CODEWITHSUNDEEP
c#active-directoryexchange-server
m_collard
m_collard

Reputation: 2018

Active Directory Shared Mailbox user permissions

I need to write a C# app that queries Active Directory and returns a list of users that have permission to use a certain Shared Mailbox.

I've spoken to our Support department and they say that each Shared Mailbox has an associated Security Group. And to grant a user access to a Shared Mailbox, they make the user a member of the associated Security Group.

My question is what is the link between a Shared Mailbox and a Security Group in AD? How can I work out which Security Group is associated to which Shared Mailbox?

Upvotes: 3

Views: 2984

Answers (2)

englebart
englebart

Reputation: 573

I had a similar requirement. The AD field on the mailbox account that I ended up using was publicDelegates:

mailboxDirectoryEntry.publicDelegates

This contains a list of distinguishedNames of userids or groups that have been granted access via Outlook delegation capabilities.

For this specific question, you could then list the members of the group(s) you obtain from publicDelegates.

Transitive membership can be obtained with the

member:1.2.840.113556.1.4.1941:=

selector on your query. (Very handy if your organization uses nested groups)

Upvotes: 0

Glen Scales
Glen Scales

Reputation: 22032

You can use the msExchMailboxSecurityDescriptor attribute of the Shared Mailbox object in Active Directory which will give you the DACL of the Mailbox. eg How to read msExchMailboxSecurityDescriptor attribute in C#

How can I work out which Security Group is associated to which Shared Mailbox?

There is no direct way other then enumerated each DACL on each Shared Mailbox. Autodiscover will return all the Mailboxes a particular user has access to if the are automapped via the AlternativeMailbox element https://msdn.microsoft.com/en-us/library/ee237925(v=EXCHG.80).aspx.

Cheers Glen

Edit See the Full assembly names you should be able to work the rest out yourself

                byte[] DaclByte = (Byte[])DirectoryEntry.Properties["msExchMailBoxSecurityDescriptor"][0];
                System.DirectoryServices.ActiveDirectorySecurity adDACL = new ActiveDirectorySecurity();
                adDACL.SetSecurityDescriptorBinaryForm(DaclByte);

                System.Security.AccessControl.AuthorizationRuleCollection aclCollection = adDACL.GetAccessRules(true, false, typeof(System.Security.Principal.SecurityIdentifier));
                foreach (System.Security.AccessControl.AuthorizationRule ace in aclCollection)
                {

Upvotes: 1

Related Questions