Remove the ability for Domain Admins to read others email

[sxmont16]

We have an issue where we have 2 domain admins who need to have full domain admin access with the exception of the ability to read emails from other users.

Is there a way to restrict members of the Domain admins group the ability to read emails.

Server 2008

Exchange 2003

 

[58sniper]

By default, Domain Admins shouldn't be able to. If they can, that's been configured that way in your environment, and you'd have to undo that.

Start by reversing what's listed here:

http://www.petri.co.il/grant_full_mailbox_rights_on_exchange_2000_2003.htm

Just make sure you're not locking out those who support the Exchange environment.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[sxmont16]

Thank you for replying.

I followed the steps, but when I to into the Mailbox Store properties > Security Tab >

It is grayed out. And I can not remove Full control from the Domain Admins group.

When I go into Active Directory and I look at an individual's Mailbox Rights, I can not remove Full mailbox access from the Domain Admins because that is Grayed out.