Wednesday, April 20, 2005

Reverse msExchMailboxSecurityDescriptor Permissions Audit script

There are a few places where you can assign mailbox rights with Exchange 2x one of these is from Active Directory User and Computer via the Mailbox rights tab which manipulates the msExchMailboxSecurityDescriptor active directory attribute. You can display who has access to a mailbox using a script which reads this attribute and there is a good sample of doing this here .

But if you want to go the other way by displaying what mailboxes a particular User account has access to this can be a little more challenging. Essentially you need to enumerate the msExchMailboxSecurityDescriptor of every account in your domain and then relate this data. Fortunately this is where ADO Data shaping comes in real handy I’ve used data shaping before here . Data shaping allows you to build hierarchal data structures which in this case allows you to build a structure where the ACE objects (Trustees) on each mailbox relates to the User Account in Active Directory.

So to put this together in a script you have something that selects all the mailboxes in a domain using a LDAP query and then enumerates the ACE's on each mailbox one at time. It then populates two disconnected record-sets and then shapes these together by relating the trustee names to the user account name (using domain\username format)

This script only checks for ACE’s that have been explicitly set on the mailbox it. It will ignore the self permission and also any ACE's that are inherited from the mail store. This narrows the output of the script so it only shows which mailbox a user has been explicitly granted access to from AD Users and Computers. It’s very possible that you may have no mailboxes that meet these criteria so in this case the script would not output anything. If you have a large number of mailboxes this script can take a while to run because its essentially doing a query on every mailbox in your domain.

What’s it good for ? Mostly auditing it gives you another view of the data eg you can see that fred bloggs has access to the following mailbox instead of looking at it form the other perspective of checking each mailboxes ACL. This can help you see permission changes that might have flown under the Radar. What it doesn’t do is look at MAPI permissions so where mailboxes or folders have been delegated using Outlook for this you would need to logon to every mailbox using something like CDO to grab all these rights. While this is possible to do it can be complicated in a large environment I might look at doing this a bit later so you can look for example from a user perspective what calendars a user has been delegated rights to.

I put a downloadable copy of the script here the code looks like

Const RIGHT_DS_DELETE = &H10000
Const RIGHT_DS_READ = &H20000
Const RIGHT_DS_CHANGE = &H40000
Const RIGHT_DS_TAKE_OWNERSHIP = &H80000
Const RIGHT_DS_MAILBOX_OWNER = &H1
Const RIGHT_DS_SEND_AS = &H2
Const RIGHT_DS_PRIMARY_OWNER = &H4

Set objSystemInfo = CreateObject("ADSystemInfo")
strdname = objSystemInfo.DomainShortName
set conn1 = createobject("ADODB.Connection")
strConnString = "Data Provider=NONE; Provider=MSDataShape"
conn1.Open strConnString
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
Query = "<LDAP://" & strNameingContext & ">;(&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))
))));samaccountname,displayname,distinguishedName;subtree"
Com.ActiveConnection = Conn
Com.CommandText = Query
Com.Properties("Page Size") = 1000
set objParentRS = createobject("adodb.recordset")
set objChildRS = createobject("adodb.recordset")
strSQL = "SHAPE APPEND" & _
" NEW adVarChar(255) AS UOADDisplayName, " & _
" NEW adVarChar(255) AS UOADTrusteeName, " & _
" ((SHAPE APPEND " & _
" NEW adVarChar(255) AS MRmbox, " & _
" NEW adVarChar(255) AS MRTrusteeName, " & _
" NEW adVarChar(255) AS MRRights, " & _
" NEW adVarChar(255) AS MRAceflags) " & _
" RELATE UOADTrusteeName TO MRTrusteeName) AS rsUOMR"
objParentRS.LockType = 3
objParentRS.Open strSQL, conn1

