Where in Exchange 2003 does "Allow Full Mailbox Access" is set?

[sharapov]

Hello,

I know that by default in MS Exchange 2003 Domain Admins and Enterprise Admins are exchange 2003 explicitly denied access to "Full mailbox access" My question is where is this explicit setting set?


I know how to overwrite it on server, information store and mailbox levels, but I want to find out where this explicit "Deny" is set. Can anybody help?

Thanks

 

[PuzzledUNIX]

use an exchange system manager, expand all the views, find default exchange server name right click -properties-security. Make sure that you understand what you are doing with rights (send as , recive as -especially).

I hope it helps,
Sam.

 

[sharapov]

Sam,

Thanks for the advice, but setting that you are talking about won’t do what I was asking for. Although you can create an account (that is not part of Domain Admins or Enterprise Admins groups) and explicitly assign "Send as" and "Receive as" permissions to it inside default exchange server it’s not good enough. What if you have several servers that you need to manage in the domain? You will need to set this setting for every single server. To set this setting you actually have to dig deeper. I just figured out where this setting is set. You can't change it using ADUC or Exchange System Manager. You have to use ADSI tool to change explicit "Deny" permission (under Send as" and "Receive as" settings) in the Exchange Object for Enterprise or Domain Admins to change this default setting and allow Enterprise or Domain Admins to have full control over any mailbox for the domain.

Thanks.
Sharapov