Inherited Permissions and Exchange 2003

We upgraded from Win2k Domain Exch5.5 to Win2k3 Domain Exch2003.  Now I understand that the security and stuff is controlled from Active Directory Users and Computers (ADUC) now.  But I am experiencing a problem.

With Exch5.5 we could (locally on the mail server) open any users mailbox by changing the mailbox properties on the local outlook icon.  However with our new stuff we get 'access denied you do not have permission' even though we are logged in as a domain admin (=exchange admin).  

Looking in ADUC Exchange Advanced tab Mailbox Rights, advanced settings there is a deny line for 'Full Mailbox Access' for Domain admins, enterprise admins, Exchange domain servers  and Administrator.  IT's inheriting from someplace but I cannot figure out where.  There is no 'allow inheritance' checkbox to remove the inheritance like there is on file and folder permissions.

What gives?

wokwonAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

VahikCommented:
If u go to ur ESM mailbox store properties psge\security can u give urself or admins full control including send as ans recieve as?
0
wokwonAuthor Commented:
Well I *could* give send as and recieve as if i remove the inherititence from the mailbox store.  Will this allow 'Full Control' for admins to be applied for all mailboxes?  I don't want to be able to send as, I want to be able to open the mailbox in outlook from the server like I used to be able to in Exch5.5

Thanks for your suggestion.
0
VahikCommented:
Listen what the heck i am talking about.There should be an allow permission box so just check it.In 2000 and later that is by design and u should either enable it on individual basis or u go and give urself
full permission on the mailbox store.I misstook allow inheritance with allow permision box.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

VahikCommented:
Just go to the specific users properties page \mailbox right and give urself allow full mailbox permission and u will be able to do what u want to do.
0
wokwonAuthor Commented:
Bingo!  You are my hero.
0
VahikCommented:
wokwon in order for u to have full mailbox right to any mailbox store
u must give urself send as and recive as permission on that store.In certain situations u may need to have that right like when u want to use exmerge to export all the users from a certain mailbox store.anyways thanks and goodluck.
0
wokwonAuthor Commented:
"Just go to the specific users properties page \mailbox right and give urself allow full mailbox permission and u will be able to do what u want to do. " 

My problem was that the specific users properties page was inheriting from somewhere and I didn't know where.  As you said, it inherits from the information store.  In hindsight, that seems perfectly logical but previously had me stumped.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.