Exchange Server Forums

"Send As" setting disappearing from AD

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> General >> "Send As" setting disappearing from AD

Page: [1]

Message

<< Older Topic Newer Topic >>

"Send As" setting disappearing from AD - 27.Jun.2006 4:07:38 AM

SDickson

Posts: 2
Joined: 27.Jun.2006
Status: offline

I need to setup "Send as" for my Managing Director's assistant to send emails as him (without the "Sent of behalf" stuff).

I get this to work by going to the AD, properties of the MD, Security Tab and add the assistant with the "Send as" rights allowed.

This works fine.

Problem is....a few hours later it stops working and if I go into AD, the setting has been removed.

Has anyone got any idea what the hell is going on??????

Post #: 1

Featured Links*

RE: "Send As" setting disappearing from AD - 27.Jun.2006 4:46:36 PM

uemurad

Posts: 8232
Joined: 7.Jan.2004
From: California, USA
Status: offline

Sounds like it could be an AD replication issue. How many domain controllers do you have in your environment?
Also, one of the recent patches (a.k.a. MS security update MS06-019) removes the manually added "Send As" settings. Was it applied to all of your Exchange servers?

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange (2007-2011)
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to SDickson)

Post #: 2

RE: "Send As" setting disappearing from AD - 27.Jun.2006 8:11:29 PM

sabel9579

Posts: 481
Joined: 4.Apr.2006
From: USA
Status: offline

It could also be that the user is a member of a "protected group" which is handled by the adminSDHolder object in AD. In a nutshell if you try to modify the permissions of a user who is protected by the adminSDholder the background process that runs on the DC's will replace what you do with the default set of perms. Was or is this user a member of any special groups (administrators, print operators, etc...)

Here is an article that might help you as well if this is the case.

http://support.microsoft.com/kb/907434/en-us
http://support.microsoft.com/kb/817433/

(in reply to uemurad)

Post #: 3

RE: "Send As" setting disappearing from AD - 28.Jun.2006 12:52:01 AM

SDickson

Posts: 2
Joined: 27.Jun.2006
Status: offline

Guys,

Thanks for your prompt replies....very impressed.

Unfortunately, neither of these seems to fit. The AD is replicating fine. And we have another user setup with the same functionality and it works fine, so no patch has killed the ability to do this.

We also have no protected objects setup and the user is not a member of any groupd that would override her settings. She only has group access to mailing lists and a departmental group for security.

Anyone else go an idea?

(in reply to sabel9579)

Post #: 4

RE: "Send As" setting disappearing from AD - 28.Jun.2006 4:02:59 PM

Richard Fleming

Posts: 85
Joined: 24.Oct.2002
From: Toronto, ONT [Canada]
Status: offline

I know exactly what's going on.

It sounds as if the 'MD' is a member of the Domain Admins group. The Domain Admin group (as well as a few others) are all a part of a container called AdminSDHolder. This container acts as a template to it's members and will remove permissions that aren't a part of it. Microsoft does this as a protection mechanism for those with Administrative privileges in the case that someone deletes important permissions effectively making the account useless. After around 15 min, all objects are checked and are brought back to what's in the AdminSDHolder container.

I discovered a means to add send as permissions to the AdminSDHolder container, but in your case I'm afraid that it will give the MD's assistant send as permissions to ALL members of the AdminSDHolder group. I don't think that's what you want :) If you do want that command, lemme know... I'll post it.

Rich

(in reply to SDickson)

Post #: 5

RE: "Send As" setting disappearing from AD - 29.Jun.2006 3:13:13 PM

sabel9579

Posts: 481
Joined: 4.Apr.2006
From: USA
Status: offline

Using this command you can dump all of the users protected by the AdminSDHolder object. I would recommend you do this and see if the user is in this list. If they are then this is your issue

ldifde -f Admincount-1.txt -d dc=your domain -r "(&(objectcategory=person)(objectclass=user)(admincount=1))"

(in reply to Richard Fleming)

Post #: 6

RE: "Send As" setting disappearing from AD - 29.Jun.2006 3:16:23 PM

sabel9579

Posts: 481
Joined: 4.Apr.2006
From: USA
Status: offline

As a follow up to my previous post if the user is in this list but is not a member of any "Protected Group" there is a script that Microsoft has that will remove this. Once run you should then be able to add the "send as" perms back.

(in reply to sabel9579)

Post #: 7