Skip to main content

Reverse msExchMailboxSecurityDescriptor Permissions Audit script

There are a few places where you can assign mailbox rights with Exchange 2x one of these is from Active Directory User and Computer via the Mailbox rights tab which manipulates the msExchMailboxSecurityDescriptor active directory attribute. You can display who has access to a mailbox using a script which reads this attribute and there is a good sample of doing this here .

But if you want to go the other way by displaying what mailboxes a particular User account has access to this can be a little more challenging. Essentially you need to enumerate the msExchMailboxSecurityDescriptor of every account in your domain and then relate this data. Fortunately this is where ADO Data shaping comes in real handy I’ve used data shaping before here . Data shaping allows you to build hierarchal data structures which in this case allows you to build a structure where the ACE objects (Trustees) on each mailbox relates to the User Account in Active Directory.

So to put this together in a script you have something that selects all the mailboxes in a domain using a LDAP query and then enumerates the ACE's on each mailbox one at time. It then populates two disconnected record-sets and then shapes these together by relating the trustee names to the user account name (using domain\username format)

This script only checks for ACE’s that have been explicitly set on the mailbox it. It will ignore the self permission and also any ACE's that are inherited from the mail store. This narrows the output of the script so it only shows which mailbox a user has been explicitly granted access to from AD Users and Computers. It’s very possible that you may have no mailboxes that meet these criteria so in this case the script would not output anything. If you have a large number of mailboxes this script can take a while to run because its essentially doing a query on every mailbox in your domain.

What’s it good for ? Mostly auditing it gives you another view of the data eg you can see that fred bloggs has access to the following mailbox instead of looking at it form the other perspective of checking each mailboxes ACL. This can help you see permission changes that might have flown under the Radar. What it doesn’t do is look at MAPI permissions so where mailboxes or folders have been delegated using Outlook for this you would need to logon to every mailbox using something like CDO to grab all these rights. While this is possible to do it can be complicated in a large environment I might look at doing this a bit later so you can look for example from a user perspective what calendars a user has been delegated rights to.

I put a downloadable copy of the script here the code looks like

Const RIGHT_DS_DELETE = &H10000
Const RIGHT_DS_READ = &H20000
Const RIGHT_DS_CHANGE = &H40000
Const RIGHT_DS_TAKE_OWNERSHIP = &H80000
Const RIGHT_DS_MAILBOX_OWNER = &H1
Const RIGHT_DS_SEND_AS = &H2
Const RIGHT_DS_PRIMARY_OWNER = &H4

Set objSystemInfo = CreateObject("ADSystemInfo")
strdname = objSystemInfo.DomainShortName
set conn1 = createobject("ADODB.Connection")
strConnString = "Data Provider=NONE; Provider=MSDataShape"
conn1.Open strConnString
set conn = createobject("ADODB.Connection")
set com = createobject("ADODB.Command")
Set iAdRootDSE = GetObject("LDAP://RootDSE")
strNameingContext = iAdRootDSE.Get("defaultNamingContext")
Conn.Provider = "ADsDSOObject"
Conn.Open "ADs Provider"
Query = "<LDAP://" & strNameingContext & ">;(&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))
))));samaccountname,displayname,distinguishedName;subtree"
Com.ActiveConnection = Conn
Com.CommandText = Query
Com.Properties("Page Size") = 1000
set objParentRS = createobject("adodb.recordset")
set objChildRS = createobject("adodb.recordset")
strSQL = "SHAPE APPEND" & _
" NEW adVarChar(255) AS UOADDisplayName, " & _
" NEW adVarChar(255) AS UOADTrusteeName, " & _
" ((SHAPE APPEND " & _
" NEW adVarChar(255) AS MRmbox, " & _
" NEW adVarChar(255) AS MRTrusteeName, " & _
" NEW adVarChar(255) AS MRRights, " & _
" NEW adVarChar(255) AS MRAceflags) " & _
" RELATE UOADTrusteeName TO MRTrusteeName) AS rsUOMR"
objParentRS.LockType = 3
objParentRS.Open strSQL, conn1

