Thursday, March 22, 2007

Granting Blackberry Permissions on Exchange 2007

One of the requirements for deploying a Blackberry Enterprise Server is to grant the Blackberry service account privileges on user mailboxes. The Blackberry service account must be granted ‘full mailbox access’ and the ‘send-as’ permissions to work properly. Here are two methods of accomplishing this task using PowerShell.

Single User Method

[PS] C:\ >Add-MailboxPermission username@domain –user domain\besadmin –AccessRights FullAccess
[PS] C:\ >Add-ADPermission username@domain –user domain\besadmin -ExtendedRights Send-As, Receive-As

The first command will grant the Blackberry service account (besadmin) full mailbox access to the user’s mailbox. The second command will assign the appropriate active directory permissions so the service account can send and receive email as the user.

Server Method

[PS] C:\ >Get-MailboxServer | Add-ADPermission -User domain\besadmin -AccessRights GenericRead, GenericWrite -ExtendedRights Send-As, Receive-As, ms-Exch-Store-Admin

This method will grant all the necessary permissions to the service account on ALL mailboxes hosted on Exchange 2007 servers.


1 comment:

Brons2 said...

I installed an Exchange 2007 server into an existing Exchange 2003 site. Everything is working fine so far. But when I try to make a BlackBerry account work, I cannot get access. If I log into a regular workstation with the BlackBerry service account and attempt to access a mailbox in 2003, it works fine. But in 2007 it fails. I have followed the directions on the BlackBerry site to a T. I am going to try the single user method you list and see if that makes a difference. ARGH!