I have a task to audit who can access 3 of our team mailboxes, regardless of how the ex admin/mb owner set their permissions. I am concerned just how many ways there seem to be to share a mailbox. 1) Are the permissions set via tools >options>delegates the same as those permissions listed if you right click the root of the mailbox, >properties>permissions? Or are these 2 different ways. 2) If they are different what is the technical name of those permissions set via root of the mailbox, >properties>permissions called so I can research further 3) Am I right in thinking you can set permissions via 3 ways - active directory, delegates, or the right click method? If so if you set them in all 3 places for the same user/group, which takes effect, as surely they can conflict? Is there any free way to identify permissions set via all 3 ways?

One will give you send on behalf permission, i.e via the delegate options. The other is more granular and just gives permissions.Just folder permissionsSeems like you're referring to Exch 2003, pretty much that how you would normally do it, you can set on the DB level like you do for applications like BES but that's quite rare for an admin to do this. AD method gove you full mailbox rights, the other 2 can give you granual rights, one also giving you send on behalf permission. To identify these permission, you will have to either write a script or look for one on the internet. You can also dump the permissions using PDDavAdmin.Sukh

One will give you send on behalf permission, i.e via the delegate options. The other is more granular and just gives permissions.Just folder permissionsSeems like you're referring to Exch 2003, pretty much that how you would normally do it, you can set on the DB level like you do for applications like BES but that's quite rare for an admin to do this. AD method gove you full mailbox rights, the other 2 can give you granual rights, one also giving you send on behalf permission. To identify these permission, you will have to either write a script or look for one on the internet. You can also dump the permissions using PDDavAdmin.Sukh

Hello cf090, I think there are two ways: <1> Access with folder permission. This way you can grant permission under delegate or folder permission. <2> Access with mailbox permission. This way user can access the shared mailbox by giving users full access permission on mailbox. So this way (tools>options>delegates) you granted the permission is the same as you grant permission under folder permission (Properties>permission) The way you right click the root of the mailbox, >properties>permissions is to grant permissions on Outlook Today. When there is conflict on folder permission and mailbox permission, permission set on mailbox will work. For example: In mailbox user2, all folders you have sat None permission for user1, but when user1 have full access permission on user2, it also can access all the folders in mailbox user2. To check permission on mailbox you can use get-mailboxpermission. To check the permission sat on folders, you can use get-mailboxfolderpermission, or PFavadmin\Exfolders (for Exchange 2010). Here is related documents for you: Get-MailboxPermission http://technet.microsoft.com/en-us/library/aa998218.aspx Get-MailboxFolderPermission http://technet.microsoft.com/en-us/library/dd335061.aspx Thanks, Evan Evan Liu TechNet Community Support

Hello cf090, I think there are two ways: <1> Access with folder permission. This way you can grant permission under delegate or folder permission. <2> Access with mailbox permission. This way user can access the shared mailbox by giving users full access permission on mailbox. So this way (tools>options>delegates) you granted the permission is the same as you grant permission under folder permission (Properties>permission) The way you right click the root of the mailbox, >properties>permissions is to grant permissions on Outlook Today. When there is conflict on folder permission and mailbox permission, permission set on mailbox will work. For example: In mailbox user2, all folders you have sat None permission for user1, but when user1 have full access permission on user2, it also can access all the folders in mailbox user2. To check permission on mailbox you can use get-mailboxpermission. To check the permission sat on folders, you can use get-mailboxfolderpermission, or PFavadmin\Exfolders (for Exchange 2010). Here is related documents for you: Get-MailboxPermission http://technet.microsoft.com/en-us/library/aa998218.aspx Get-MailboxFolderPermission http://technet.microsoft.com/en-us/library/dd335061.aspx Thanks, Evan Evan Liu TechNet Community Support One goves you send on behalf and the other doesnt.Sukh

Hello cf090, I think there are two ways: <1> Access with folder permission. This way you can grant permission under delegate or folder permission. <2> Access with mailbox permission. This way user can access the shared mailbox by giving users full access permission on mailbox. So this way (tools>options>delegates) you granted the permission is the same as you grant permission under folder permission (Properties>permission) The way you right click the root of the mailbox, >properties>permissions is to grant permissions on Outlook Today. When there is conflict on folder permission and mailbox permission, permission set on mailbox will work. For example: In mailbox user2, all folders you have sat None permission for user1, but when user1 have full access permission on user2, it also can access all the folders in mailbox user2. To check permission on mailbox you can use get-mailboxpermission. To check the permission sat on folders, you can use get-mailboxfolderpermission, or PFavadmin\Exfolders (for Exchange 2010). Here is related documents for you: Get-MailboxPermission http://technet.microsoft.com/en-us/library/aa998218.aspx Get-MailboxFolderPermission http://technet.microsoft.com/en-us/library/dd335061.aspx Thanks, Evan Evan Liu TechNet Community Support One goves you send on behalf and the other doesnt.Sukh