All tasks in Exchange Server 2007 or Exchange Server 2010 can be done in the Exchange Management Shell. So you are also able to give the Send-As permission and the Full-access permission via the Exchange Management Shell.
Send-As permissions
If you want to give the user Pete Peterson the Send-As permission for the John Johnson Mailbox you can use the following command line:
get-user -identity “john.johnson@msexchangeblog.nl” | Add-ADPermission -User “pete.peterson@msexchangeblog.nl” -ExtendedRights Send-As
If you want to give the Active Directory group SendAsGroup the Send-As permission for the John Johnson Mailbox you can use the same command line:
get-user -identity “john.johnson@msexchangeblog.nl” | Add-ADPermission -User “SendAsGroup” -ExtendedRights Send-As
Full-Access permission
To be able to give an user or group the Exchange mailbox Full-Access permission, you need to use two separate command lines. First you need to remove the Deny FullAccess permissions on the account. After the deny permission is removed you need to give the user or group the FullAccess permission on the Exchange Mailbox.
If you want to give the user Pete Peterson the Full-Access permission for the John Johnson Mailbox you can use the following command lines:
get-user -identity “john.johnson@msexchangeblog.nl” |Remove-MailboxPermission -User “pete.peterson@msexchangeblog.nl” -Deny -InheritanceType ‘All’ -AccessRights ‘FullAccess’
get-user -identity “john.johnson@msexchangeblog.nl” | Add-MailboxPermission -User “pete.peterson@msexchangeblog.nl” -AccessRights ‘FullAccess’
If you want to give the Active Directory group FullAccessGroup the Send-As permission for the John Johnson Mailbox you can use the same command lines:
get-user -identity “john.johnson@msexchangeblog.nl” |Remove-MailboxPermission -User “FullAccessGroup” -Deny -InheritanceType ‘All’ -AccessRights ‘FullAccess’
get-user -identity “john.johnson@msexchangeblog.nl” | Add-MailboxPermission -User “FullAccessGroup” -AccessRights ‘FullAccess’
I tried granting full access permissions to a mailbox by a AD group. The command completes without error but the msExchDelegateListLink attribute of the mailbox is not updated. Even after manually adding the CN of the group to the attribute, the members of the group do not have access to the mailbox. In other words, only adding the individual accounts to the full access permissions list works. By the way, there is a known bug that prevents the attribute from being updated when the permissions are removed. It has to be edited by hand using Active Directory Users and Groups.
Any ideas on why granting full access permissions to a group does not work?
Thanks in advance.
For Exchange-Online:
Add-RecipientPermission -Identity “Contoso Printer Support” -Trustee “Printer Support” -AccessRights SendAs