Remove-MailboxPermission -Identity SharedMailboxAlias -User Username -AccessRights FullAccess -InheritanceType all
Confirm Are you sure you want to perform this action? Removing mailbox permission "SharedMailboxAlias" for user "UserName" with access rights "'FullAccess'".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y WARNING: An inherited access control entry has been specified: [Rights: CreateChild, Delete, `
ReadControl, WriteDacl, WriteOwner, ControlType: Allow] and was ignored on object `
"CN=SharedMailboxAlias,OU=Shared Mailboxes,OU=Mail,DC=Domain,DC=lan".
Checked to see what was keeping me from removing the access rights:Get-MailboxPermission -Identity SharedMailboxAlias -User UserName Identity User AccessRights IsInherited Deny ======== ==== ============ =========== ==== Domain.lan/Mail/S... Domain\UserName {FullAccess} True True Domain.lan/Mail/S... Domain\UserName {FullAccess}, Delete... True FalseAnd there it was, the "IsInherited" value True.
So its coming from above...
So I had to go through and remove some legacy permissions from Exchange. This can be added at multiple levels so it’s aways a diagnostic trail to where this was added. Go through each of these and if IsInherited is set to False you’ve found out where it’s being applied from.
Get-MailBoxPermission Domain\UserName Get-MailboxDatabase | Get-ADPermission -User Domain\UserName Get-ExchangeServer | Get-ADPermission -User Domain\UserName Get-OrganizationConfig | Get-ADPermission -User Domain\UserNameRemove the Permissions per level with
Get-MailBoxPermission Domain\UserName | Remove-ADPermission Get-MailboxDatabase | Get-ADPermission -User Domain\UserName | Remove-ADPermission Get-ExchangeServer | Get-ADPermission -User Domain\UserName | Remove-ADPermission Get-OrganizationConfig | Get-ADPermission -User Domain\UserName | Remove-ADPermissionSome of the permissions where also added from AD.
Open up ADSI Edit and Navigate to these :
In “Default Naming Context” OU=Microsoft Exchange Security Groups,DC=Domain,DC=lan
In “Default Naming Context” CN=Microsoft Exchange System Objects
In “Configuration” CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Domain,DC=lan
Make sure the user is not in any of these.
After the User has been removed from any of these places its inheritance is gone is no longer listed.
Way to plagiarize. https://pariswells.com/blog/tag/an-inherited-access-control-entry-has-been-specified
ReplyDeleteGuess I forgot to mention the source, glad you did.
ReplyDelete