1

I apologize if this is answered elsewhere. I'm so new to Exchange administration that I don't even know what to Google next.

My Issue: Certain users within our organization seem to have full permissions to resource calendars. We can't figure out how they have these permissions.

My coworker creates a resource calendar, then puts a meeting in it. I am also able to create meetings in this calendar, but not conflicting meetings, and I cannot delete their original meeting. This is all as it should be.

However, we went to test this in a random employees' Outlook. They can add conflicting meetings. They can delete other people's meetings. They can see the full permissions of the calendar - and edit them! We then checked, and sure enough, they can do this with any of our room or equipment calendars. In short, the receptionist can delete meetings made by our senior leadership team.

I have looked through the calendars, and they look like they are set up properly to me. The auto-attendant is on. Conflicting meeting requests are rejected. I ran Get-MailboxPermission and Get-MailboxFolderPermission against the mailbox, and I don't see any group membership or individual permission that would allow this user to do this. Are there other Exchange permissions I am not aware of? How is it possible that this person has godmode access and I can't even see how?

We use on-premise Exchange 2010. Please let me know what other information I can provide to help.

  • Here is the output from that command: [PS] C:\Windows\system32>Get-MailboxFolderPermission cnb.int\<user>:\calendar | select FolderName, user, AccessRights FolderName User AccessRights ---------- ---- ------------ Calendar Default {AvailabilityOnly} Calendar Anonymous {None} – frogers Apr 24 at 2:41
  • @PimpJuiceIT And the calendar was created using the wizard in the Exchange Management Console. I did the same thing with another new mailbox and got the same results. Right Click Mailbox > New Mailbox > Select Room Mailbox then click Next > etc. We named it, accepted all the default policies and there it was. After creating, we enabled the auto-attendant. There's probably a few other steps we did, but since this is true of previously existing room mailboxes as well, I doubt they're super relevant. – frogers Apr 24 at 2:47
  • @PimpJuiceIT - Using the command you mentioned above, I see the same listings. The Default user has {LimitedDetails} under AccessRights, and the user Anonymous has {None}. Those are the expected settings of the calendar, and are what I want them to be. The thing I'm still missing is how does this other user have permission to modify calendar items or overbook? They aren't listed in the permissions of the calendar, so they shouldn't be able to do anything beyond the Default rights assigned, which is only the role LimitedDetails. – frogers Apr 25 at 14:24
  • @PimpJuiceIT It's more than one user. It isn't everyone, but at this point since I am unable to find the root of how this user can do it, I can't tell how many more are like this. This person is not a delegate for anyone, and the resource calendar does not have any delegates specified. And this person can alter and delete meeting requests from anyone, not just leadership. – frogers Apr 29 at 1:56
  • 1
    Mighty fine of you to stick with it as long as you have @PimpJuiceIT, I'm grateful for the time you took. If I ever come up with an answer, I'll make sure to put it here. – frogers May 8 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.