Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company is running Exchange 2007. From time to time, we need to open a user's Mailbox to to various tasks. Until now, we've been logging is as them and using Outlook directly. I'd like to give Full Access permission for all mailboxes to an "IT" security group in active directory, that way we can simply open their folders/mailbox in Outlook under our accounts. I understand the syntax to do this from PowerShell, but Exchange won't find the "IT" group name.

 Add-MailboxPermission -Identity 'IT' -User '*' -AccessRights 'FullAccess'

The command stalls on the Identity parameter. It works fine when another exchange user is specified, but not for AD groups. I CAN add the permission through the GUI, but only one account at a time. I've tried this in every configuration I could think of, including 'DOMAIN\IT' 'CN=IT,etc..', but no dice. Any help?

Thank you!

share|improve this question
Wow, I hope that the legalities have been addressed. – mdpc Dec 20 '12 at 22:03
Have you tried the full distinguished name of the LDAP object? (And, now that I think of it, wouldn't it be easier to just add the Organization Management role to your IT group?) – HopelessN00b Dec 20 '12 at 22:06
@mdpc Company email isn't private, that's policy. – tfrederick74656 Dec 20 '12 at 22:24
@HopelessN00b The OM role only gives you rights to define permissions, such as grant yourself access, not the actual access itself, I think...could be wrong. My colleague has all the Exchange roles though, and he couldn't directly access other mailboxes. I will look into this tomorrow. – tfrederick74656 Dec 20 '12 at 22:27
@tfrederick74656 Yeah, well I assumed OM had access to all the mailboxes...I guess that doesn't have to be the case, but it's the way I've always set it up. – HopelessN00b Dec 20 '12 at 22:36
up vote 4 down vote accepted

You have it backwards there. The -user reference is to the security principal that you give permission to. -Identity is the identity of the resource that the -user gets permissions on.

$Mailboxes = Get-Mailbox -ResultSize unlimited 
foreach($Mailbox in $Mailboxes){Add-MailboxPermission -Identity $Mailbox -User 'IT' -AccessRights 'FullAccess'}
share|improve this answer
doh! I can't believe I missed that! I'll give it a shot tomorrow morning. – tfrederick74656 Dec 20 '12 at 22:23
Worked perfectly, thank you very much! – tfrederick74656 Dec 21 '12 at 19:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.