Shared mailboxes on an Exchange server

On the Exchange server, we can use the standard mailboxes for users, referred to as User Mailbox, which are assigned to the user account in Active Directory, and this is used to access the mailbox. From Exchange server version 2007, we also have several special types, where the mailbox is again assigned to an account in AD, but it is disabled, so it cannot be used for login. These are the room (Room Mailbox) and equipment (Equipment Mailbox) mailboxes, which are collectively referred to as resource mailboxes (Resource Mailbox), or the shared mailbox (Shared Mailbox).

Room and equipment mailboxes are intended for scheduling, the shared mailbox for use by multiple users (e.g., for a hotline or a company's public address). The main advantage over using a regular user mailbox (which can of course be done) is that the assigned domain account is disabled, so it cannot be misused (which is a plus for security). For a shared mailbox, we need to set permissions for the users who are to use it.

All the mentioned mailboxes have the RecipientType attribute with the value UserMailbox and differ in the RecipientTypeDetails attribute, the user mailbox has the value UserMailbox, the shared mailbox SharedMailbox, the room RoomMailbox and the equipment EquipmentMailbox.

Creating a Shared Mailbox

If we want to create or convert a shared mailbox on the Exchange Server 2010, we cannot use the Exchange Management Console (EMC), but we must use the Exchange Management Shell (EMS), i.e. PowerShell cmdlets. On Exchange Server 2013, we can already use the Exchange Admin Center (EAC). To create it, we use the standard New-Mailbox command, just add the -Shared parameter, there is no need to enter a password because the disabled account doesn't need it. For example:

New-Mailbox -Shared -Name 'Marketing' -Alias 'marketing' -OrganizationalUnit 'company.local/Shared' -UserPrincipalName 'marketing@company.local' -SamAccountName 'marketing' -Database "Mailbox Database"

Changing the Mailbox Type

The second option is to create a standard user mailbox and then convert it to a shared one. This simplifies the creation, as we can use the GUI (but we have to set a password for the user), but the actual conversion can only be done using a cmdlet in the EMS. We convert the user mailbox to a shared one using:

Set-Mailbox marketing -Type Shared

We can also do the conversion the other way around (or to another mailbox type):

Set-Mailbox marketing -Type Regular

It may be useful to list the mailboxes and their types:

Get-Mailbox | FT Name, RecipientTypeDetails

Setting Permissions for a Shared Mailbox

We have a shared mailbox so that several different users can use it. We need to set permissions for them first. The commonly used one is full access to the mailbox (Full Access Permission), which allows the user to act as the owner of the mailbox. They can do almost anything, but they cannot send mail from that address. For that, we also need to set the Send As or Send on Behalf permission.

Setting Full Mailbox Access

We can set the full access to the mailbox permission graphically in the EMC or using a cmdlet in the EMS. In the EMC, we just right-click on the mailbox in the Recipient Configuration - Mailbox and choose Manage Full Access Permission, then add the user. In the shell, we use the cmdlet

Add-MailboxPermission marketing -User bouska -AccessRights FullAccess

The set permission takes effect immediately. If we have Exchange Server 2010 SP1, Outlook 2007 and Outlook 2010 clients will use the automatic mailbox mapping feature, and the user will see their own and the shared mailbox right after restarting the client. They don't have to add it manually in Outlook settings. This behavior can be disabled (starting from Exchange 2010 SP2) when setting permissions:

Add-MailboxPermission marketing -User bouska -AccessRights FullAccess -InheritanceType All -Automapping $false

Setting Send As Permission

We described the setting of the send mail on behalf of the mailbox permission in the article Exchange Send As - sending emails from another address (where we also mentioned how to send mail on behalf of another mailbox). It's a permission on the Active Directory user, so we can set it using ADUC, PowerShell with the AD module, or EMC, where again in Recipient Configuration - Mailbox we right-click on the mailbox and choose Manage Send As Permission.

This permission does not take effect immediately, but typically within two hours, when the replication is done. It is also important that the mailbox from which we want to send the mail must be in the directory (must not be hidden), otherwise it is evaluated as foreign and we don't have permission to it.

Saving Sent Mail in Outlook

If we have not only our own mailbox, but also another - shared one in Outlook, all the sent mail is saved to the Sent Items folder of the user who sent the mail. When using shared mailboxes, we would rather want the mail sent on behalf of the shared mailbox to be saved in that mailbox. For Outlook 2010, this can be resolved, we need to have the KB 2459115 hotfix installed and set an item in the registry. Microsoft describes this in the article Messages sent from a shared mailbox aren't saved to the Sent Items folder of the shared mailbox in Outlook 2010.

In the registry, in the path HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Preferences, we create a DWORD value DelegateSentItemsStyle and set it to 1.