Show all users with Full Mailbox Permissions

When you use the Get-MailboxPermission cmdlet or Manage Full Access Permission in the Exchange Management Console you can view the users and groups who have Full permissions over a mailbox in Exchange.

However, if a group is assigned access you may struggle to quickly see who has access. If we look at an example mailbox, we’ll see Test Group has been assigned access:

Image

However when we examine the group we might find that the members are still not easily apparent if it contains another group as a member, otherwise known as Nested Groups:

 Image

These layers of abstraction can be untangled with the following script that recursively lists all users who have Full Access permissions whether or not they are assigned membership by group or nested group:

# Helper function to get group members recursivelyparam($Mailbox)
function Get-GroupMembersRecursive
{
    param($Group)
    [array]$Members = @()
    $Group = Get-Group $Group -ErrorAction SilentlyContinue
    if (!$Group)
    {
        throw "Group not found"
    }
    foreach ($Member in $Group.Members)
    {
        if (Get-Group $Member -ErrorAction SilentlyContinue)
        {
            $Members += Get-GroupMembersRecursive -Group $Member
        } else {
            $Members += ((get-user $Member.Name).UserPrincipalName)
        }
    }
    $Members = $Members | Select -Unique
    return $Members
}
 
# Mailbox Full Access Permissions
[array]$Result = Get-MailboxPermission $Mailbox | where { ($_.AccessRights -like "*FullAccess*") -and ($_.IsInherited -eq $false) -and -not ($_.User -like "NT AUTHORITY\SELF") } | Select User
[array]$AccessUsers=@()
$Members = @()
foreach ($Item in $Result)
{
    $User = Get-User $Item.User.ToString() -ErrorAction SilentlyContinue
    if (!$User)
    {
        $Members += Get-GroupMembersRecursive $Item.User.ToString();
    } else {
        $Members += $User.UserPrincipalName
    }
}
 
$Members

 

To use this script, copy and paste into a new PS1 file and execute as shown below:

 Image

About The Author

1 thought on “Show all users with Full Mailbox Permissions”

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top