Set Rs = Com.Execute
While Not Rs.EOF
dn = "LDAP://" & replace(rs.Fields("distinguishedName").Value,"/","\/")
set objuser = getobject(dn)
Set oSecurityDescriptor = objuser.Get("msExchMailboxSecurityDescriptor")
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
objParentRS.addnew
objParentRS("UOADDisplayName") = rs.fields("displayname")
objParentRS("UOADTrusteeName") = strdname & "\" & rs.fields("samaccountname")
objParentRS.update
Set objChildRS = objParentRS("rsUOMR").Value
For Each ace In dacl
if ace.AceFlags <> 18 then
if ace.Trustee <> "NT AUTHORITY\SELF" then
objChildRS.addnew
objChildRS("MRmbox") = rs.fields("displayname")
objChildRS("MRTrusteeName") = ace.Trustee
objChildRS("MRRights") = ace.AccessMask
objChildRS("MRAceflags") = ace.AceFlags
objChildRS.update
end if
end if
Next
rs.movenext
Wend
wscript.echo "Number of Mailboxes Checked " & objParentRS.recordcount
Wscript.echo
objParentRS.MoveFirst
Do While Not objParentRS.EOF
Set objChildRS = objParentRS("rsUOMR").Value
if objChildRS.recordcount <> 0 then wscript.echo objParentRS("UOADDisplayName")
Do While Not objChildRS.EOF
wscript.echo " " & objChildRS.fields("MRmbox")
If (objChildRS.fields("MRRights") And RIGHT_DS_SEND_AS) Then
wscript.echo " -send mail as"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_CHANGE) Then
wscript.echo " -modify user attributes"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_DELETE) Then
wscript.echo " -delete mailbox store"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_READ) Then
wscript.echo " -read permissions"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_TAKE_OWNERSHIP) Then
wscript.echo " -take ownership of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_MAILBOX_OWNER) Then
wscript.echo " -is mailbox owner of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_PRIMARY_OWNER) Then
wscript.echo " -is mailbox Primary owner of this object"
End If
objChildRS.movenext
loop
objParentRS.MoveNext
loop

22 comments:

Anonymous said...

Hi Glen,

I was looking for a script like this. It works great.

Thank you!!

Anonymous said...

This is a very good one. No Special permissions required to run this script.

Anonymous said...

Hi,
I get an error line 46 char 2 - multiple step operation generated errors code:80040e2
Any ideas as this script is just what i am looking for?

Anonymous said...

How could I modify this script to output to a file? Yes I'm a n00b to exchange and vbscript.

Anonymous said...

Hi,

My domain is too large and geographically spread out to run this script, could anyone show me how to narrow the script only to report against a paticular ou ?
Either here or by email to tony.yates@ace-ina.com

Thanks in advance.

Glen said...

You only really need to modify one line

Query = "<LDAP://" & strNameingContext & ">(&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*))


Replace the strNameingContext varible which will be set to the root of the Ldap tree with the distinguished name of the OU you want to query. (to get the DN of the OU use ADSI Edit)

simonkw said...

Hi Glen,

I noticed that the script can check for mailbox-enabled accounts only. Any ways to apply for non-mailbox-enabled accounts? Thanks!

Glen said...

That's a good question i didn't really think about users who dont have a mailbox. Have a look at http://msgdev.mvps.org/exdevblog/revpermv2.zip

Basically i modified the ADSI query to include all user objects (instead of just mail enabled objects) And also i had to rearrange some of the other lines and add a conditional so the the mailbox security descriptor isn't checked if the mail alias is not set.

Cheers
Glen

Guido said...

Great! but how can i redirect the output for a txtfile or screen instead of messages dialogs boxes?

Glen said...

If you run the script from cscript and then pipe the output a text file is the easiest way.Otherwise you need to put in some File System object code the write the varible out to a file

Cheers
Glen

Anonymous said...

Glen -

You TOTALLY ROCK! Thanks for posting this script. Our company was looking at a tool that does this (plus more) at a cost of over 10k. With your script and a few more reporting pieces, I can replicate that same functionalty.

Again, Thanks much!
david

Anonymous said...

Glen,

This script would be great if it went to a file. I know how to doubleclick a script but that is about it. Could you provide the script straight to a file?

Anonymous said...

Thanks for sharing this script. It was extremely useful in helping me understand mailbox rights. Keep up the great work!

michael said...

Just used your tool and must say its bloomin' good!

Anonymous said...

Hello, I tried to run this script but gets only as a result of something like "Number of mailboxes checked 3". What's wrong?

Glen said...

Do you have multiple domains this script will query the domain that the user is currently logged onto if the users you want to report on are in multiple domains then the ADSI in this script wont really catter for this.

Cheers
Glen

Anonymous said...

I have one domain. It seemed to me that this script will show the permission to mailbox and not just their number? (start script via xp and windows server 2003)

Anonymous said...

Great work! This script helped us out!

Darien said...

This post might be from '05 but this does exactly what I need. Thanks Glen!

Anonymous said...

Top Man, just what I needed!

Anonymous said...

Seems to me the script does not export SendAs permissions correctly.
I setup a user with mailbox and granted Full Mailbox access (Exchange Advanced Tab) and SendAs (Security) to another user.
Only Full Mailbox access permission is exported...

Xinete said...

Great Job!!

Thank You!