All, I am currently searching for the right way to complete this task. I
need to enumerate all users within an OU that have mailboxes. Then I need to
check the ACL's on those mailboxes for any users that are listed but do not
have full control of the mailbox. As in, some of our vanity mailboxes have
users that can view the mailbox, but they don't have full control. I'm
attaching a little snipit of stuff i've tried, notice the section commented
out, this was my first attempt. Then I tried using an array and that's not
working either.
Sub PerformQuery
'On Error Resume Next
Const ACE_MB_FULL_ACCESS = &h1
Const ACE_MB_ASSOC_EXT_ACCT = &h4
Const ACE_MB_DELETE_STORAGE = &h10000
Const ACE_MB_READ_PERMISSIONS = &h20000
Const ACE_MB_CHANGE_PERMISSIONS = &h40000
Const ACE_MB_TAKE_OWNERSHIP = &h80000
Const ACE_MB_SYNCRONIZE=&h100000
Const ADS_ACETYPE_ACCESS_ALLOWED = 0
Const ADS_ACETYPE_ACCESS_DENIED = 1
Const ADS_ACETYPE_SYSTEM_AUDIT = 2
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT = 5
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = 6
Const ADS_ACETYPE_SYSTEM_AUDIT_OBJECT = 7
Const ADS_ACETYPE_SYSTEM_ALARM_OBJECT = 8
Const ADS_ACEFLAG_INHERIT_ACE = 16
Dim OUTPUT_DELIMITER, empname, empuserid, empidnum, outhtml, txtUser,
objUser, oSecurityDescriptor, dacl, ace
OUTPUT_DELIMITER = vbTab
Set con = CreateObject("ADODB.Connection")
con.Provider = "ADsDSOObject"
con.open
Set command = CreateObject("ADODB.Command")
Set command.ActiveConnection = con
command.CommandText =
"<LDAP://OU=Vanity,OU=Users,DC=domain,DC=com>;(&(objectCategory=person)(objectClass=user));displayName,ADsPath;subtree"
command.Properties("searchscope") = 2
command.Properties("Page Size") = 3000
outhmtl = "<br>" & "The script is now processing the accounts." & "<br>"
Set rs = command.Execute
while not rs.eof
Dim aceArray()
Dim iCount
txtUser = rs.fields("ADsPath")
'SystemOutput.InnerHTML = "The Adspath: " & txtUser
Set objUser = GetObject(txtUser)
Set oSecurityDescriptor = objUser.MailboxRights
Set dacl = oSecurityDescriptor.DiscretionaryAcl
Set ace = CreateObject("AccessControlEntry")
'Set objDictGroup = CreateObject("Scripting.Dictionary")
For Each ace in dacl
aceArray(iCount) = ace.AccessMask
iCount = iCount + 1
'accessstr = ""
'accessmask = ace.AccessMask
'acetype = ace.AceType
'if (accessmask AND ACE_MB_FULL_ACCESS) = ACE_MB_FULL_ACCESS
then
' select case acetype
' case ADS_ACETYPE_ACCESS_ALLOWED
' outhtml = outhtml & "The Mailbox: " &
rs.fields("displayName") & " is okay." & "<br>"
' case else
' if (acetype <> ADS_ACETYPE_ACCESS_ALLOWED) and
(acetype <> ADS_ACETYPE_ACCESS_DENIED) then
' outhtml = outhtml & "The Mailbox: " &
rs.fields("displayName") & " has an account: " & ace.Trustee & " that does
not have full control." & "<br>"
' end if
' end select
'end if
'objDictGroup.Add
Next
ReDim aceArray(iCount)
i=0
FullAccessExists = False
Do Until i = uBound(aceArray)
if aceArray(i) = ACE_MB_FULL_ACCESS then
FullAccessExists = True
end if
i = i + 0
Loop
if not FullAccessExists then
outhtml = outhtml & "The Mailbox: " &
rs.fields("displayName") & " has an account: " & ace.Trustee & " that does
not have full control." & "<br>"
end if
iCount = 0
rs.movenext
wend