The command as shown here only returns the ACE's that only have FullAccess specified in the -AccessRights property. Very often (especially after migrating from Exchange 2003) the users that are granted Full Mailbox Access also have the DeleteItem AccessRight and in such cases the query in this Example does not return those entries and thus not 'fix' them.
In my environment I changed the queries to:
#get the DACL excluding SELF
$FixAutoMapping = Get-MailboxPermission -identity $strMailbox | wh
↧