4.2.3. Grant Full Mailbox Permissions in MS Exchange Server

A. Granting Full Access to Mailboxes on Exchange Servers  (2010, 2013, 2016, 2019)

To provide full access to all mailboxes for a user account on Exchange Servers, you must assign Administrator rights. This process is done through the Exchange Control Panel (ECP).

Follow the steps to grant full access to accounts.

1. Open the Exchange Control Panel (ECP):

• Log in to the ECP with the necessary credentials.

• Navigate to the "Recipients" tab, where you can manage user accounts.

2. Select the User Account:

• Locate the account you wish to grant full access to and double-click on it to open the account properties.

3. Open Full Access Permissions:

• In the account properties window, click on "Mailbox Delegation”.

• Look for the "Full Access" section and click  .

4. Select the Administrator Account:

• A "Select Full Access" window will appear. This window displays a list of user accounts and groups with their display names.

• From the list, find and select the "Administrator" account. If the account is not listed, use the search function to locate it.

5. Add the Administrator Account:

• After selecting the "Administrator" account, click "OK."

• The Administrator account will now appear in the list under the "Full Access" section.

6. Save the Changes:

• Review the changes and click "Save" to apply the full access permissions.

• The selected account will now have full access to the mailboxes, allowing it to manage and access all mailbox content as a mailbox owner.

Note:

• Permission Scope: Granting full access permissions allows the selected account to open, view, and manage the contents of all mailboxes. Use this privilege judiciously.

• Security Considerations: Ensure that only trusted accounts are granted full access, as this level of access includes sensitive information

B. For Exchange Servers 2000, 2003, and 2007

In Exchange Server 2003 and 2000, by default even accounts having Enterprise Administrator privileges are not allowed to access all mailboxes of the Exchange Server. Even administrators have no right to open a mailbox on any of the servers. Thus, you can access only the mailboxes of your account, even if you have full admin, domain admin, or enterprise admin rights. This limitation can be overcome by certain methods. However, these methods can be applied only if they confer with security and privacy policies. We will discuss these methods to grant Full Mailbox Permission access rights in detail.

Access a Single Mailbox:

If you have the proper Exchange Server administrative rights, you can follow the underlying procedure to access a single mailbox in Exchange 2003 and 2000.

1. Click the Start menu.

2. In the Run dialog box, type mmc dsa.msc.

3. Click OK. Active Directory window is displayed.

4. If Advanced Features is not selected, select it in the View menu options.

5. In the list of users shown in Active Directory, right-click on the user whose mailbox permission is to be given. Select the Properties option.

6. In the [User] Properties dialog box, click the Exchange Advanced tab.

7. In the Exchange Advanced window, click the Mailbox Rights button. [User] Permission dialog box is displayed.

8. In the Permission dialog box, click the user or group whose mailbox is to be accessed. If the user is not present in the list click Add button. Enter the object name and click OK.

9. Select the Full mailbox access option under the Allow column.

10. Click Apply and then click OK.

 

Access to Mailboxes of a Specific Mailbox Store:

If you have proper Exchange Server administrative rights, you can follow the underlying procedure to access the mailbox on a specific store in Exchange Server 2003 and 2000.

1. Run Exchange System Manager (ESM).

2. Navigate and select the required Mailbox Store in the appropriate server object.

3. Right-click on Mailbox Store and click the Properties option. Properties dialog box appears.

4. Click the Security tab option.

5. In the Properties dialog box, click the user or group whose mailbox is to be accessed. If the user is not present in the list click Add button. Enter the object name and click OK.

6. Select Full Control options under the Allow column.

7. Click Apply and then click OK.

 

If Mailbox is on a Specific Server:

If you have the proper 'Exchange Server' administrative rights, you can follow the underlying procedure to access the mailbox on a specific Server in Exchange 2003 and 2000.

1. Start Exchange System Manager.

2. Navigate to the desired Administrative Group and then the Server under the servers node. Right-click on the selected server and choose the Properties option.

3. Click the Security tab.

4. In the Properties dialog box, click the user or group whose mailbox is to be accessed. If the user is not present in the list click Add button. Enter the object name and click OK.

5. Select Full Control under Allow column.

6. Click Apply and then click OK.

Wait for few minutes depending on number of domain controllers, Global Catalogs and site replication schedules and intervals for the changes to take place.