Exchange Server Cookbook

5.23. Granting Users or Groups Permission to Access Other Mailboxes

Problem

You have a mailbox and need to allow either an additional user or a group of users to access information within it. This mailbox could either be a normal user mailbox or a resource mailbox, used to book a resource such as a conference room, audio/video equipment, or a company car.

Solution

Using a graphical user interface

1. Log on to any machine in your domain that has the Exchange management tools installed.

2. Open the ADUC snap-in (Users and Computers.msc).

3. Browse to the container that holds the target user account.

4. Ensure that the Advanced View is selected on the View menu.

5. Right-click the user account whose mailbox you want others to be able to access and click Properties.

6. Select the Exchange Advanced tab and click Mailbox Rights.

7. Click Add and select the users and groups you wish to have permissions to the mailbox. Click OK.

8. In the Allow column of the Permissions list, make sure Full mailbox access is checked. Click OK.

9. Click OK.

Discussion

The link between an AD user object and the actual mailbox in the Exchange message store is contained in two places: the security descriptor property on the actual mailbox database and the msExchMailboxSecurityDescriptor property in AD. The msExchMailboxSecurityDescriptor property is added to the AD user object by the Exchange schema updates; it holds a partial copy of the security descriptor on the actual mailbox. Modifying the AD property directly will not change the descriptor ...