Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small application that retrieves all appointments from Exchange 2010 and puts them in a timesheet management app. The code to retrieve the appointments is as follows (it uses Exchange Web Services):

var mailbox = service.ResolveName("smtp:" + emailAddress).FirstOrDefault(o => o.Mailbox.MailboxType == MailboxType.Mailbox);
var folderId = new FolderId(WellKnownFolderName.Calendar, mailbox.Mailbox.Address);
var res = service.FindAppointments(folderId, new CalendarView(thisDay, nextDay.AddSeconds(-1)));

This works fine if I give the service account GenericAll permissions using this line in EMS:

Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericAll

However, GenericAll gives way too much power to the account and I would like to reduce those only to permissions related to reading. I have tried different permutations of the available permissions but nothing seems to work (I am restarting IIS between the tests to make sure the permissions are not cached). For example, this line does not work:

Get-MailboxDatabase | Add-ADPermission -user "DOMAIN\User" -InheritanceType All -AccessRights GenericRead,ListChildren,ListObject

I have seen scripts online that would give the permissions just to read calendars but those unfortunately all seem to enumerate existing mailboxes. What I need is a solution that is run only once and will work for all mailboxes created in the future.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.