Set Rs = Com.Execute
While Not Rs.EOF
dn = "LDAP://" & replace(rs.Fields("distinguishedName").Value,"/","\/")
set objuser = getobject(dn)
Set oSecurityDescriptor = objuser.Get("msExchMailboxSecurityDescriptor")
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
objParentRS.addnew
objParentRS("UOADDisplayName") = rs.fields("displayname")
objParentRS("UOADTrusteeName") = strdname & "\" & rs.fields("samaccountname")
objParentRS.update
Set objChildRS = objParentRS("rsUOMR").Value
For Each ace In dacl
if ace.AceFlags <> 18 then
if ace.Trustee <> "NT AUTHORITY\SELF" then
objChildRS.addnew
objChildRS("MRmbox") = rs.fields("displayname")
objChildRS("MRTrusteeName") = ace.Trustee
objChildRS("MRRights") = ace.AccessMask
objChildRS("MRAceflags") = ace.AceFlags
objChildRS.update
end if
end if
Next
rs.movenext
Wend
wscript.echo "Number of Mailboxes Checked " & objParentRS.recordcount
Wscript.echo
objParentRS.MoveFirst
Do While Not objParentRS.EOF
Set objChildRS = objParentRS("rsUOMR").Value
if objChildRS.recordcount <> 0 then wscript.echo objParentRS("UOADDisplayName")
Do While Not objChildRS.EOF
wscript.echo " " & objChildRS.fields("MRmbox")
If (objChildRS.fields("MRRights") And RIGHT_DS_SEND_AS) Then
wscript.echo " -send mail as"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_CHANGE) Then
wscript.echo " -modify user attributes"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_DELETE) Then
wscript.echo " -delete mailbox store"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_READ) Then
wscript.echo " -read permissions"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_TAKE_OWNERSHIP) Then
wscript.echo " -take ownership of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_MAILBOX_OWNER) Then
wscript.echo " -is mailbox owner of this object"
End If
If (objChildRS.fields("MRRights") And RIGHT_DS_PRIMARY_OWNER) Then
wscript.echo " -is mailbox Primary owner of this object"
End If
objChildRS.movenext
loop
objParentRS.MoveNext
loop

Popular posts from this blog

Downloading a shared file from Onedrive for business using Powershell

I thought I'd quickly share this script I came up with to download a file that was shared using One Drive for Business (which is SharePoint under the covers) with Powershell. The following script takes a OneDrive for business URL which would look like https://mydom-my.sharepoint.com/personal/gscales_domain_com/Documents/Email%20attachments/filename.txt This script is pretty simple it uses the SharePoint CSOM (Client side object Model) which it loads in the first line. It uses the URI object to separate the host and relative URL which the CSOM requires and also the SharePointOnlineCredentials object to handle the Office365 SharePoint online authentication. The following script is a function that take the OneDrive URL, Credentials for Office365 and path you want to download the file to and downloads the file. eg to run the script you would use something like ./spdownload.ps1 ' https://mydom-my.sharepoint.com/personal/gscales_domain_com/Documents/Email%20attachments/filena

A walk-though using the Graph API Mailbox reports in Powershell

Quite recently the Reporting side of the Graph API has moved in GA from beta, there are quite a number of reports that can be run across various Office365 surfaces but in this post I'm going to focus on the Mailbox related ones. Accessing Office365 Reports using Powershell is nothing new and has been available in the previous reporting endpoint  https://msdn.microsoft.com/en-us/library/office/jj984326.aspx however from the end of January many of these cmdlets are now being depreciated in favour of the Graph API  https://msdn.microsoft.com/en-us/library/office/dn387059.aspx . Prerequisites  In comparison to using the Remote PowerShell cmdlets where only the correct Office365 Admin permissions where needed, to use the new Graph API reports endpoint you need to use OAuth for authentication so this requires an Application Registration  https://developer.microsoft.com/en-us/graph/docs/concepts/auth_overview  that is then given the correct oAuth Grants to use the Reports EndPoin

How to test SMTP using Opportunistic TLS with Powershell and grab the public certificate a SMTP server is using

Most email services these day employ Opportunistic TLS when trying to send Messages which means that wherever possible the Messages will be encrypted rather then the plain text legacy of SMTP.  This method was defined in RFC 3207 "SMTP Service Extension for Secure SMTP over Transport Layer Security" and  there's a quite a good explanation of Opportunistic TLS on Wikipedia  https://en.wikipedia.org/wiki/Opportunistic_TLS .  This is used for both Server to Server (eg MTA to MTA) and Client to server (Eg a Message client like Outlook which acts as a MSA) the later being generally Authenticated. Basically it allows you to have a normal plain text SMTP conversation that is then upgraded to TLS using the STARTTLS verb. Not all servers will support this verb so if its not supported then a message is just sent as Plain text. TLS relies on PKI certificates and the administrative issue s that come around certificate management like expired certificates which is why I wrote th
All sample scripts and source code is provided by for illustrative purposes only. All examples are untested in different environments and therefore, I cannot guarantee or imply reliability, serviceability, or function of these programs.

All code contained herein is provided to you "AS IS" without any warranties of any kind. The implied warranties of non-infringement, merchantability and fitness for a particular purpose are expressly disclaimed.