Exchange Server Forums

Grant "Administrator" access to all mailboxes

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Grant "Administrator" access to all mailboxes

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Grant "Administrator" access to all mailboxes - 31.Jul.2007 6:22:24 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Hi,

I need to give Administrator access to all mailboxes on an Exchange 2003 server. I know by default Administrator is denied Send As and Recieve as but I can not find where these permissions are inherited from. I could remove the inheritance but ideally don't want to do this. It would be easier to create a new account/security group and apply the permissions but I have been told to give Administrator access. I have been searching on google and I am not getting anywhere.

Thanks

Chris

Post #: 1

Featured Links*

RE: Grant "Administrator" access to all mailb... - 31.Jul.2007 6:32:38 AM

ismail.mohammed

Posts: 2334
Joined: 9.May2007
From: India
Status: offline

hi,

install windows support tools
open adsiedit.msc

configuration => Services => Microsoft Exchange =>Organization (properties : Security Tab) from this place you will get it. Make sure you are removing send as and receive as deny permission on the user and group to which it is added.

(in reply to chrishayward)

Post #: 2

RE: Grant "Administrator" access to all mailb... - 31.Jul.2007 6:56:01 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Ok thanks I will give it a go.

(in reply to ismail.mohammed)

Post #: 3

RE: Grant "Administrator" access to all mailb... - 31.Jul.2007 8:01:43 AM

consultOz

Posts: 901
Joined: 11.Mar.2005
From: Virginia, USA
Status: offline

You can achieve this without Adsiedit.msc, stay away from Adsiedit.msc since it is and can be very perilous tool if you are not paying attention.
Need full access for all users' mailboxes in Your SMTP mail organization

To display the permissions tab, make this change to the registry.

1. Here is the correct path to navigate:

HKEY_Current_User\Software\ Microsoft\Exchange\ExAdmin.

2. Once you reach the above section of the registry you need to create a DWORD called ShowSecurityPage.
3. A value of 1 (Numeric one) means on, whilst 0 (Zero) means off.
4. Close the Exchange System Manger, and then reopen

http://smtp25.blogspot.com/2007/04/need-full-access-for-all-users.html

best
oz

< Message edited by consultOz -- 31.Jul.2007 8:03:57 AM >

_____________________________

Good luck and Best Regards
Oz Ozugurlu
MVP (Exchange)
MCITP (EMA),MCITP (EA), MCITP (SA),
MCSE 2003 M+ S+, MCDST
Security+, Project+ ,Server+
http://smtp25.blogspot.com (Blog)

(in reply to chrishayward)

Post #: 4

RE: Grant "Administrator" access to all mailb... - 31.Jul.2007 10:48:37 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Thanks consultOz that worked a treat. I have removed the send as and recieve as deny permissions from administrator but I can not access mailboxes? Domain Admins are still denied send as and recieve as, does that matter?

< Message edited by chrishayward -- 31.Jul.2007 10:56:37 AM >

(in reply to consultOz)

Post #: 5

RE: Grant "Administrator" access to all mailb... - 31.Jul.2007 2:40:00 PM

a.grogan

Posts: 1887
Joined: 12.Apr.2005
From: London
Status: offline

Hiya chap, if the account that you are using is a member of the domain admins group then you will need to remove the deny (as a deny will always take preference).

Cheers,

A

_____________________________

Andy Grogan
MSExchange.org Forums Moderator
For my general ramblings about Exchange please visit my blog:
W: http://telnetport25.wordpress.com/
M: manifoldmaster@gmail.com

(in reply to chrishayward)

Post #: 6

RE: Grant "Administrator" access to all mailb... - 1.Aug.2007 4:09:42 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Thats what I thought. But I am a Domain Admin and if I give myself "Full mailbox Access" to a users account , even though domain admins are denied I can access their mailbox. When I check in Active Directory Administrator is no longer denied Full mailbox access so I am assuming it should work?

(in reply to a.grogan)

Post #: 7

RE: Grant "Administrator" access to all mailb... - 6.Sep.2007 9:33:17 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Anybody got any ideas? Still a problem.

(in reply to chrishayward)

Post #: 8

RE: Grant "Administrator" access to all mailb... - 7.Sep.2007 1:06:28 AM

ismail.mohammed

Posts: 2334
Joined: 9.May2007
From: India
Status: offline

hi,

go to this following location
configuration => Services => Microsoft Exchange =>Organization
and let me know which are the groups and users have denied rule for "send as" & "receive as" permission

(in reply to chrishayward)

Post #: 9

RE: Grant "Administrator" access to all mailb... - 7.Sep.2007 6:45:59 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Hi,

Domain Admins and Enterprise Admins are denied "send as" and "receive as".

Administrator has allow "Full Control" and no deny permissions but is a member of Domain Admins and Enterprise Admins? I thought this might be the problem but I am a Domain Admin and if I add myself allow "Full Control" it works fine.

(in reply to ismail.mohammed)

Post #: 10

RE: Grant "Administrator" access to all mailb... - 7.Sep.2007 6:58:04 AM

ismail.mohammed

Posts: 2334
Joined: 9.May2007
From: India
Status: offline

pls try to remove deny permission for Domain Admins and Enterprise Admins and give them allow for "send as" and "receive as"

(in reply to chrishayward)

Post #: 11

RE: Grant "Administrator" access to all mailb... - 7.Sep.2007 8:25:06 AM

chrishayward

Posts: 10
Joined: 31.Jul.2007
From: UK
Status: offline

Removing deny for Domain Admins and Enterprise Admins worked but obviously this allows every Domain / Enterprise admin to open anyones mailbox.

I added the deny "send as" and "recieve as" permissions back in ADSI edit but it did not apply them, when I looked at a users mailbox rights, Domain and Enterprise admins did not have a "grey" tick in deny "Full mailbox access". All domain admins could still open every mailbox.

I then added the deny "send as" and "recieve as" permissions on through system manager and it has worked. Not sure if I wasn't waiting long enough?

Is there anyway that I can give the domain administrator full mailbox access if it is a member of domain and enterprise admins? Its weird that the deny permissions don't take priority with me as I am a domain admin but if I had myself, I can open all mailboxes.

< Message edited by chrishayward -- 7.Sep.2007 8:29:26 AM >

(in reply to ismail.mohammed)

Post #: 12

RE: Grant "Administrator" access to all mailb... - 10.Sep.2007 3:17:09 AM

ismail.mohammed

Posts: 2334
Joined: 9.May2007
From: India
Status: offline

hi,

In my real time scenario i use to create one mailbox who is not part of any groups says EXMERGE and will give him full exchange administrator rights and will remove the deny option. This should work. but i don't know whether i have suggested you with this option.

(in reply to chrishayward)

Post #: 13