Two methods are discussed in this post regarding command-line modifications to Exchange 2003 mailbox security, VBScript and ADModify.Net.
Method 1 - VBScript
The first method is to use a VBScript - modifying exchange mailbox rights can be done in a very similar fashion to modifying the ntSecurityDescriptor attribute. However, to make this work you need CDOEXM installed, installed with the exchange console on your administrative workstation.
The CDOEXM (Collaboration Data Objects for Exchange Management) objects provide an interface called IExchangeMailbox. This interface inherits from IMailboxStore, and also provides an additional property key to modifying Exchange permissions - the MailboxRights property.
Instead of using the msExchMailboxSecurityDescriptor attribute, you need to get and set the DACL using the MailboxRights property. The msExchMailboxSecurityDescriptor is only a back-link from the Exchange store, it doesn’t have a matching forward-link - therefore it won't be replicated if you modify this AD attribute. It eventually would be overwritten when the DACL is replicated back from the exchange mailbox object.
I assume the reason for the backlink msExchMailboxSecurityDescriptor attribute is mostly convenience and backwards compatibility, ie, an application or an admin can read the Exchange permissions (excluding inheritance I think) without requiring CDO.
Note that the Microsoft references below provide example script on using MailboxRights to modify existing mailboxes, and although the articles are quite good and very detailed, the relevance of MailboxRights compared to msExchMailboxSecurityDescriptor wasn't immediately obvious (to me at least).
Method 2 - ADModify.Net
The second method is to use ADModify.Net - a very powerful (and therefore potentially dangerous) utility to perform bulk modifications on mailbox objects. It comes with both command-line and GUI versions.
admodcmd is the command-line version, and the following example command starts at the specified DN, filtering based on user accounts with a certain CN, and then adds full-access mailbox rights to these users for the specified group:
admodcmd -dn "OU=USERS,DC=domain,DC=com" -f "(&(objectClass=user)(objectCategory=person)(CN=user*))" -addtomailboxrights domain\GroupToAdd ACE_MB_FULL_ACCESS
12 items found matching the specified filter.
0% 50% 100%
Successful changes: 12
Already set to specified value: 0
Failed changes: 0
Operation Completed in 4.15625 seconds.
How to set Exchange Server 2003 and Exchange 2000 Server mailbox rights on a mailbox that exists in the information store
How to set Exchange Server 2000 and 2003 mailbox rights at the time of mailbox creation
Exchange 2003 SP2 Disabling Mapi/Non-Cached Access Per User
ADModify.NET - Home
Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.