Hi all,
the following group builtin\administrators has send as permission on nearly 100 user mailboxes in my org.
i would like to revoke this
i ran the following command to view the existing delegation permissions on the mailbox
[PS] C:\Windows\system32>Get-Mailbox samir0884 | Get-ADPermission | Where-Object { ($_.ExtendedRights -like “*send-as*”) -and -not ($_.User -like“nt authorityself”) }
Identity User Deny Inherited
-------- ---- ---- ---------
ho.ae.enoc.com/DU... BUILTIN\Administr... False False
ho.ae.enoc.com/DU... S-1-5-32-548 False False
ho.ae.enoc.com/DU... ENOCHO\sayed1157 False False
ho.ae.enoc.com/DU... ENOCHO\samir0884 False False
To Revoke the sendas permission for builtin\administrators i ran the below command
[PS] C:\Windows\system32>Remove-MailboxPermission -Identity samir0884 -User builtin\administrators -AccessRights sendas -InheritanceType all
Confirm
Are you sure you want to perform this action?
Removing mailbox permission "samir0884" for user "builtin\administrators" with access rights "'SendAs'".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
WARNING: Can't remove the access control entry on the object "CN=DADA\, Mr. SAMIR SHIRAZ,OU=09 I&E
Maint.,OU=DUGAS,DC=ho,DC=ae,DC=enoc,DC=com" for account "BUILTIN\Administrators" because the ACE doesn't exist on the
object.
[PS] C:\Windows\system32>Remove-MailboxPermission -Identity samir0884 -User builtin\administrators -AccessRights sendas
-InheritanceType all -Deny:$True
Confirm
Are you sure you want to perform this action?
Removing mailbox permission "samir0884" for user "builtin\administrators" with access rights "'SendAs'".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
WARNING: Can't remove the access control entry on the object "CN=DADA\, Mr. SAMIR SHIRAZ,OU=09 I&E
Maint.,OU=DUGAS,DC=ho,DC=ae,DC=enoc,DC=com" for account "BUILTIN\Administrators" because the ACE doesn't exist on the
object.
[PS] C:\Windows\system32>Remove-MailboxPermission -Identity samir0884 -User builtin\administrators -AccessRights sendas
-InheritanceType all -Deny:$false
Confirm
Are you sure you want to perform this action?
Removing mailbox permission "samir0884" for user "builtin\administrators" with access rights "'SendAs'".
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y
WARNING: Can't remove the access control entry on the object "CN=DADA\, Mr. SAMIR SHIRAZ,OU=09 I&E
Maint.,OU=DUGAS,DC=ho,DC=ae,DC=enoc,DC=com" for account "BUILTIN\Administrators" because the ACE doesn't exist on the object.
I'm getting the samer error "ACE does not exist" despite adding -Deny$true and -Deny$false switch
I tried finding the send as permission attribute on ADSIEDIT - cannot find this attribute
I also tried to open the EAC and check delegation feature for the mailbox = Page shows me error while trying to open this object
this happens for all the users which have builtin\administrators delegation as -sendas
Please advise who to remove this sendas permission for builtin\administrators group on 100 mailboxes that i have.
tfernandes