Yes. LauraEHunter is correct.
Microsoft has changed their default setting to denying access to users' mailboxes by default a couple of years ago. Enterprise admins and "Exchange admins" DO have the ability to change/overwrite that if required. This may be especially helpful for accounts that requires "send as permission" such as Blackberry or Goodtech service accounts.
I have been with companies where this is required, especially for SEC compliance issue you may have an officer of the company who may require such access. Also, although I am not 100% sure, these privilege may be needed if you would like to turn on Journaling, which is essentially another way to access other people's emails (although technically it is for conserving other user's data to prevent missing archive of deleted files).
I have also been with companies where everything is so "hush hush" that IT was demanded to lock themselves out of the system due to fear of information leakage. Keep in mind that IT can almost always get the information if they really tried, but the only "safety net" is that when they do it in this kind of locked down environment, they will most likely leave some kind of trace in the security logs or event viewer logs.
Main Topics
Browse All Topics
by: LauraEHunterMVPPosted on 2007-10-29 at 13:27:51ID: 20173006
Domain Admins in Exchange 2003 are denied access to other users' mailboxes by default.
It is a reality of any DACL-based system that Domain/Enterprise Admins have the potential to access everything and anything on the domain. At a certain point it becomes a personnel issue, not a technical one, in terms of running background checks and placing "Appropriate Use" policies in place (and then enforcing them.)