daknetworks.com

Scenario

You are an administrator of an Exchange system. Through the ECP, you add yourself FULL-ACCESS to another mailbox account. The account naturally shows in your Outlook. You are finished with the account and no longer need access to it. Again, through the ECP, you remove yourself FULL-ACCESS. The account still shows in your Outlook. What gives?

 You might be tempted to remove the FULL-ACCESS through the EMS with the following:

remove-MailboxPermission foo.user -user foo.user2 -AccessRights FullAccess

But that yields:

WARNING: An inherited access control entry has been specified: [Rights: CreateChild, Delete, ReadControl, WriteDacl, WriteOwner, ControlType: Allow]  and was ignored on object "CN=where,OU=ever,OU=city,OU=Users,DC=domain,DC=tld".

Description

The mailbox is inheriting FullAccess permissions and has explicit FullAccess permissions. So when you removed the explicit FullAccess permissions, it won't have any effect unless a Deny permission is added. The problem is that Exchange doesn't tell you it is doing this.

Solution

To fix this, simply clear the Deny permission:

remove-MailboxPermission foo.user -user foo.user2 -AccessRights FullAccess -Deny

NOTES:

I've must have run into this before as I already have this post: http://www.daknetworks.com/blog/404-remove-mailbox-permissions-that-are-not-inherited