How to expand "Get-ADPermission"'s "ExtendedRights" property?

Question

I need to enumerate the permissions that are embedded within Get-AdPermission's property "ExtendedRights".

How do I expand the properties within this multi-valued object and display them?

Normally I see commands like this:

Get-Mailbox | Get-ADPermission | where {($_.ExtendedRights -like "*Send-As*")} | Fl

But now I'm in the situation where I simply want to report on the permissions granted to the user (could be send-as, could be receive-as)

have you tried replacing the FL with " | Select -ExpandProperty ExtendedRights". — , Nov 21 '11 at 14:49
@ShawnMelton, that gets me partway, but I get errors that fail on a null entry.. I haven't debugged this. PRobably due to an ACL that has a standard right (not extended) — makerofthings7, Nov 21 '11 at 21:35

score 5 · Answer 1 · answered Nov 21 '11 at 21:33

Appending this ft identity,user,extendedrights,accessrights allows me to see the extended rights:

[PS] C:\Scripts\Exchange>Get-ReceiveConnector | Get-ADPermission | where {$_.User -like '*anonymous*'} | ft identity,user,extendedrights,accessrights

Identity                                          User                                              ExtendedRights                                    AccessRights
--------                                          ----                                              --------------                                    ------------
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-SMTP-Accept-Authoritative-Domain-Sender} {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-SMTP-Accept-Any-Sender}                  {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-SMTP-Submit}                             {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-Accept-Headers-Routing}                  {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-Store-Create-Named-Properties}           {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-Create-Public-Folder}                    {ExtendedRight}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                                                                        {GenericRead}
CAS01\Default HUBCAS01                       NT AUTHORITY\ANONYMOUS LOGON                                                                        {GenericRead}
CAS01\Client HUBCAS01                        NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-Store-Create-Named-Properties}           {ExtendedRight}
CAS01\Client HUBCAS01                        NT AUTHORITY\ANONYMOUS LOGON                      {ms-Exch-Create-Public-Folder}                    {ExtendedRight}
CAS01\Client HUBCAS01                        NT AUTHORITY\ANONYMOUS LOGON                                                                        {GenericRead}

score 1 · Accepted Answer · answered Nov 15 '19 at 00:21

I know this is old and the solution works but here's some extra info. The reason the command doesn't work is because the "Send-As" string is in $_.ExtendedRights.RawIdentity. The command you want is:

Get-Mailbox | Get-ADPermission | where {$_.ExtendedRights.RawIdentity -eq "Send-As"} | fl identity,user,extendedrights,accessrights

Bonus command for grabbing Send As permissions on all of the mail-enabled public folders. Be sure to replace DC=contoso,DC=com with your organization's domain name

Get-ADObject -SearchBase "CN=Microsoft Exchange System Objects,DC=contoso,DC=com" -Filter 'ObjectClass -eq "publicFolder"'| % { Get-ADPermission -identity $_.DistinguishedName } | Where-Object {$_.ExtendedRights.RawIdentity -eq "Send-As"} | fl identity,user,extendedrights,accessrights

How to expand "Get-ADPermission"'s "ExtendedRights" property?

2 Answers2