Two methods are discussed in this post regarding command-line modifications to Exchange 2003 mailbox security, VBScript and ADModify.Net.
Method 1 - VBScript
The first method is to use a VBScript - modifying exchange mailbox rights can be done in a very similar fashion to modifying the ntSecurityDescriptor attribute. However, to make this work you need CDOEXM installed, installed with the exchange console on your administrative workstation.
The CDOEXM (Collaboration Data Objects for Exchange Management) objects provide an interface called IExchangeMailbox. This interface inherits from IMailboxStore, and also provides an additional property key to modifying Exchange permissions - the MailboxRights property.
Instead of using the msExchMailboxSecurityDescriptor attribute, you need to get and set the DACL using the MailboxRights property. The msExchMailboxSecurityDescriptor is only a back-link from the Exchange store, it doesn’t have a matching forward-link - therefore it won't be replicated if you modify this AD attribute. It eventually would be overwritten when the DACL is replicated back from the exchange mailbox object.
I assume the reason for the backlink msExchMailboxSecurityDescriptor attribute is mostly convenience and backwards compatibility, ie, an application or an admin can read the Exchange permissions (excluding inheritance I think) without requiring CDO.
Note that the Microsoft references below provide example script on using MailboxRights to modify existing mailboxes, and although the articles are quite good and very detailed, the relevance of MailboxRights compared to msExchMailboxSecurityDescriptor wasn't immediately obvious (to me at least).
Method 2 - ADModify.Net
The second method is to use ADModify.Net - a very powerful (and therefore potentially dangerous) utility to perform bulk modifications on mailbox objects. It comes with both command-line and GUI versions.
admodcmd is the command-line version, and the following example command starts at the specified DN, filtering based on user accounts with a certain CN, and then adds full-access mailbox rights to these users for the specified group:
admodcmd -dn "OU=USERS,DC=domain,DC=com" -f "(&(objectClass=user)(objectCategory=person)(CN=user*))" -addtomailboxrights domain\GroupToAdd ACE_MB_FULL_ACCESS
Issuing Query....
12 items found matching the specified filter.
0% 50% 100%
----------------------------------------
...................................................
Successful changes: 12
Already set to specified value: 0
Failed changes: 0
Operation Completed in 4.15625 seconds.
References
How to set Exchange Server 2003 and Exchange 2000 Server mailbox rights on a mailbox that exists in the information store
http://support.microsoft.com/?id=310866
How to set Exchange Server 2000 and 2003 mailbox rights at the time of mailbox creation
http://support.microsoft.com/kb/304935
Exchange 2003 SP2 Disabling Mapi/Non-Cached Access Per User
http://technet.microsoft.com/en-us/library/bb219050(EXCHG.65).aspx
ADModify.NET - Home
http://www.codeplex.com/admodify
Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.
Information regarding Windows Infrastructure, centred mostly around commandline automation and other useful bits of information.
3 comments:
Have you heard about security explorer for exchange ?
I think it's much easier way to do the same.
The tool provides very powerful way for managing exchange mailbox security permissions as well as ntfs, sharepoint and sql permissions.
It's much easier to do the same with security explorer for microsoft exchange .
I've been using this new tool from ScriptLogic and really like it.
You don't need to navigate multiple menus - you can do everything from a tree view. Security explorer also inludes permissions cloning abilities for transfering permissions from one account to another as well as quite powerful backup and reporting features.
I'm an engineer. But I had an unpleasant issue with MS Exchange. I asked the help an one man on a soft forum. I was lucky and his advice aided me as well as would relieve in this trouble - exchange 2007 edb recovery.
Post a Comment