Ive developed a powershellscript that is able to add this functionality, feel free to improve or use.
Iv'e used the msExchExtensionCustomAttribute3 and then renamed the attribute in Adaxes to "Full Mailbox Access". Also it uses samAccountName as user identifier, you could also implement adaxes module, but Im more comfy with MS modules.
There is no sync with the regular exchange management list of full mailbox access and the attributes list, and I intended to to this only because I didnt want to wait til the next adaxes update with better exchange support.
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
import-module activedirectory
if ($Context.IsPropertyModified("msExchExtensionCustomAttribute3"))
{
$OldAccessList = Get-ADUser -identity %sAMAccountName% -properties "msExchExtensionCustomAttribute3" | Select-Object msExchExtensionCustomAttribute3
$NewAccessList = $Context.GetModifiedPropertyValues("msExchExtensionCustomAttribute3");
foreach ($account in $OldAccessList.msExchExtensionCustomAttribute3)
{
if ($newAccessList -notcontains $account -and (Get-ADUser -Filter {samAccountName -eq $account}) -ne $NULL)
{
$CurrentUser = Get-ADUser -Identity %sAMAccountName% | Select-Object DistinguishedName, SamAccountName
$SamId = Get-Mailbox -identity $account | Select-Object DistinguishedName, SamAccountName, PrimarySMTPAddress
Remove-ADPermission -Identity $CurrentUser.DistinguishedName -User $SamId.DistinguishedName -InheritanceType 'All' -ExtendedRights 'send-as' -Confirm:$false
Remove-MailboxPermission -Identity $CurrentUser.DistinguishedName -User $SamId.DistinguishedName -AccessRight FullAccess -Confirm:$false
$Context.LogMessage("Removed FullMailboxAccess to" + ": " + $account, "Information")
}
else {}
}
if ($NewAccessList -ne $NULL)
{
foreach ($account in $NewAccessList)
{
# Check if samAccountName Exists in AD. If not, Cancel Edit.
if((Get-ADUser -f {samAccountName -eq $account}) -eq $NULL)
{
$Context.Cancel("Following account does not exist: " + $account);
return;
}
if ($OldAccessList.msExchExtensionCustomAttribute3 -notcontains $account -and (Get-ADUser -Filter {samAccountName -eq $account}) -ne $NULL)
{
$CurrentUser = Get-ADUser -Identity %sAMAccountName% | Select-Object DistinguishedName, SamAccountName
$SamId = Get-Mailbox -identity $account | Select-Object DistinguishedName, SamAccountName, PrimarySMTPAddress
Add-MailboxPermission -Identity $CurrentUser.DistinguishedName -User $SamId.DistinguishedName -AccessRight FullAccess -InheritanceType All
Add-ADPermission -Identity $CurrentUser.DistinguishedName -User $SamId.DistinguishedName -Extendedrights "Send As"
$Context.LogMessage("Added FullMailboxAccess to" + ": " + $SamId.SamAccountName, "Information")
}
else{}
}
}
}