Mailbox related Attributes:
-setmailboxrights
Set msExchMailboxSecurityDescriptor (Q324353)
-fixsendas Grant Send-As rights to users with Full Mailbox Access and Read.
-removefixsendas
Remove Send-As rights from users with Full Mailbox Access and Read.
(Undo for -fixsendas)
-grantselfaea
Grant Associated External Account privileges to SELF (Q278966)
-removeaeafromself
Remove Associated External Account from SELF. (Undo for Q278966)
-grantselffullandread
Grant Full Mailbox Access and Read to SELF. (Q304935)
-removefullandread
Remove Full Mailbox Access and Read from SELF. (Undo for Q304935)
-dumpmailboxrights
Dump all permissions in Mailbox Rights to a file called mbxrights.xml.
-importmailboxrights overwrite|append
Import mailbox rights from the mbxrights.xml created by -dumpmailboxrights
When using this switch, the -dn switch is not required.
Overwrite will remove all non-inherited ACE’s before importing,
append will not. This switch only imports non-inherited mailbox rights.
-addtomailboxrights DOMAIN\USER ACCESS_MASK -deny (Optional)
Add an account to mailbox rights with the specified permissions masks.
The optional -deny switch specfies a deny entry, default is an allow entry.
Valid Access Masks:
ACE_MB_FULL_ACCESS
ACE_MB_DELETE_MB_STORAGE
ACE_MB_READ_PERMISSIONS
ACE_MB_CHANGE_PERMISSION
ACE_MB_TAKE_OWNERSHIP
-removefrommailboxrights DOMAIN\USER ACCESS_MASK -deny (optional)
Remove the specified mask from DOMAIN\USER in mailbox rights.
The -deny switch specifies a deny entry, default is an allow entry.
Valid Access Masks:
ACE_MB_FULL_ACCESS
ACE_MB_DELETE_MB_STORAGE
ACE_MB_READ_PERMISSIONS
ACE_MB_CHANGE_PERMISSION
ACE_MB_TAKE_OWNERSHIP
ALL
The ALL Mask will remove all permissions for the specified user.
“Learning music by reading about it is like making love by mail” ~ Luciano Pavarotti
ADmodcmd - Active Directory Bulk Modify Tool.
How Terminal Services Works - docs.microsoft.com
Terminal Server Attributes ➞ Exchange Related Attributes ➞ User Account Settings ➞ Custom Attributes