Problem
You implement shared mailboxes as part of a legacy public folder migration. Access to the shared mailbox provided by dedicated security groups which, in this case, provide access to dedicated sub folders within the mailbox.
The migrated legacy public folder content contained items marked as private.
When you access a shared mailbox as a group member you are not able to see or access private items.
The following two screenshots are used to demontraste the issue:
The Inbox node shows three unread items:
The Inbox detail pane just shows a single read message:
So how to access items marked as private?
Solution
The privacy level (Sensitivity) of a mailbox item is controlled by MAPI extended property 0x36.
- 0x36 = 0, sensitivity = normal
- 0x36 = 2, sensitivity = private
When an item does have an extended property 0x36, the value is set to 0.
A mailbox is accessed using Exchange Web Services. The EWS endpoint is discovered using AutoDiscover for the selected mailbox.
The item modificatiuon is handled by the following code segment:
var extendedPropertyDefinition = new ExtendedPropertyDefinition(0x36, MapiPropertyType.Integer);int extendedPropertyindex = 0;foreach (var extendedProperty in Message.ExtendedProperties){ if (extendedProperty.PropertyDefinition == extendedPropertyDefinition) { if (log.IsInfoEnabled) { log.Info(string.Format("Try to remove private flag from message: {0}", Message.Subject)); } else { Console.WriteLine("Try to remove private flag from message: {0}", Message.Subject); } // Set the value of the extended property to 0 (which is Sensitivity normal, 2 would be private) Message.ExtendedProperties[extendedPropertyindex].Value = 0; // Update the item on the server with the new client-side value of the target extended property. Message.Update(ConflictResolutionMode.AlwaysOverwrite); } extendedPropertyindex++;}
Usage
RemovePrivateFlags.exe -mailbox user@domain.com [-logonly] [-foldername "Inbox"]
Search through the mailbox and ask for changing a item if -logonly is not set to true.
If -foldername is given the folder path are compared to the folder name.
If -logonly is set to true only a log will be created.
RemovePrivateFlags.exe -mailbox user@domain.com [-foldername "Inbox"] [-noconfirmation]
Search through the mailbox, if -noconfirmation is set to true all items will be altered without confirmation.
Note
It should be noted that this solution is intended for use in migration scenarios.
When providing access to mailbox delegates you can enable access to your private elements as well. But access to shared mailboxes is not configured using the delegation workflow.
The code has been tested using Exchange Server 2013 CU15.
The program utilizes log4net to log detailed information to the file system. The configuration is controlled by the application’s config file.
Updates
- 2017-03-17: Release 1.1.0.0, Parameter changes
- 2017-03-09: Release 1.0.0.0
Links
- Download the source code at Github: https://github.com/Apoc70/RemovePrivateFlag
- Download the most current release here: https://github.com/Apoc70/RemovePrivateFlag/releases
Any issues or feature requests? Use Github.
Like the code? Leave a note.
