RE: [ActiveDir] Exporting Mailbox rights

Alain Lissoir Mon, 05 Dec 2005 07:02:18 -0800

Do you have the Functions folder available? It contains a series of functions used by WMIManageSD.Wsf

Next you must register the DLL with REGSVR32 in the resource folder. Then you are all set.

By default, WMIManageSD.Wsf must be in Folder XYZ while Functions folder must be at the same level.

Root +-------- Functions

+-------- XYZ

Otherwise you can change the "..\Functions" reference to an absolute path and point to the exact location of the Functions folder in your installation (you call).

To run against a group of MB in an OU, just query the users you have in that OU with DSQUERY (or any equivalent tool) and combine them in a command like:

(one single when you type. Line is cut for readability reasons in this mail).

For /F "delims=*" %i in ('dsquery * "ou=group mailboxes,OU=,DC=spinnaker,DC=org"
-filter "(objectClass=user)"') do
WMIManageSD.Wsf /E2KMailbox:"%1" /Decipher+ /ADSI+

HTH.

PS: Don't forget the + at the end of the /Decipher+ and /ADSI+ switches.

From: Amy Hunter [mailto:[EMAIL PROTECTED]
Sent: Monday, December 05, 2005 4:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Exporting Mailbox rights

Hi Alain,

thanks for your response, it all looks very clever.

I have tried running the following command:

WMIManageSD.Wsf /E2KMailbox:"cn=POTrust,ou=group mailboxes,OU=,DC=spinnaker,DC=org" /adsi

WMIManageSD.Wsf /E2KMailbox:"cn=POTrust,ou=group mailboxes,OU=,DC=spinnaker,DC=org" /decipher

I receive this error "c:\WMIManageSD.Wsf(155, 39) Windows Script Host: Cannot retrieve referenced URL : ..\Functions\SecurityInclude.vbs"

when I open this script, i can't see any reference to this....

Also, How can I run this against all group mailboxes in an OU>

any ideas?

Amy ;-)

Ps...sorry if I sound lame, scripting is not an area I spent too much time with Yet.< /DIV>

Alain Lissoir <[EMAIL PROTECTED]> wrote:

You can look at http://www.lissware.net, volume 2, Sample 4.02 to 4.13 - WMIManageSD.Wsf (and associated sub-functions in the Functions folder).

Syntax to use in red below (the script supports Filesystem, Share, ADObject with Extended Rights, Exchange Mailbox, Registry Key, WMI namespace).

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Usage: WMIManageSD.Wsf [/FileSystem:value] [/Share:value] [/ADObject:value] [/E2KMailbox:value] [/E2KStore[+|-]] [/RegistryKey:value] [/WMINameSpace:value] [/ViewSD[+|-]] [/Owner:value] [/Group:value] [/SDControls:value] [/AddAce[+|-]] [/DelAce[+|-]] [/Trustee:value] [/ACEMask:value] [/ACEType:value] [/ACEFlags:value] [/ObjectType:value] [/InheritedObjectType:value] [/SACL[+|-]] [/Decipher[+|-]] [/ADSI[+|-]] [/SIDResolutionDC[+|-]] [/Machine:value] [/User:value] [/Password:value]

Options:

FileSystem          : Get the security descriptor of the specified file or directory path.
Share               : Get the security descriptor of the specified share name.
ADObject            : Get the security descriptor of the specified distinguished name AD object.
E2KMailbox          : Get the security descriptor of the Exchange 2000 mailbox specified by AD user distinguished name.
E2KStore            : Specify if th e security descriptor must come from the Exchange 2000 store.
RegistryKey         : Get the security descriptor of the specified registry key.
WMINameSpace        : Get the security descriptor of the specified WMI Name space.
ViewSD              : Decipher the security descriptor.
Owner               : Set the security descriptor owner.
Group               : Set the security descriptor group.
SDControls          : Set the security descriptor control flags.
AddAce              : Add a new ACE to the ACL.
DelAce              : Remove an existing ACE from the ACL.
Trustee             : Specify the ACE mask (granted user, group or machine account).
ACEMask             : Specify the ACE mask (granted rights).
ACEType             : Specify the ACE type (allow or deny the ACE mask).
ACEFlags            : Specify the ACE flags (ACE mask inheritance).
ObjectType          : Specify which object type, property set, or property an ACE refers to.
InheritedObjectType : Specify the GUID of an object that will inherit the ACE.
SACL                : Manage the System ACL (auditing) (default=Discretionary ACL).
Decipher            : Decipher the security descriptor.
ADSI                : Retrieve the security descriptor with ADSI.
SIDResolutionDC     : Domain Controller to use for SID resolution.
Machine             : Determine the WMI system to connect to. (default=LocalHost)
User                : Determine the UserID to perform the remote connection. (default=none)
Password            : Determine the password to perform the remote connection. (default=none)
Examples:

