Solved

check to see if domain admins have receive as permission

Posted on 2012-04-10
5
478 Views
Last Modified: 2012-05-12
Hi all,

I am trying to find out if domain admins have the receive-as permission by running the following command:
get-mailboxdatabase |get-adpermission -user "domain admins"

I get the following error:
There are multiple users/groups matching the identity domain admins".  plase specify a unique value.

Am I doing something incorrectly?

I have an Exchange 2007 SP3
0
Comment
Question by:annayeg
  • 4
5 Comments
 
LVL 37

Expert Comment

by:Neil Russell
ID: 37830036
Your trying to get the ad permissions on a group, you can NOT do that. Only one user at a time as it explains.

You can use something like....

Get-Mailbox -Server “ESS-Exch702¿ - database "DBName" | Get-ADPermission | where { ($_.ExtendedRights -like “*Send-As*”) -and ($_.IsInherited -eq $false) -and -not ($_.User -like “NT AUTHORITY\SELF”) } | ft -wrap
0
 
LVL 1

Author Comment

by:annayeg
ID: 37830266
When I run the get-adpermission on a user, my domain admins have genericALL rights on all the users.  Is it in adpermission that you allow or deny mailboxpermissions?

Sorry, I am all over the map.   Basically, I am trying to find out what kind of permissions do domain admins have so I can remove the full mailbox permsisions.   So far, I am seeing Accessrights GenericAll.  If I remove the Accessright GenericAll would that remove their permissions from accessing all the mailboxes?

Thanks
0
 
LVL 1

Author Comment

by:annayeg
ID: 37856968
i am trying to test it with one mailbox but I still get the "there are multiple users/groups matching the identity "domain admins.  Please specify a unique value"


get-mailbox -identity  latrain |remove-adpermission  -user "domain admins" -accessrights genericall

Any suggestion how I can accomplish this?
Thanks
0
 
LVL 1

Accepted Solution

by:
annayeg earned 0 total points
ID: 37939548
get-mailbox - database "servername\databasename" |add-mailboxpermission -user "distinguished name of the domain admins" -denyu -accessrights -fullaccess

This did the trick.
0
 
LVL 1

Author Closing Comment

by:annayeg
ID: 37960029
This solved my problem.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now