Karsten, sorry I seem to have missed your comment. Replace should have worked. However, I'm working on a new tool to replace ExFolders. It doesn't have that functionality yet, but I'll put it on the list. It's getting hard to maintain the old ExFolders code.

Mike, that is very interesting! I will have to try that and see if I can reproduce a non-canonical ACL that way. Unfortunately, your only option for dealing with the mailbox ACL (what you see with get-mailboxpermission) in 2010 and later is Powershell. So if the Powershell cmdlets don't work, you are out of luck. In past versions of Exchange we could go in via CDOEXM to modify the raw mailbox ACL and fix it, but that is no longer possible.