
Chapter 5: Public Folders
149
Another approach is to grant users the rights to create top - level folders. This can be done with
PowerShell or with an Active Directory editing tool, such as ADSI Edit. The command to grant permis-
sions requires the distinguished name (DN) of the public folder configuration object. The DN can be
found in the Configuration partition in Active Directory, and will look similar to the following:
CN=Public folderPublic foldersPublic folders,CN=Folder Hierarchies,CN=Exchange
Administrative Group
(FYDIBOHF23SPDLT),CN=Administrative Groups,CN= < company > ,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC= < company > ,DC=com
The cmdlet to change top - level permissions is Add-ADPermission :
Add-ADPermission -Identity < ADRawEntryIdParameter > -User
< SecurityPrincipalIdParameter > [-AccessRights < ActiveDirectoryRights[] > ]
[-ChildObjectTypes < ADSchemaObjectIdParameter[] > ] [-Deny < SwitchParameter > ]
[-DomainController < Fqdn > ] [-ExtendedRights < ExtendedRightIdParameter[] > ]
[-InheritanceType < None | All | Descendents | SelfAndChildren | Children > ]
[-InheritedObjectType < ADSchemaObjectIdParameter > ] [-Properties
< ADSchemaObjectIdParameter[] > ][ < CommonParameters > ]
For example:
Add-ADPermission -id “CN=Public folders,CN=Folder Hierarchies,CN=Exchange
Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=contosolab, ...