      >>Viewing Security descriptors ...
        >>Files and Folders -----------------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Decipher+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Decipher+ /ADSI+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Decipher+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Decipher+ /ADSI+

        >>Share -----------------------------------------------------------------------------------
        WMIManageSD.Wsf /Share:MyDirectory /Decipher+

        >>AD object -------------------------------------------------------------------------------
        WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+
        WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /ADSI+

        >>Exchange 2000 mailbox -------------------------------------------------------------------
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /ADSI+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Decipher+ /E2KStore+

        >>Registry --------------------------------------------------------------------------------
        WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Decipher+ /ADSI+

        >>WMI namespace ---------------------------------------------------------------------------
        WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Decipher+

      >>Adding ACE in Security descriptors ...
        >>Files (Rights) --------------------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:NONE /AddAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_ALL_ACCESS /ACEFlags:NONE /AddAce+

        >>Files (Audit) ---------------------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_WRITE_OWNER /ACEFlags:SUCCESSFUL_ACCESS_ACE_FLAG /AddAce+ /SACL+

        >>Folders (Rights) ------------------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FOLDER_ADD_FILE,FILE_SYNCHRONIZE /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:EMEA\MyOtherUser /SIDResolutionDC:MyDC01.Emea.LissWare.Net /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_GENERIC_READ /ACEFlags:OBJECT_INHERIT_ACE,CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Owner:BUILTIN\Administrators

        >>Folders (Audit) -------------------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:Everyone /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_DELETE /ACEFlags:INHERIT_ONLY_ACE,SUCCESSFUL_ACCESS_ACE_FLAG /AddAce+ /SACL+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:BUILTIN\Administrators /ACEType:SYSTEM_AUDIT_ACE_TYPE /ACEMask:FILE_DELETE,FILE_WRITE_OWNER /ACEFlags:SUCCESSFUL_ACCESS_ACE_FLAG,CONTAINER_INHERIT_ACE,OBJECT_INHERIT_ACE /AddAce+ /SACL+ /ViewSD+ /Decipher+

        >>Share -----------------------------------------------------------------------------------
        WMIManageSD.Wsf /Share:MyDirectory /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_SHARE_READ_ACCESS /ACEFlags:NONE /AddAce+
        WMIManageSD.Wsf /Share:MyDirectory /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:FILE_SHARE_FULL_ACCESS,FILE_SHARE_CHANGE_ACCESS,FILE_SHARE_READ_ACCESS /ACEFlags:NONE /AddAce+

        >>AD object (Rights) ----------------------------------------------------------------------
        WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /ADSI+

        >>AD object (Extended Rights) -------------------------------------------------------------
        WMIManageSD.W sf /ADObject:"user;CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CONTROL_ACCESS /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /ObjectType:{AB721A53-1E2F-11D0-9819-00AA0040529B} /AddAce+
        WMIManageSD.Wsf /ADObject:"CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CONTROL_ACCESS /ACEFlags:ADS_ACEFLAG_OBJECT_INHERIT_ACE,ADS_ACEFLAG_CONTAINER_INHERIT_ACE /ObjectType:{AB721A53-1E2F-11D0-9819-00AA0040529B} /AddAce+ /ADSI+
        WMIManageSD.Wsf /ADObject:"user;CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CREATE_CHILD /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_INHERIT_ONLY_ACE /ObjectType:{A8DF74C1-C5EA-11D1-BBCB-0080C76670C0} /InheritedObjectType:{E934CB68-A980-11D2-A9FF-00C04F8EEDD8} /AddAce+
        WMIManageSD.Wsf /ADObject:"CN=MyObject,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_ACCESS_DENIED_OBJECT /ACEMask:ADS_RIGHT_DS_CREATE_CHILD /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_INHERIT_ONLY_ACE /ObjectType:{A8DF74C1-C5EA-11D1-BBCB-0080C76670C0} /InheritedObjectType:{E934CB68-A980-11D2-A9FF-00C04F8EEDD8} /AddAce+ /ADSI+

