Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to use Powershell to remove certain full access permissions on an account as part of a disable user process.

I need to remove all full access permissions on the account except for:

NT AUTHORITY\SELF and DOMAIN\svcEnterpriseVault

How can I go about doing this using the Remove-MailboxPermission cmdlet?


Edit: I've gotten a little further with the command below, but I am having trouble passing the list of full-access users to the Remove-MailboxPermission cmdlet.

Get-MailboxPermission -Identity $TheUser | Select User | where {($_.User -notlike
 "NT AUTHORITY\SELF") -and ($_.User -notlike "DOMAIN\svcEnterpriseVault")} | Remove-MailboxPermission -Identity $TheUser -User [ALL THE USERS FROM THE GET-MAILBOX COMMAND]
share|improve this question
up vote 2 down vote accepted

Can you just do this? I removed the "Select User" since that is for display purposes only and used no parameters on "Remove-MailboxPermision" since it accepts input. Haven't tested though.

Get-MailboxPermission -Identity $TheUser | where {($_.User -notlike
"NT AUTHORITY\SELF") -and ($_.User -notlike "DOMAIN\svcEnterpriseVault")} | 
share|improve this answer
Thank you, that worked. – chris Jul 2 '12 at 20:25

Due to this site I tried to add -Identity at the end of the line, as in the line on the top. This worked for me.

I excluded also some other users, because I don't know exactly what they do, am afraid to delete too much. I also added -confirm:$false:

Get-MailboxPermission -Identity $TheUser | where {($_.User -notlike "NT AUTHORITY\SELF") -and ($_.User -notlike "NT AUTHORITY\SYSTEM") -and ($_.User -notlike "DOMAIN\Exchange Servers") -and ($_.User -notlike "DOMAIN\Exchange Trusted Subsystem") -and ($_.User -notlike "S-1-5-21*") -and ($_.User -notlike "DOMAIN\Domain Admins") -and ($_.User -notlike "DOMAIN\Organization Management") -and ($_.User -notlike "DOMAIN\Enterprise Admins") -and ($_.User -notlike "DOMAIN\Administrator") -and ($_.User -notlike "DOMAIN\Public Folder Management") -and ($_.User -notlike "NT AUTHORITY\Network Service") -and ($_.User -notlike "DOMAIN\Delegated Setup")} | Remove-MailboxPermission -Identity $TheUser -AccessRights FullAccess -confirm:$False
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.