Remove-MailboxPermission -Identity SharedMailboxAlias -User Username -AccessRights FullAccess -InheritanceType all
Confirm Are you sure you want to perform this action? Removing mailbox permission "SharedMailboxAlias" for user "UserName" with access rights "'FullAccess'".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y WARNING: An inherited access control entry has been specified: [Rights: CreateChild, Delete, `
ReadControl, WriteDacl, WriteOwner, ControlType: Allow] and was ignored on object `
"CN=SharedMailboxAlias,OU=Shared Mailboxes,OU=Mail,DC=Domain,DC=lan".
Checked to see what was keeping me from removing the access rights:Get-MailboxPermission -Identity SharedMailboxAlias -User UserName Identity User AccessRights IsInherited Deny ======== ==== ============ =========== ==== Domain.lan/Mail/S... Domain\UserName {FullAccess} True True Domain.lan/Mail/S... Domain\UserName {FullAccess}, Delete... True FalseAnd there it was, the "IsInherited" value True.
So its coming from above...
So I had to go through and remove some legacy permissions from Exchange. This can be added at multiple levels so it’s aways a diagnostic trail to where this was added. Go through each of these and if IsInherited is set to False you’ve found out where it’s being applied from.
Get-MailBoxPermission Domain\UserName Get-MailboxDatabase | Get-ADPermission -User Domain\UserName Get-ExchangeServer | Get-ADPermission -User Domain\UserName Get-OrganizationConfig | Get-ADPermission -User Domain\UserNameRemove the Permissions per level with
Get-MailBoxPermission Domain\UserName | Remove-ADPermission Get-MailboxDatabase | Get-ADPermission -User Domain\UserName | Remove-ADPermission Get-ExchangeServer | Get-ADPermission -User Domain\UserName | Remove-ADPermission Get-OrganizationConfig | Get-ADPermission -User Domain\UserName | Remove-ADPermissionSome of the permissions where also added from AD.
Open up ADSI Edit and Navigate to these :
In “Default Naming Context” OU=Microsoft Exchange Security Groups,DC=Domain,DC=lan
In “Default Naming Context” CN=Microsoft Exchange System Objects
In “Configuration” CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Domain,DC=lan
Make sure the user is not in any of these.
After the User has been removed from any of these places its inheritance is gone is no longer listed.