this morning and looked at the permissions, all the permissions I had assigned were gone, except for a single individual.
I re-applied the same permissions and checked them an hour later and they were gone again. I thought it may be related to the groups, so I selected several individuals and gave them Full Access Permissions to the Shared Mailbox. I checked
that some time later to discover that several individuals were missing again..
What might cause this to happen

Hi,
As Willard suggested, please check if these problematic mailboxes are members of Domain Admins or Enterprise Admins. Domain Admins and Enterprise Admins are assigned the explicit Deny permissions for Send As and Receive as on the main Exchange Organization
object in AD. If you want to grant them full access permission, you need to remove the explicit Deny permissions.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Export Mailbox permissions to CSV

I am looking for a powershell script to export mailbox permissions. I have a list of accounts that I know are shared to other users but I want to be able to export all their permissions to a CSV so I can then replicate these permissions in Office 365. I
have a script now that pulls every mailbox and its permissions but it is such a mess i would like to be able to pull a file much cleaner they what i have.
The one I have now is
Get-Mailbox | Get-MailboxPermission | Select {$_.AccessRights}, Deny, InheritanceType, User, Identity, IsInherited, IsValid | Export-Csv D:\test_permission.csv
I want to be able to only pull data from the list of mailboxes that i have, and only see accounts/groups that have full mailbox rights. If I could filter out system accounts that would be great as well. i tried modifying this script but had no such luck.
Thanks!

Hi,
I have a test in my environment using Exchange 2010. You can use the following cmdlet Amit provided to find who has full mailbox access on one or more mailboxes in your environment and export the result to a CSV file.
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission | Where {$_.user -notlike "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false} | Select Identity,User,@{Name='Access Rights';Expression={[String]::join(‘, ‘, $_.AccessRights)}} | Export-Csv C:\MailboxAccess.csv
-NoTypeInformation
Please change the "C:\MailboxAccess.csv " to the location that you use to save this .csv file.
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

Security group guidance

Hello,
I'm having all sorts of troubles getting security groups working within SharePoint. I'm aware of the various timeouts and caching that occur and have changed my WindowsTokenLifeTime to 30 minutes to pick up security group changes faster. However, I have
some areas in SharePoint where even after days, users in security groups with access to a site, library, or document still do not have access and they don't show up in Check Permissions. Also, I have some instances where a user, as a member of a security group
with access to a file, has access one day and then the next day does not. This happens for multiple users in multiple locations and I have no idea what's going on.
Is there any guidance other than this about using AD security groups in SharePoint?
http://technet.microsoft.com/en-us/library/cc261972(v=office.15).aspx
This is really messing with my head.
Our farm is SharePoint 2013 SP1. Some of my security groups have nested security groups, some don't, and both have these issues.
Thanks,
Aaron

I'm going to have to re-open this in a Reporting forum because this is so confusing.
So our setup is SSRS2012 on SharePoint 2013. We are doing item level permissions, which means we have an AD security group
Reports-All with Read to the Reports folder, then each actual report has unique permissions. We have a report with the
ProjectManagers AD security group on it with Read (plus some other stuff to let them manage subscriptions), and another AD security group
ProjectUsers with just Read access so they can open the reports. The data source used by this report has the AD security group I mentioned before,
Reports-All, with Read.
At a SharePoint level, things appear to work. When a user in ProjectManagers
or ProjectUsers browses to the library, they see only the 3 reports that those two security groups have permission to see (out of a lot more in the library). That means SharePoint is reading those security group memberships correctly
as far as I can tell.
The issue is when a user in ProjectManagers or ProjectUsers
clicks on a report, they get a reporting server based error message, and the ULS logs have an error specific to the user trying to run the report.
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'MyDomain\MyUser' are insufficient for performing this operation. (Fault Detail is equal to Microsoft.ReportingServices.ServiceContract.RsExceptionInfo)
If I add that specific user with Read permissions to the report and the data source, they are then able to run the report without errors. It seems like some Report Server component is not liking the fact that I'm using security groups.
Even though I'm going to put this elsewhere I figured I'd expand on my situation here in case it's an obvious solution to someone.

Full access permissions and calendars

Quick question...in Exchange 2007 if you grant full access permissions on a mailbox, does it also give full owner rights to the calendar as well?
So if User A has full access permissions to User B's mailbox, do they also get Owner permissions on the calendar of User B?

Hi,
When you grant the Full Access permission to another user for a mailbox, that user becomes able to log on to the mailbox and access its entire contents. This includes calendar as well.
Grant Full Access permission is different from applying the Owner role to a folder. For more details, you can refer to the following articles.
Add-MailboxPermission:http://technet.microsoft.com/en-us/library/bb124097(v=exchg.150).aspx
Add-MailboxFolderPermission:http://technet.microsoft.com/en-us/library/dd298062(EXCHG.140).aspx
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Restrict printers based on security groups

We have set up all of our printers on a server and deployed them via group policy. I am looking for a way to restrict printing based on which security group the user is in. We have got it working by setting permissions in the printer security tab
in the server. But I would like a more elegant solution, since the printers that the user can't print to are greyed out with an X over the icon. I would like to have the printer not even show up in the printer list if that user isn't allowed to
print there.
Is this possible?
We are running Windows Server 2008 R2 and our clients are all Windows 7.
Thank you.

