Who has full access on all mailboxes in Exchange 2010 using Powershell ?

Question

Greetings,
Could you please tell me how can i know Who has full access on all mailboxes in Exchange 2010 using Powershell ?
Thanks.
Redouane SARRA

Answer 1

This is going to depend greatly on WHICH inherited permissions you plan to delete - there are some that you can never delete if you want the system to function properly.  Now, that being said, let's look at some example permissions.  First, here
are some permissions on a standard mailbox:
Identity             User                 AccessRights                                               
IsInherited Deny
users.corp.... USERS\btwatcher    {FullAccess}                                               
False       False
users.corp.... USERS\svcactAdmin {FullAccess}                                               
True        False
users.corp.... CORP\Domain Ad... {FullAccess}                                               
True        True
users.corp.... CORP\Enterpris... {FullAccess}                                               
True        True
users.corp.... CORP\Organizat... {FullAccess}                                               
True        True
users.corp.... CORP\adminact    {FullAccess}                                               
True        True
users.corp.... CORP\esswin       {FullAccess}                                               
True        True
users.corp.... USERS\svcactEncase {FullAccess}                                               
True        False
users.corp.... CORP\Exchange ... {FullAccess}                                               
True        False
users.corp.... NT AUTHORITY\SYSTEM  {FullAccess}                                               
True        False
As you can see, the first is not inherited.  All others are, and two are from service accounts (svcact...).  Also, some are Exchange system permissions, some are denies, and some are just administrative accounts.  Once you determine which
you wish to remove, the SIMPLEST way to set the permissions you want is to open the account properties in ADSIEdit, and go to the Security tab.  Here, click the Advanced button and find the inherited permission you wish to remove.  ADSIEdit will
show where the permission is inherited from - you will need to go to that container to remove the inherited permission.  You can also grant inherited denies at the same level(s).
Now, something you will need to understand is that if you hope to remove permissions granted to domain administrators, the system will replace them - these permissions are required by the system and can't be modified permanently.