Saturday, October 22, 2011

Changing Folder and Calendar Permissions in Exchange using the EWS Managed API and powershell

While Exchange 2010 provides some really good cmdlets now for setting and changing folder permissions such as Set-MailboxFolderPermission http://technet.microsoft.com/en-us/library/ff522363.aspx . Using EWS to do this can still be useful in circumstances where the cmdlets can't be used or your having problems with localized folder names or you want to take advantage of EWS Impersonation to get around any issues your having with acquiring the correct rights to make the changes you might need.

I'll look at the example of changing the default calendar permissions of the default ACL on the calendar as this is one of the harder things to do and there are a few points that can catch you out.

First point is that when you modify permissions with EWS you basically grab the DACL from the server make your changes locally to the DACL and the post it back in a Update Folder operation. This means the logic you use on the client side needs to be up to dealing with this. The permissions object in the Managed API has a Add and Remove methods and you have the ability to modify am ACE within the permissions collection. The one problem you can have is if the Folder permissions is currently set to custom and you try to use one the default FolderPermissionLevel. You will also have problem if you don't check the current collection and try to add a duplicate ACE into the collection.

A simple way to solve this is to first search the current collection for any existing ACE entries and remove the existing ACE then add the new rights you want set using the Add method. The other issue you need to deal with when setting the calendar folder permission is to also make sure you set the corresponding rights on the FreeBusy Data folder or you may have problems such as explained in http://support.microsoft.com/kb/184151

I've put together two examples both of these use EWS Impersonation which you can configure in 2010 via RBAC http://msdn.microsoft.com/en-us/library/bb204095%28v=EXCHG.140%29.aspx

There are 3 varibles in the script you need to modify

$MailboxName = "user@domain.com"




This is the mailbox you want to make the changes and what will be impersonated

$Permission = [Microsoft.Exchange.WebServices.Data.FolderPermissionLevel]::Editor






This is the rights you want to set

$credentials = New-Object System.Net.NetworkCredential("user@domain.com,"password")



These are the user credentials to use this user must have impersonation rights

I've posted both examples up here

In the first example this shows how to set the Default permissions for the default user on the Calendar to Editor


The second Example shows how to set calendar permission for a particular user to Editor this example looks like



  1. $MailboxName = "mailbox@domain.com"  
  2.   
  3.  
  1. $credentials = New-Object System.Net.NetworkCredential("user@domain.com","Password#")  
  2.   
  3. $NewACLUser = "newacl@domain.com"  
  4.   
  5. $dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\1.1\Microsoft.Exchange.WebServices.dll"  
  6.   
  7. [void][Reflection.Assembly]::LoadFile($dllpath)  
  8.  
  9. $Permission = [Microsoft.Exchange.WebServices.Data.FolderPermissionLevel]::Editor  
  10.  
  11. $service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010)  
  12. $service.Credentials = $credentials  
  13. $service.AutodiscoverUrl($MailboxName,{$true})  
  14. $service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $MailboxName);  
  15.   
  16.   
  17. function addFolderPerm($folder){  
  18.     $existingperm = $null  
  19.     foreach($fperm in $folder.Permissions){  
  20.         if($fperm.UserId.StandardUser -eq $null){  
  21.             if ($fperm.UserId.PrimarySmtpAddress.ToLower() -eq $NewACLUser.ToLower()){  
  22.                 $existingperm = $fperm  
  23.             }  
  24.         }  
  25.     }  
  26.     if($existingperm -ne $null){  
  27.         $folder.Permissions.Remove($existingperm)  
  28.     }   
  29.     $newfp = new-object Microsoft.Exchange.WebServices.Data.FolderPermission($NewACLUser,$Permission)  
  30.     $folder.Permissions.Add($newfp)  
  31.     $folder.Update()  
  32. }  
  33.   
  34. "Checking : " + $MailboxName   
  35. $folderidcnt = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Calendar,$MailboxName)  
  36. $Calendar = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderidcnt)  
  37. "Set Calendar Rights"  
  38. addFolderPerm($Calendar)  
  39. $sf1 = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,"Freebusy Data")  
  40.   
  41. $fvFolderView = New-Object Microsoft.Exchange.WebServices.Data.FolderView(1000)  
  42. $fvFolderView.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Shallow;  
  43.   
  44. $folderidRoot = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Root,$MailboxName)  
  45. $fiResult = $Service.FindFolders($folderidRoot,$sf1,$fvFolderView)  
  46. if($fiResult.Folders.Count -eq 1){  
  47.     "Set FreeBusy Rights"  
  48.     $Freebusyfld = $fiResult.Folders[0]  
  49.     $Freebusyfld.Load()  
  50.     addFolderPerm($Freebusyfld)  
  51. }  

5 comments:

Ade said...

I am using a similar method written in C# to set the permission on a calendar and freebusy data folders of a mailbox on an Exchange 2007 system. I am trying to set the permission for the default standard user to reviewer. However, when I look at the permissions set in Outlook 2007, it is not set to reviewer, it is shown as custom. If I set the permission to reviewer using Outlook, and and examine the permissions in code, they show up as reviewer for the calendar and editor for the freebusy data folder. If I replace with identical permissions and update in code, Outlook shows a custom permission. What am I doing wrong?

Thanks
Ade

Glen said...

With EWS the permission don't align for versions Outlook other the 2010 and greater. Its not a big deal really but if you want the permissions to align you need to use a custom permission type.

Cheers
Glen

Ade said...

Thanks for responding. I saw a previous post where you mentioned this and have used the custom permission type and set the relevant properties but it makes no difference. It appears the FolderPermission.ReadItems property is being read as None or ignored by Outlook 2007 even though I have set it to FullDetails. The value is still set to FullDetails when I read it back.

mjolinor said...

My eyes aren't what the used to be, but the code samples for the IPM_Subtree and Non_IPM_Subtree seem to be missing some trailing punctuation.

Anonymous said...

This is exactly my big issue since one week
how to change permission for one entry without changing all others with update fodler method???????????????????,
thanks a lot lot lot