Hi,
Based on your description, we can use Security Filtering to apply the printer deployment GPO polices to the specific groups.
Regarding this point, the following articles can be referred to for more information.
Security filtering using GPMC
http://technet.microsoft.com/en-us/library/cc781988(v=WS.10).aspx
Filter using security groups
http://technet.microsoft.com/en-us/library/cc779291(v=WS.10).aspx
Besides, we can choose to deploy printers via GPP and use Item-level Targeting to filter out users who don’t need the printers.
Regarding this point, the following blog can be referred to for more information.
Deploying Printers with Group Policy Preferences (Complete Guide)
http://deployhappiness.com/deploying-printers-with-group-policy-preferences/
Regarding Item-level Targeting, the following articles can be referred to for more information.
Preference Item-Level Targeting
http://technet.microsoft.com/en-us/library/cc733022.aspx
Security Group Targeting
http://technet.microsoft.com/en-us/library/cc772471.aspx
Best regards,
Frank Shen

File Server Migration - For ORG A Forest to ORG B Forest ( Need to create and Map Security Group automatically on new Migrated Folders - Please Help

I have two forest With Trust works Fine .
I have file server in ORG – A ( Forest ) with 2003 R2 Standard
I have a File server in ORG - B ( Forest ) With Windows server 2012 ( New Server for Migration )
I have 1000 + folders with each different permission sets on ORG-A. We are using Security groups for providing permission on the share Folders on ORG A
I need to Migrate all the folders from ORG – A to ORG – B.
I am looking for an automated method of creating Security Groups on AD during the Migration, Once the Migration is Done, I can add the required users to the security groups manually.
Example.
Folder 1 on ORG – A has Security Group Called SEC-FOLDER1-ORGA
I need an automated method of Copying the files to ORG – B and Creating a new security Groups on ORG –B Forest with the same permission on parent and child Folders. I shall Add the users manually to the Group.
Output Looks Like
Folder 1 on ORG – B has Permission called SEC-FOLDER1-ORGB ( New Security Group )
Also I need a summarized report of security Group Mapping, Example – Which security Group on ORGA is mapped with Security Group Of ORGB

Hi,
I think you can try ADMT to migrate your user group to target domain/forest first. Once user groups are migrated, you can use Robocopy to copy files with permission - that permission will continue be recognized in new domain as you migrated already.
Migrate Universal Groups
http://technet.microsoft.com/en-us/library/cc974367(v=ws.10).aspx
If you have any feedback on our support, please send to [email protected]

Grant full access object in database

Hi Experts,
I try use sysdba account to grant full object access right to a user. But I got error as
SQL> declare
2 I number;
3 begin
4 FOR I IN (SELECT TABLE_NAME FROM DBA_tables)
5 LOOP
6 EXECUTE IMMEDIATE 'GRANT SELECT ON ' || I.TABLE_NAME || ' TO allselectl';
7 END LOOP;
8 end;
9 /
declare
ERROR at line 1:
ORA-00911: invalid character
ORA-06512: at line 6
I try to user a DBA account (also as a schema owner_ I got error as
SQL> declare
2 I number;
3 begin
4 FOR I IN (SELECT * FROM ALL_tables)
5 LOOP
6 EXECUTE IMMEDIATE 'GRANT SELECT ON ' || I.table_name || ' TO allselect';
7 END LOOP;
8 end;
9 /
declare
ERROR at line 1:
ORA-00942: table or view does not exist
ORA-06512: at line 6
Here allselect is a role that created by dba account.
Could you help me to do this job?
I use oracle 10gR4 in 32 bit window2003
Thanks
JIM
Edited by: user589812 on Jun 2, 2009 8:31 AM

Hi Justine,
Thanks for your help.
It works and get below error.
Error executing grant select on "SYS"."SYS_IOT_OVER_4478" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_4484" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_4488" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_5082" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_5168" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_8691" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_8801" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_9694" TO allselect
Error executing grant select on "WMSYS"."SYS_IOT_OVER_10101" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_40414" TO allselect
Error executing grant select on "CTXSYS"."SYS_IOT_OVER_40888" TO allselect
Error executing grant select on "CTXSYS"."SYS_IOT_OVER_40933" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42452" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42459" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42466" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42469" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42488" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42491" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42494" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42497" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153360" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153363" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153258" TO allselect
Error executing grant select on "STRMADMIN"."SYS_IOT_OVER_167992" TO allselect
Error executing grant select on "STRMADMIN"."SYS_IOT_OVER_168042" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_60551" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_57132" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_147443" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_147585" TO allselect
how about to access all of other objects in database?
Thanks
JIM

Using security groups to grant Full Mailbox Permissions

Similar Messages

Maybe you are looking for