asked on

Remove-MailboxFolderPermission not working

User gone and disabled. But still shows up in:
Get-MailboxFolderPermission -Identity user@user.com:\calendar
RunspaceId : f88acd62-6876-4345-ae18-87e1c7346861
FolderName : Calendar
User : NT User:DOMAIN\user
AccessRights : {Editor}
Identity : NT User:DOMAIN\user
IsValid : True

How can I completely remove it? I tried:
Remove-MailboxFolderPermission -Identity user@domain.com:\calendar -User user@domain.com
Gives me error:

The user "user@domain.com" is either not valid SMTP address, or there is no matching information.
+ CategoryInfo : NotSpecified: (0:Int32) [Remove-MailboxFolderPermission], InvalidExternalUserIdException
+ FullyQualifiedErrorId : FF534F1B,Microsoft.Exchange.Management.StoreTasks.RemoveMailboxFolderPermission

Should I ignore it since the user is gone and disabled in AD anyways?

Roy Bene

Have you tried removing from EMC? If so, same error?

Likely, if you deleted the user through ADUC and not in Exchange (I usually disable mailboxes first and let it mark the user for deletion), then you will likely have to use ADSIEDIT to remove the attribute.

-Roy

tiras gans

ASKER

EMC only shows full Mailbox permissions. That user is not listed there.
It was only given permissions to the Calendar.

Dejan Vasiljevic

Hi Tiras25,

Which Exchange are You using?

Thanks,
D.

tiras gans

ASKER

2010. Sorry forgot to mention that.

Roy Bene

Check to ensure the user is not assigned as a delegate with 'send on behalf' permissions. This will gum things up. If not, you will need to use ADSIEDIT to remove the attribute.

Dejan Vasiljevic

Ok, so the commands are -

Remove-MailboxFolderPermission <mailbox>:\Calendar –User <Mailbox-that-will-be-removed-from-Calendar-Permissions>

So this would look like - Remove-MailboxFolderPermission –identity John.Smith:calendar –user Tom.Smith

So without @domain i think. You will need to type in name, in format that is defined on server.

Thanks,
D.

VB ITS

Grant yourself Owner access to the Calendar and then remove the disabled user through Outlook, much easier from a management perspective.

tiras gans

ASKER

[PS] C:\>Remove-MailboxFolderPermission mailbox:\Calendar -User name
Same thing:
Confirm
Are you sure you want to perform this action?
Removing mailbox folder permission on "mailbox:\Calendar" for user "first last".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
There is no existing permission entry found for user: first last.
+ CategoryInfo : NotSpecified: (0:Int32) [Remove-MailboxFolderPermission], Use
xception
+ FullyQualifiedErrorId : FC30BDD4,Microsoft.Exchange.Management.StoreTasks.RemoveMailb

Roy Bene

Once again ...

You will need to use ADSIEDIT to remove the attribute. Can you safely ignore it? Yes. If the user is gone and there are no traces of the user in AD, then it will not cause you issues.

Dejan Vasiljevic

I would do the same thing as VB_ITS said,

Would log in as admin/owner and go to Nav. pane, click Calendar, go to Proporties, Permissions, check user and remove it. Easy... Right.

tiras gans

ASKER

Hmm, not really that easy. Need to know users logins, or have a user near by. Need to fire up another Outlook.
I still wonder why the EMS doesn't work. Always removes no problems until now...

Satya Pathak

try below KB it might be help you

https://www.experts-exchange.com/questions/27373981/Remove-permisions-to-a-calaendar.html

Dejan Vasiljevic

It may sound stupid but are You using powershell in ELEVATED mode / run as ADMIN. If that is right, I guess You should be able to just type - Remove-MailboxFolderPermission -Identity dejan@homtail.com:\calendar -User quest-tiras@ee.com

Thanks,
D.

tiras gans

ASKER

Yes, Elevated doesn't help much. Same error.

Roy Bene

The issue here is that there is no SID in AD for Exchange to reference. There will be a username in Exchange, but, when referenced against AD, it will not see the user, so it will not see a permission entry for that user, hence none will be displayed. Therefore, none of these methods will work. Unless you reanimate the tombstoned user (https://technet.microsoft.com/en-us/magazine/2007.09.tombstones.aspx) and/or restore it from the Active Directory Recycle Bin (need to be on at least a 2008 domain infrastructure level) you are going to beat your head against a wall trying to do this.

The other option is ADSIEDIT.

tiras gans

ASKER

The username is still in AD and Exchange mailbox exist. Just disabled in AD. So there is a SID if the username still there. Its not removed or deleted. Just disabled.

VB ITS

Hmm, not really that easy. Need to know users logins, or have a user near by. Need to fire up another Outlook.

Not necessarily.

- Grant your admin account full access to the mailbox through EMC/EMS
- Access the account through OWA using this URL: https://owa.company.com/owa/user@company.com
- Enter your admin account credentials if prompted (since we've granted it Full Access)
- Click on Calendar in the navigation pane
- Click on Share towards the top then Change Sharing Permissions...

- You should then be able to see the list of users who has access to the calendar. Highlight the unwanted entry and delete it

Just make sure you're using the OWA premium as opposed to OWA light. You'll need to use IE to do this.

ASKER CERTIFIED SOLUTION

VB ITS

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Roy Bene

Ah ok. The first line in your original post stated 'user gone and disabled'. I took that to mean deleted. Apologies for the misunderstanding.

In that case, I agree with VB_ITS as well.

tiras gans

ASKER

VB, yes just tried and it worked. Weird! I can swear to tried with other disabled users and it worked before. Not sure how is it different now.

Dejan Vasiljevic

Right, as I said, his way is easier...

Well, well done.

Roy Bene

Well done indeed!

tiras gans

ASKER

Yeah. Just hate when its still weird and unexplained. Should work with disabled account as well.

Dejan Vasiljevic

I remember that I had similar but not same problem with Exchange 2010, but I've migrated from 2007 to 2010, and after that it started...

Roy Bene

I agree. However, if the user is a delegate with 'send on behalf' permissions, I have seen that cause issues in the past.

VB ITS

Alright, I can confirm that with a disabled account I wasn't able to add, set, or remove calendar permissions using EMS.
Here's the command I tried:

Add-MailboxFolderPermission -Identity user@company.com:\Calendar -User "Disabled User" -AccessRights Editor

Open in new window

Here's the error I received:

The user "Disabled User" was found in Active Directory but isn't valid to use for permissions. Try an SMTP address instead.
+ CategoryInfo : NotSpecified: (0:Int32) [Add-MailboxFolderPermission], InvalidInternalUserIdException
+ FullyQualifiedErrorId : 27431183,Microsoft.Exchange.Management.StoreTasks.AddMailboxFolderPermission

tiras gans

ASKER

I see. I'll wait till I migrate to 2013 then :)

Roy Bene

VB, were you also not able to remove from Outlook with the user account disabled?

Dejan Vasiljevic

I think he is able to remove it from Outlook.

And I've migrated to 2013 / No console, and etc. Had a rough time with 1st time.

Roy Bene

Ah, I see. Thanks, Dejan.

Great catch VB!

tiras gans

ASKER

Thanks Roy!

Dejan Vasiljevic

Thanks guys.
And in reply to VB's last comment there is a link, with similar explanation which might help others with same or similar problem to understand it - link

Thanks to all once again.

Roy Bene

Yessir. Thank you!

Roy Bene

Tiras,

You're very welcome!