Reverse msExchMailboxSecurityDescriptor Permissions Audit script

There are a few places where you can assign mailbox rights with Exchange 2x one of these is from Active Directory User and Computer via the Mailbox rights tab which manipulates the msExchMailboxSecurityDescriptor active directory attribute. You can display who has access to a mailbox using a script which reads this attribute and there is a good sample of doing this here .

But if you want to go the other way by displaying what mailboxes a particular User account has access to this can be a little more challenging. Essentially you need to enumerate the msExchMailboxSecurityDescriptor of every account in your domain and then relate this data. Fortunately this is where ADO Data shaping comes in real handy I’ve used data shaping before here . Data shaping allows you to build hierarchal data structures which in this case allows you to build a structure where the ACE objects (Trustees) on each mailbox relates to the User Account in Active Directory.

So to put this together in a script you have something that selects all the mailboxes in a domain using a LDAP query and then enumerates the ACE's on each mailbox one at time. It then populates two disconnected record-sets and then shapes these together by relating the trustee names to the user account name (using domain\username format)

This script only checks for ACE’s that have been explicitly set on the mailbox it. It will ignore the self permission and also any ACE's that are inherited from the mail store. This narrows the output of the script so it only shows which mailbox a user has been explicitly granted access to from AD Users and Computers. It’s very possible that you may have no mailboxes that meet these criteria so in this case the script would not output anything. If you have a large number of mailboxes this script can take a while to run because its essentially doing a query on every mailbox in your domain.

What’s it good for ? Mostly auditing it gives you another view of the data eg you can see that fred bloggs has access to the following mailbox instead of looking at it form the other perspective of checking each mailboxes ACL. This can help you see permission changes that might have flown under the Radar. What it doesn’t do is look at MAPI permissions so where mailboxes or folders have been delegated using Outlook for this you would need to logon to every mailbox using something like CDO to grab all these rights. While this is possible to do it can be complicated in a large environment I might look at doing this a bit later so you can look for example from a user perspective what calendars a user has been delegated rights to.

I put a downloadable copy of the script here the code looks like

Const RIGHT_DS_DELETE = &H10000
Const RIGHT_DS_READ = &H20000
Const RIGHT_DS_CHANGE = &H40000
Const RIGHT_DS_TAKE_OWNERSHIP = &H80000
Const RIGHT_DS_MAILBOX_OWNER = &H1
Const RIGHT_DS_SEND_AS = &H2
Const RIGHT_DS_PRIMARY_OWNER = &H4

Set objSystemInfo = CreateObject("ADSystemInfo")
strdname = objSystemInfo.DomainShortName
set conn1 = createobject("ADODB.Connection")
strConnString = "Data Provider=NONE; Provider=MSDataShape"
conn1.Open strConnString
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
Query = "<LDAP://" & strNameingContext & ">;(&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))
))));samaccountname,displayname,distinguishedName;subtree"
Com.ActiveConnection = Conn
Com.CommandText = Query
Com.Properties("Page Size") = 1000
set objParentRS = createobject("adodb.recordset")
set objChildRS = createobject("adodb.recordset")
strSQL = "SHAPE APPEND" & _
" NEW adVarChar(255) AS UOADDisplayName, " & _
" NEW adVarChar(255) AS UOADTrusteeName, " & _
" ((SHAPE APPEND " & _
" NEW adVarChar(255) AS MRmbox, " & _
" NEW adVarChar(255) AS MRTrusteeName, " & _
" NEW adVarChar(255) AS MRRights, " & _
" NEW adVarChar(255) AS MRAceflags) " & _
" RELATE UOADTrusteeName TO MRTrusteeName) AS rsUOMR"
objParentRS.LockType = 3
objParentRS.Open strSQL, conn1

Set Rs = Com.Execute
While Not Rs.EOF
dn = "LDAP://" & replace(rs.Fields("distinguishedName").Value,"/","\/")
set objuser = getobject(dn)
Set oSecurityDescriptor = objuser.Get("msExchMailboxSecurityDescriptor")
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
objParentRS.addnew
objParentRS("UOADDisplayName") = rs.fields("displayname")
objParentRS("UOADTrusteeName") = strdname & "\" & rs.fields("samaccountname")
objParentRS.update
Set objChildRS = objParentRS("rsUOMR").Value
For Each ace In dacl
if ace.AceFlags <> 18 then
if ace.Trustee <> "NT AUTHORITY\SELF" then
objChildRS.addnew
objChildRS("MRmbox") = rs.fields("displayname")
objChildRS("MRTrusteeName") = ace.Trustee
objChildRS("MRRights") = ace.AccessMask
objChildRS("MRAceflags") = ace.AceFlags
objChildRS.update
end if
end if
Next
rs.movenext
Wend
wscript.echo "Number of Mailboxes Checked " & objParentRS.recordcount
Wscript.echo
objParentRS.MoveFirst
Do While Not objParentRS.EOF
Set objChildRS = objParentRS("rsUOMR").Value
if objChildRS.recordcount <> 0 then wscript.echo objParentRS("UOADDisplayName")
Do While Not objChildRS.EOF
wscript.echo " " & objChildRS.fields("MRmbox")
If (objChildRS.fields("MRRights") And RIGHT_DS_SEND_AS) Then
wscript.echo " -send mail as"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_CHANGE) Then
wscript.echo " -modify user attributes"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_DELETE) Then
wscript.echo " -delete mailbox store"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_READ) Then
wscript.echo " -read permissions"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_TAKE_OWNERSHIP) Then
wscript.echo " -take ownership of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_MAILBOX_OWNER) Then
wscript.echo " -is mailbox owner of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_PRIMARY_OWNER) Then
wscript.echo " -is mailbox Primary owner of this object"
End If
objChildRS.movenext
loop
objParentRS.MoveNext
loop