Changing Folder and Calendar Permissions in Exchange using the EWS Managed API and powershell

While Exchange 2010 provides some really good cmdlets now for setting and changing folder permissions such as Set-MailboxFolderPermission http://technet.microsoft.com/en-us/library/ff522363.aspx . Using EWS to do this can still be useful in circumstances where the cmdlets can't be used or your having problems with localized folder names or you want to take advantage of EWS Impersonation to get around any issues your having with acquiring the correct rights to make the changes you might need.

I'll look at the example of changing the default calendar permissions of the default ACL on the calendar as this is one of the harder things to do and there are a few points that can catch you out.

First point is that when you modify permissions with EWS you basically grab the DACL from the server make your changes locally to the DACL and the post it back in a Update Folder operation. This means the logic you use on the client side needs to be up to dealing with this. The permissions object in the Managed API has a Add and Remove methods and you have the ability to modify am ACE within the permissions collection. The one problem you can have is if the Folder permissions is currently set to custom and you try to use one the default FolderPermissionLevel. You will also have problem if you don't check the current collection and try to add a duplicate ACE into the collection.

A simple way to solve this is to first search the current collection for any existing ACE entries and remove the existing ACE then add the new rights you want set using the Add method. The other issue you need to deal with when setting the calendar folder permission is to also make sure you set the corresponding rights on the FreeBusy Data folder or you may have problems such as explained in http://support.microsoft.com/kb/184151

I've put together two examples both of these use EWS Impersonation which you can configure in 2010 via RBAC http://msdn.microsoft.com/en-us/library/bb204095%28v=EXCHG.140%29.aspx

There are 3 varibles in the script you need to modify

$MailboxName = "user@domain.com"




This is the mailbox you want to make the changes and what will be impersonated

$Permission = [Microsoft.Exchange.WebServices.Data.FolderPermissionLevel]::Editor





This is the rights you want to set

$credentials = New-Object System.Net.NetworkCredential("user@domain.com,"password")


These are the user credentials to use this user must have impersonation rights

I've posted both examples up here

In the first example this shows how to set the Default permissions for the default user on the Calendar to Editor


The second Example shows how to set calendar permission for a particular user to Editor this example looks like

1. $MailboxName = "mailbox@domain.com"  
2.   
 

1. $credentials = New-Object System.Net.NetworkCredential("user@domain.com","Password#")  
2.   
3. $NewACLUser = "newacl@domain.com"  
4.   
5. $dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\1.1\Microsoft.Exchange.WebServices.dll"  
6.   
7. [void][Reflection.Assembly]::LoadFile($dllpath)  
8.  
9. $Permission = [Microsoft.Exchange.WebServices.Data.FolderPermissionLevel]::Editor  
10.  
11. $service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010)  
12. $service.Credentials = $credentials  
13. $service.AutodiscoverUrl($MailboxName,{$true})  
14. $service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $MailboxName);  
15.   
16.   
17. function addFolderPerm($folder){  
18.     $existingperm = $null  
19.     foreach($fperm in $folder.Permissions){  
20.         if($fperm.UserId.StandardUser -eq $null){  
21.             if ($fperm.UserId.PrimarySmtpAddress.ToLower() -eq $NewACLUser.ToLower()){  
22.                 $existingperm = $fperm  
23.             }  
24.         }  
25.     }  
26.     if($existingperm -ne $null){  
27.         $folder.Permissions.Remove($existingperm)  
28.     }   
29.     $newfp = new-object Microsoft.Exchange.WebServices.Data.FolderPermission($NewACLUser,$Permission)  
30.     $folder.Permissions.Add($newfp)  
31.     $folder.Update()  
32. }  
33.   
34. "Checking : " + $MailboxName   
35. $folderidcnt = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Calendar,$MailboxName)  
36. $Calendar = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderidcnt)  
37. "Set Calendar Rights"  
38. addFolderPerm($Calendar)  
39. $sf1 = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,"Freebusy Data")  
40.   
41. $fvFolderView = New-Object Microsoft.Exchange.WebServices.Data.FolderView(1000)  
42. $fvFolderView.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Shallow;  
43.   
44. $folderidRoot = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Root,$MailboxName)  
45. $fiResult = $Service.FindFolders($folderidRoot,$sf1,$fvFolderView)  
46. if($fiResult.Folders.Count -eq 1){  
47.     "Set FreeBusy Rights"  
48.     $Freebusyfld = $fiResult.Folders[0]  
49.     $Freebusyfld.Load()  
50.     addFolderPerm($Freebusyfld)  
51. }