Solved

delegate a helpdesk users admin rights to create mailboxes on one exchange server only

Posted on 2006-07-21
19
680 Views
Last Modified: 2012-05-05
I have 5 exchange 2003 boxes on a single domain, I want to be able to delegate one of my admin guys the ability to create mailboxes only on his exchange box. I used the exchange delegation wizard to give him view only rights, but I noticed that he will have the ability to create mailboxes on the other 4 exchange boxes. how do I set it that he only can create mailboxes on his own server?

all my boxes are running Exchange 2003 with sp2 on win2k3
0
Comment
Question by:pauls13
  • 6
  • 6
  • 4
19 Comments
 
LVL 8

Expert Comment

by:bilbus
ID: 17166009
I beleve you need to be a local admin + delegate to be a local admin (or domain admin) of an exchange server (using delegation)

Read only admin just needs to be able to login to the server

I could be wrong but give it a try
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17166018
and you can set up permisions for the server via the security tab. (right click server name in ESA and choose properties)
0
 

Author Comment

by:pauls13
ID: 17166265
I have tried doing it this way using the delgate wizard but then it allows that user to create mailboxes on all the other exchange servers as well even with read only rights, i need them only to be able to create mailboxes on their exchange server only
0
 

Author Comment

by:pauls13
ID: 17166325
Hi bilbus

I have tried giving the user rights the user rights using the security tab in ESA but that allows the user to have complete control of the exchange server including the info store, I really just want the user to be able to create users without being able to have any admin rights for the exchange server
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17190872
hmm i will look for the correct spot
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17190875
You could give the user Deny permisions under advanced for all the other servers, but there needs to be a better way
0
 
LVL 8

Expert Comment

by:bilbus
ID: 17190915
ok, got something.

Is the helpdesk user a domain admin? if not, this will work.

Remove the user from being an administrator on the other exchange boxes. If they are not a local computer admins, they cant admin the exchange server even if they were delegated.

Make the helpdesk ppl only domain users on the exchange boxes, or even remove then completly (This can be done by runing computer management on the exchange servers you dont want them to touch)
0
 

Author Comment

by:pauls13
ID: 17191017
Ok this is what i have done, I have created a new user, and given that user view rights for exchange using the deligation wizard and added then to the local admin group on the Exchange which for the record is a member server. After running the wizard, i created a mailbox on the US server, but was also able to create mailboxes on my German, Denmark & UK boxes as well. the new user did not have any admin rights on the other exchange boxes but his own
0
Integrate social media with email signatures

Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

 
LVL 8

Expert Comment

by:bilbus
ID: 17209487
that does not sound right, is he a membe rof any other groups that have admin permisions?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 17212169
Have you split this Exchange org in to admin groups? If not, then that is something you should consider.

Simon.
0
 

Author Comment

by:pauls13
ID: 17213209
not sure what you mean could you explain?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 17222784
You can split the Exchange org up in to administrative groups. The default administrative group is where all the servers are currently set.
Create a new admin group and move the server in to it. Then right click on the admin group and choose Delegate Control. Run through the wizard, restricting access as required.

Simon.
0
 

Author Comment

by:pauls13
ID: 17222880
by creating a new admin group, will that have an effect on the way the org is currently set up?
0
 
LVL 104

Accepted Solution

by:
Sembee earned 500 total points
ID: 17222982
Admin groups don't play a part in the way that Exchange works. They provide the administrative boundaries to Exchange. You do have to make sure that the permissions are set correctly, but as long as you are accessing the server with an account that has Full Exchange Admin rights at the org level you should be fine.

This section of the Exchange 2003 Admin Guide covers Admin Groups.

http://www.microsoft.com/technet/prodtechnol/exchange/guides/E2k3AdminGuide/7958497b-3508-4247-9c80-7c6cf8839b09.mspx?mfr=true

Simon.
0
 

Author Comment

by:pauls13
ID: 17226290
how can i move a server to the new admin group?
0
 
LVL 104

Expert Comment

by:Sembee
ID: 17226441
The serves me right for posting just after I had woken up.
You can't move servers between admin groups. You would have to install Exchange on to a new server.

Simon.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now