        >>AD object (Audit) -----------------------------------------------------------------------
        WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /ACEType:ADS_ACETYPE_SYSTEM_AUDIT /ACEMask:ADS_RIGHT_READ_CONTROL,ADS_RIGHT_ACTRL_DS_LIST,ADS_RIGHT_DS_READ_PROP /ACEFlags:ADS_ACEFLAG_SUCCESSFUL_ACCESS,ADS_ACEFLAG_CONTAINER_INHERIT_ACE,ADS_ACEFLAG_OBJECT_INHERIT_ACE /AddAce+ /ADSI+ /SACL+

        >>Exchange 2000 mailbox -------------------------------------------------------------------
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administrators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administr ators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /ADSI+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:BUILTIN\Administrators /ACEType:ADS_ACETYPE_ACCESS_ALLOWED /ACEMask:E2K_MB_FULL_MB_ACCESS,E2K_MB_SEND_AS,E2K_MB_READ_PERMISSIONS /ACEFlags:ADS_ACEFLAG_CONTAINER_INHERIT_ACE /AddAce+ /E2KStore+

        >>Registry --------------------------------------------------------------------------------
        WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:REG_GENERIC_READ /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+ /ADSI+

        >>WMI namespace ---------------------------------------------------------------------------
        WMIManageSD.Wsf /WMINameSpace:Root\MyNameSpace /Trustee:LissWareNET\MyUser /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:WBEM_ENABLE,WBEM_METHOD_EXECUTE,WBEM_WRITE_PROVIDER,WBEM_REMOTE_ACCESS /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+
        WMIManageSD.Wsf /WMINameSpace:Root\MyNameSpace /Trustee:BUILTIN\Administrators /ACEType:ACCESS_ALLOWED_ACE_TYPE /ACEMask:WBEM_ENABLE,WBEM_METHOD_EXECUTE,WBEM_WRITE_PROVIDER,WBEM_REMOTE_ACCESS /ACEFlags:CONTAINER_INHERIT_ACE /AddAce+

< SPAN class=875551814-02122005>      >>Deleting ACE in Security descriptors ...
        >>Files and Folders (Rights) --------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:REMOVE_ALL_ACE /DelAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:LissWareNET\MyUser /DelAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory\MyFile.Txt /Trustee:BUILTIN\Administrators /DelAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+

        >>Files and Folders (Audit) ---------------------------------------------------------------
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:REMOVE_ALL_ACE /DelAce+ /SACL+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+
        WMIManageSD.Wsf /FileSystem:C:\MyDirectory /Trustee:LissWareNET\MyUser /DelAce+ /SACL+ /ADSI+

        >>Share -----------------------------------------------------------------------------------
        WMIManageSD.Wsf /Share:MyDirectory /Trustee:LissWareNET\MyUser /DelAce+
        WMIManageSD.Wsf /Share:MyDirectory /Trustee:Everyone /DelAce+

        >>AD object (Rights) ----------------------------------------------------------------------
        WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:REMOVE_ALL_ACE /DelAce+
        WMIManageSD.Wsf /ADObject:"user;CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+
        WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+

>>AD object (Audit) -----------------------------------------------------------------------
WMIManageSD.Wsf /ADObject:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyGroup /DelAce+

        >>Exchange 2000 mailbox -------------------------------------------------------------------
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+
        WMIManageSD.Wsf /E2KMailbox:"CN=MyUser,CN=Users,DC=LissWare,DC=Net" /Trustee:LissWareNET\MyUser /DelAce+ /E2KStore+

>>Registry --------------------------------------------------------------------------------
WMIManageSD.Wsf /RegistryKey:HKLM\SOFTWARE\Microsoft /Trustee:LissWareNET\MyUser /DelAce+ /ADSI+

        >>WMI namespace ---------------------------------------------------------------------------
        WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Trustee:REMOVE_ALL_ACE /DelAce+
        WMIManageSD.Wsf /WMINameSpace:Root\CIMv2 /Trustee:LissWareNET\MyUser /DelAce+

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Amy Hunter
Sent: Friday, December 02, 2005 2:17 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Exporting Mailbox rights

Hi everyone,

Thankyou everyone for your responses to my other post, everything went smoothly.

I am looking for a way to export Exchange 2003 Mailbox Permission access to a .csv or .txt for all mailboxes in active directory

Does anyone know of a script or tool which will give me the same information as the Exchange Advanced Tab > Mailbox Rights for all users and groups.

I want to view the mailboxes to see who has access to what.

Kind Regards,

Amy ;-)

How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos

Yahoo! Model Search - Could you be the next catwalk superstar? Check out the competition now

RE: [ActiveDir] Exporting Mailbox rights

Reply via email to