Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to collect and store the folder permissions for each folder in each mailbox of our Exchange system. I'm already aware of the Cmdlet Get-MailboxFolderPermission but it has a serious problem.

The objects returned by Get-MailboxFolderPermission are a tuple of (User, AccessRights, FolderName). However, the "User" identity isn't an object, it's just a simple string representing the DisplayName of a user. (Edit: This was incorrect. See answer for details.).

However, display names are not necessarily unique in an Exchange deployment. In our forest, there are over a dozen mailboxes that have identical display names. Therefore, the results from Get-MailboxFolderPermission are ambiguous, and don't uniquely identify a single user or mailbox.

How can I get permissions on mailbox folders in an unambiguous way? I would like the ability to reassign them later using Add-MailboxFolderPermission, ideally with the UPN.

share|improve this question
FWIW, it appears that people on Office 365 complain of this very issue (with user being the samaccountname). You might be able to create a script that grabs it, parses the user and looks up the UPN for that samaccountname, and then returns what you want. But you might end up having to do the reverse for your "Add" idea. – TheCleaner Apr 26 '13 at 21:53
up vote 0 down vote accepted

After tinkering with this for a couple hours, it looks like I was wrong. The cmdlet to get permissions on folder mailboxes actually does provide everything in the User.ADRecipient property.

Get-MailboxFolderPermission "username:\Foldername" |
  Foreach-Object {

I discovered this by outputting the results using Export-Clixml which created a very large XML file. Now I know that can be a useful technique for seeing what you actually have available.

share|improve this answer
But if you ever needed to resolve a DisplayName into a UserPrincipalName, you could do something like this. – Nic Apr 26 '13 at 23:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.