I apologize if this is answered elsewhere. I'm so new to Exchange administration that I don't even know what to Google next.
My Issue: Certain users within our organization seem to have full permissions to resource calendars. We can't figure out how they have these permissions.
My coworker creates a resource calendar, then puts a meeting in it. I am also able to create meetings in this calendar, but not conflicting meetings, and I cannot delete their original meeting. This is all as it should be.
However, we went to test this in a random employees' Outlook. They can add conflicting meetings. They can delete other people's meetings. They can see the full permissions of the calendar - and edit them! We then checked, and sure enough, they can do this with any of our room or equipment calendars. In short, the receptionist can delete meetings made by our senior leadership team.
I have looked through the calendars, and they look like they are set up properly to me. The auto-attendant is on. Conflicting meeting requests are rejected. I ran Get-MailboxPermission and Get-MailboxFolderPermission against the mailbox, and I don't see any group membership or individual permission that would allow this user to do this. Are there other Exchange permissions I am not aware of? How is it possible that this person has godmode access and I can't even see how?
We use on-premise Exchange 2010. Please let me know what other information I can provide to help.