Occasionally, users need to access someone else’s mailbox, and in certain situations, you should allow this. For example, if John is Susan’s manager and Susan is going on vacation, John might need access to her mailbox while she’s away. Another situa- tion in which someone might need access to another mailbox is when you’ve set up special-purpose mailboxes, such as a mailbox for [email protected] or a mailbox for [email protected].
You can grant permissions for a mailbox in two ways:
n You can grant access to a mailbox and its content.
n You can grant the right to send messages as the mailbox owner.
If you want to grant access to a mailbox and its contents but not grant Send As permissions, use the Manage Full Access Permission Wizard. In the Exchange Management Console, right-click the mailbox you want to work with and then select Manage Full Access Permission. In the Manage Full Access Permission Wizard, click Add, and then use the Select User Or Group dialog box to choose the user or users who should have access to the mailbox. To revoke the authority to access the mailbox, select an existing user name in the Security Principal list box and then click Remove. Click Manage to set the desired access permissions.
If you want to grant Send As permissions, use the Manage Send As Permission Wizard. In the Exchange Management Console, right-click the mailbox you want
to work with and then select Manage Send As Permission. In the Manage Send As Permission Wizard, click Add, and then use the Select Recipient dialog box to choose the user or users who should have this permission. To revoke this permission, select an existing user name in the Security Principal list box and then click Remove. Click Manage to set the desired Send As permissions.
In the Exchange Management Shell, you can use the Add-MailboxPermission and Remove-MailboxPermission cmdlets to manage full access permissions. Samples 6-4 and 6-5 show examples of using these cmdlets. In these examples, the AccessRights parameter is set to FullAccess to indicate you are setting full access permissions on the mailbox.
SaMpLe 6-4 Adding full access permissions Syntax
Add-MailboxPermission –Identity UserBeingGrantedPermission
–User UserWhoseMailboxIsBeingConfigured –AccessRights 'FullAccess'
usage
Add-MailboxPermission –Identity
'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com'
–User 'CPANDL\boba' –AccessRights 'FullAccess'
SaMpLe 6-5 Removing full access permissions Syntax
Remove-MailboxPermission –Identity 'UserBeingGrantedPermission' –User 'UserWhoseMailboxIsBeingConfigured' –AccessRights 'FullAccess'
–InheritanceType 'All'
usage
Remove-MailboxPermission –Identity 'CN=Jerry Orman, OU=Engineering,DC=cpandl,DC=com'
–User 'CPANDL\boba' –AccessRights 'FullAccess' –InheritanceType 'All'
If you want to allow another user to send messages as the mailbox owner, you can do this using the Manage Send As Permission Wizard. In the Exchange Management Console, right-click the mailbox you want to work with and then select Manage Send As Permission. In the Manage Send As Permission Wizard, click Add, and then use the Select User Or Group dialog box to choose the user or users who should have Send As permission on the mailbox. To revoke Send As permission, select an existing user name in the Security Principal list box and then click Remove. Click Manage to set the desired access permissions.
Syntax
Add-MailboxPermission –Identity UserBeingGrantedPermission
–User UserWhoseMailboxIsBeingConfigured –AccessRights 'FullAccess'
usage
Add-MailboxPermission –Identity
'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com'
–User 'CPANDL\boba' –AccessRights 'FullAccess'
Syntax
Remove-MailboxPermission –Identity 'UserBeingGrantedPermission' –User 'UserWhoseMailboxIsBeingConfigured' –AccessRights 'FullAccess'
–InheritanceType 'All'
usage
Remove-MailboxPermission –Identity 'CN=Jerry Orman, OU=Engineering,DC=cpandl,DC=com'
In the Exchange Management Shell, you can use the Add-ADPermission and Remove-ADPermission cmdlets to manage Send As permissions. Samples 6-6 and 6-7 show examples using these cmdlets. In these examples, the ExtendedRights parameter is set to Send-As to indicate you are setting Send As permissions on the mailbox.
SAMPLE 6-6 Adding Send As permissions Syntax
Add-ADPermission –Identity UserBeingGrantedPermission
–User UserWhoseMailboxIsBeingConfigured –ExtendedRights 'Send-As'
Usage
Add-ADPermission –Identity 'CN=Jerry Orman,OU=Engineering,DC=cpandl,DC=com'
–User 'CPANDL\boba' –ExtendedRights 'Send-As'
SAMPLE 6-7 Removing Send As permissions Syntax
Remove-ADPermission –Identity UserBeingRevokedPermission
–User UserWhoseMailboxIsBeingConfigured –ExtendedRights 'Send-As' –InheritanceType 'All' –ChildObjectTypes $null
–InheritedObjectType $null -Properties $null
Usage
Remove-ADPermission –Identity 'CN=Jerry Orman,OU=Engineering, DC=cpandl,DC=com'
–User 'CPANDL\boba' –ExtendedRights 'Send-As' –InheritanceType 'All' –ChildObjectTypes $null –InheritedObjectTypes $null
-Properties $null
NOTE Another way to grant access permissions to mailboxes is to do so through Outlook. Using Outlook, you have more granular control over permissions. You can allow a user to log on as the mailbox owner, delegate mailbox access, and grant various levels of access. For more information on this issue, see the “Accessing Multiple Exchange Server Mailboxes” and “Granting Permission to Access Folders Without Delegating Access” sections in Chapter 16.