Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a small application that retrieves all appointments from Exchange 2010 and puts them in a timesheet management app. The code to retrieve the appointments is as follows (it uses Exchange Web Services):

var mailbox = service.ResolveName("smtp:" + emailAddress).FirstOrDefault(o => o.Mailbox.MailboxType == MailboxType.Mailbox);
var folderId = new FolderId(WellKnownFolderName.Calendar, mailbox.Mailbox.Address);
var res = service.FindAppointments(folderId, new CalendarView(thisDay, nextDay.AddSeconds(-1)));

This works fine if I give the service account GenericAll permissions using this line in EMS:

Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericAll

However, GenericAll gives way too much power to the account and I would like to reduce those only to permissions related to reading. I have tried different permutations of the available permissions but nothing seems to work (I am restarting IIS between the tests to make sure the permissions are not cached). For example, this line does not work:

Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericRead,ListChildren,ListObject

I have seen scripts online that would give the permissions just to read calendars but those unfortunately all seem to enumerate existing mailboxes. What I need is a solution that is run only once and will work for all mailboxes created in the future.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.