Exchnage Server 2010 信箱權限設定

Grant permissions on a single mailbox
Use the following command to grant access to just one mailbox for a single user:Add-MailboxPermission -Identity “” -User -AccessRights Fullaccess -InheritanceType all
Example:Add-MailboxPermission -Identity “Test” -User Administrator -AccessRights Fullaccess -InheritanceType all



Grant permissions on all mailboxes
Use the following command to grant access to all mailboxes for a single user:Get-Mailbox | Add-MailboxPermission -User -AccessRights Fullaccess -InheritanceType all
Example:Get-Mailbox | Add-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all
Note: In the screenshot below I received a message saying that Administrator already have access to the mailbox Test (Yellow text message).



Grant permissions on mailboxes using Where
We might as well add a where to the command while we are at it. With this command we grant access to all mailboxes in a specific OU for a single user:
Get-Mailbox | Where { $_.OrganizationalUnit –eq “” } | Add-MailboxPermission -User -AccessRights Fullaccess -InheritanceType all
Example:Get-Mailbox | Where { $_.OrganizationalUnit –eq “sundis.local/Test/Users” } | Add-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all



Remove permissions on a single mailbox
Quite simple, just change Add to Remove:Remove-MailboxPermission -Identity “” -User -AccessRights Fullaccess -InheritanceType all
Example:Remove-MailboxPermission -Identity ”Test” -User Administrator -AccessRights Fullaccess -InheritanceType all



Remove permissions on all mailboxes
Well you have probably figured this one out already, but I will show it to you anyway:Get-Mailbox | Remove-MailboxPermission -User -AccessRights Fullaccess -InheritanceType all
Example:Get-Mailbox | Remove-MailboxPermission -User Administrator -AccessRights Fullaccess -InheritanceType all
Note: As you can se below, using this command will remove the users full access to its own mailbox. That is not good, this command should be used with care…

As a final note: These commands only affects excisting mailboxes. The permissions will not be automatically applied to new mailboxes. To achieve this you can run the command as a scheduled script on a regular basis, once every night for example.

查看用戶信箱大小的指令(Exchange Server 2010)

假設 Exchange Server 2010 Server Name = ex01

請在 ex01 伺服器上(Exchange Management shell)以下指令來查看，輸出檔案為 USER.CSV

Get-MailboxStatistics -server "ex01" Select DisplayName, LastLoggedOnUserAccount, ItemCount, TotalItemSize, LastLogonTime, LastLogoffTime Export-CSV USER.csv -encoding "unicode"

Exchange Server 2010 Push Mail 無法使用

在 Exchange Server 2010 的架構下，只要是屬於 Domain Admins & Enterprise Admins 的成員，該帳號繼承選項在一小時內都會被清掉，導致 Push Mail 無法使用，這是 Exchange 2010 安全性的設計。




建議將用戶帳號與系統管理帳號分開使用，盡量避免將一般使用者帳號加到
Domain Admins & Enterprise Admins 的群組中

參考資訊:
http://support.microsoft.com/kb/907434/en-us

Outlook 2003 存取 Exchange Server 2010

當使用 Outlook 2003 存取 Exchange Server 2010 時，Outlook 2003 嘗試開啟已授權其他用戶信箱，會出現錯誤訊息


解決方法請在 Exchange Server 2010 輸入以下指令:

$a = Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true}

$a | Set-ThrottlingPolicy –RCAMaxConcurrency:$null

在 Exchange Server 2007 環境中，使用 Outlook Express 寄信時，收件者有包含自己時，讀取回條會收到兩條

測試結果:
我發現只要是走 POP3 (不管是 Outlook 還是 Outlook Express) 都會這樣, 底下是官方的資訊

http://technet.microsoft.com/en-us/library/cc296568(EXCHG.80).aspx
看起來這是 Product Design, 文章裡面提到, 要避免這種現象請使用 OWA 或是 Outlook MAPI

Exchange Server 2010 開放使用者維護 DL 成員

在 Exchange Server 2010 SP1 架構中，要讓各部門助理自行維護 DL 成員，權限都設定了，但時還是會出現權限不足，無法運作，一樣的設定，在 Exchange 2003 是可以運作的 !

在 Exchange 2003 架構中只要做這個設定就可以運作了，但是在 Exchange 2010 就無法運作了。

解決方法:
Exchange 2010 對於 Distribution Group 權限委派方式與 Exchange 2003 有所不同，必須額外執行以下指令使其生效

New-ManagementRoleAssignment -Role MyDistributionGroups -Policy "Default Role Assignment Policy"

Allowing End-Users to Manage Distribution Group Membership in Exchange 2010
http://sysadmin-talk.org/2010/06/omg-allowing-end-users-to-manage-distribution-group-membership-in-exchange-2010-2/

Exchange Server 2010 SP1 OWA 重複驗證

最近發現 Exchange Server 2010 OWA 在讀取信件時，會發生重複要求輸入帳號密碼問題，如下圖所示:

找問題找了很久，最後發現用戶端的 DNS 是指到一台網路設備，再透過轉寄站轉到 AD DNS，因此使用者在 Exchange 2010 OWA 讀取信件時，經過 DNS 轉送至 AD DNS 時，會產生一個新的 Session， 導致一再要求使用者輸入帳號密碼畫面。

最後把用戶端 DNS 直接只到 AD DNS 就可以解決囉。