Script sharing: Export recipient permissions
I'd like to share an old script that I polished a bit in the last days. It may be of help for some of you in this forum. Document Exchange mailbox access rights, folder permissions, "send as", "send on behalf" and "managed by". Smoothen your migration to Exchange Online/Microsoft 365 by identifying permission chains that won't work cross-premises. Monitor permission changes over time. Identify permissions granted to recipients that no longer exist Export-RecipientPermissions can help you with all these tasks. Get your free copy at https://github.com/GruberMarkus/Export-RecipientPermissions.
Shared mailbox permissions in hybrid environment
Hello. I manage a hybrid Exchange environment with 2 x Exchange 2016 servers (CU19) on-premise. I ran the HCW some time ago, and had to do lots of things manually that it couldn't do (such as create connectors), but for the most part it seems to work well. I have created some shared mailboxes on-premise and granted access to some users. They appeared in Outlook and all was well. I have now migrated these mailboxes to Exchange Online and while existing users can still access them new users can't. I've delegated permission through the usual way but they can never see the mailbox. Also, I've revoked access for some users but they can still access them. What am I missing, what's not working or not setup right to cause this to happen? Any tips and suggestions welcome. Thanks, Dave
Do Exchange administrators have to be system administrators on Exchange servers?
Hello, I asked this question before on TechNet (https://social.technet.microsoft.com/Forums/de-DE/a48fa3a9-df42-43ca-bc4f-24035853dd64/system-administrator-rights?forum=Exch2016GD). After some confusing mentions of domain admins, the consensus appeared to be that no, Exchange administrators do not have to be system administrators, but nobody knows how it is supposed to work. The problem is that there are several directories on Exchange servers which Exchange admins apparently need to access on a regular basis that the installer nevertheless configured with ACLs with access for sys admins only. Our Exchange team in-house tells me that ACLs on those directories cannot be changed because Microsoft does not support Exchange installations where those ACLs have been changed. Can anybody confirm whether Exchange admins have to be sys admins (and how this squares with RBAC guidelines) or how this is supposed to work? It is apparently not a question that comes up a lot. Are Exchange admins usually sys admins? How do other companies handle this? Are all admins of all applications always sys admins?
