Today a client requested a method to find out who had access to users mailboxes. I came up with a quick script to resolve this:
get-mailbox –resultsize unlimited | Get-MailboxPermission | select identity, user, @{name="Access Rights";expression={$_.get_accessrights()}},isinherited,deny | ?{@('NT AUTHORITY\SELF','DOMAIN\Domain Admins','DOMAIN\Administrator','DOMAIN\Exchange Servers','DOMAIN\Public Folder Management','NT AUTHORITY\SYSTEM','NT AUTHORITY\NETWORK SERVICE','DOMAIN\Delegated Setup','DOMAIN\Organization Management','DOMAIN\Exchange Trusted Subsystem','DOMAIN\Enterprise Admins'
) -notcontains $_.User}
The main component of the script is which users you wish to exclude from the results, I added all the access entries that were added by default by exchange. For me it was the following Accounts:
NT AUTHORITY\SELF
NT AUTHORITY\SYSTEM
NT AUTHORITY\NETWORK SERVICE
DOMAIN\Public Folder Management
DOMAIN\Organization Management
DOMAIN\Exchange Trusted Subsystem
DOMAIN\Exchange Servers
DOMAIN\Enterprise Admins
DOMAIN\Domain Admins
DOMAIN\Delegated Setup
DOMAIN\Administrator
You could then pipe the results to a CSV file using the Export-Csv Cmdlet
