I have a small application that retrieves all appointments from Exchange 2010 and puts them in a timesheet management app. The code to retrieve the appointments is as follows (it uses Exchange Web Services):
var mailbox = service.ResolveName("smtp:" + emailAddress).FirstOrDefault(o => o.Mailbox.MailboxType == MailboxType.Mailbox); var folderId = new FolderId(WellKnownFolderName.Calendar, mailbox.Mailbox.Address); var res = service.FindAppointments(folderId, new CalendarView(thisDay, nextDay.AddSeconds(-1)));
This works fine if I give the service account
GenericAll permissions using this line in EMS:
Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericAll
GenericAll gives way too much power to the account and I would like to reduce those only to permissions related to reading. I have tried different permutations of the available permissions but nothing seems to work (I am restarting IIS between the tests to make sure the permissions are not cached). For example, this line does not work:
Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericRead,ListChildren,ListObject
I have seen scripts online that would give the permissions just to read calendars but those unfortunately all seem to enumerate existing mailboxes. What I need is a solution that is run only once and will work for all mailboxes created in the future.