• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Problem with permissions in AD for "Domain Admins".

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 2000] >> Server Security >> Problem with permissions in AD for "Domain Admins". Page: [1]
Login
Message << Older Topic   Newer Topic >>
Problem with permissions in AD for "Domain Admins&... - 7.Dec.2003 8:34:00 AM   
JohnnyS

 

Posts: 2
Joined: 7.Dec.2003
From: Toronto, Ontario
Status: offline
Hi, all.

According to Q292509: "administrators and domain administrators are specifically denied Receive As and Send As permissions", where the permissions are found on a users' mailbox. These permissions are inherited from a parent object.

Instead of just overriding the permission entries that enforce this restriction, the previous Exchange 2000 administrator completely removed them, without writing down what he did. I'd like to put them back so I'm back to a "default" security configuration and the auditors stop making a fuss.

Can anyone tell me what parent object in AD has these permission entries applied so they get inherited down to the mailboxes? That way I can put them back in the right place.

Note: I think the object to put the permission entry to deny "Receive As" and "Send As" is the Exchange Organization container object at:

distinguishedname: CN=ExchangeOrganization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=mycompany,DC=com

Also, I think the correct way to change the permissions is to load mmc with the ADSI Edit snap-in, then navigate to CN=Configuration,DC=mycompany,DC=com and then drill down to the Exchange Organisation name. Check security and do the changes.

Can someone PLEASE confirm this is the correct AD object to apply the "deny" permission entries for "Receive As" and "Send As" for Administrators and Domain Admins?

I posted this on the newsgroup "microsoft.public.exchjange2000.general", but no-one replied. So hopefully there are more clueful people here!

TIA,

JS
Post #: 1
RE: Problem with permissions in AD for "Domain Adm... - 8.Dec.2003 6:03:00 AM   
JohnnyS

 

Posts: 2
Joined: 7.Dec.2003
From: Toronto, Ontario
Status: offline
Never mind. I figured it out by installing a test server, and checking the rights. The info in the parent post is correct.

(in reply to JohnnyS)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 2000] >> Server Security >> Problem with permissions in AD for "Domain Admins". Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter