0

I have a couple powershell scripts used to deleted out contacts then import them back in to a list of users. We had these scrips locally on the exchange server but wanted to consolidate so we moved them all to a central location. However since doing that one of them stopped working with a access denied error. For example the following:

New-MailboxInportRequest -Mailbox OurUser -FilePath "\\Server1\Share\Scripts and Commands\Contacts.pst" -TargetRootFolder "Contacts"

This fails with a

Unable to open PST file '\Server1\Share\Scripts and Commands\Contacts.pst'. Error details: Access to the path is denied

If we move the files to the mail servers local drive we can call it just fine. The weird part is this command which is using a Import-csv to the exact same server location has no issues:

foreach ($i in (Import-Csv "\\Server1\Share\Scripts and Commands\AutoContacts.txt"))  { Search-Mailbox -Identity $i.alias  -SearchQuery 'kind:contacts AND subject:" - CompanyName"' -DeleteContent }

I have verified permissions are correct and even tried adding the user I am running the Exchange PowerShell commands with explicitly to the share but still access denied. For testing we tried this also:

Get-ChiltItem "\\Server1\Share\Scripts and Commands"

It returns the directory list correctly. We have tried shortening the name and removing the quotes and that didn't matter. I even threw a hail Mary and gave the user Everyone read only permission and still nothing. Any ideas why the FilePath command doesn't work but both the Get-ChileItem and Import-Csv do? Worst case part of the script will be to copy the file locally, use it, then delete it, but I'm hoping there can be a better answer.

1

This is definitely a permission issue.

When you run Import-Csv, this is performed by your PowerShell, running as your user account; when instead you ask Exchange to run an asynchronous job (such as a MailboxImportRequest), the job is performed by Exchange, not by you; as per https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/new-mailboximportrequest:

In on-premises Exchange, you need to grant the following permission to the group Exchange Trusted Subsystem to the network share where you want to export or import PST files:

To import PST files from the share: Read permission

To save exported PST files to the share: Read/Write permission.

If you don't grant this permission, you will receive an error message stating that Exchange is unable to establish a connection to the PST file on the network share.

3
  • 1
    The worst part of this is we already have a folder on our file server called "PSTExports" that we use just for that and after reading your reply I checked the permissions. Sure enough Exchange Trusted Subsystem has modify rights. Thank-you, I haven't even checked it yet but I'm sure that's the answer.
    – Allan
    Feb 27 '20 at 21:19
  • Thanks for your sharing :)
    – Joy Zhang
    Feb 28 '20 at 8:05
  • FYI - Adding the user to the file/directory permissions was not enough. I had to add the Exchange Trusted Subsystem user access to the share permissions also (we have ours set to only domain users by default).
    – Allan
    Mar 5 '20 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.