We help IT Professionals succeed at work.

DSACLS syntax to restore Everyone permissions?

bflack asked

I can no longer see my mailbox in Exchange.  After much Googling I realised it's because I deleted or Denied the Everyone group from the Security tab.

So I am trying to restore it using DSACLS (ADSI Edit doesn't let me) but having trouble with the syntax:

dsacls "CN=Mailbox Store (SERVER),CN=First Storage Group,CN=InformationStore,CN=SBS2003,CN=Servers,CN=first administrative group,CN=Administrative Group,CN=DOMAIN,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=local,DC=Everyone:GA"

Obviously I am replacing domain and server with their correct names.

But it keeps coming back with:
The specified domain either does not exist or could not be contacted.

Any ideas anyone?

Thanks, Brad.

Watch Question

How about?

dsacls "CN=Mailbox Store (SERVER),CN=First Storage Group,CN=InformationStore,CN=SBS2003,CN=Servers,CN=first administrative group,CN=Administrative Group,CN=DOMAIN,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=DOMAIN,DC=local" /G Everyone:GA


Thanks but it now comes back with:

The format of the specified domain name is inavlid.

I won't give you the exact domain name but say it was acme.local, I am putting in:

dsacls "CN=Mailbox Store (SERVER),CN=First Storage Group,CN=InformationStore,CN=SBS2003,CN=Servers,CN=first administrative group,CN=Administrative Group,CN=ACME,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=acme,DC=local" /G Everyone:GA
The following just worked fine for me using a test domain;

DSACLS "CN=Mailbox Store (EX2K7DC1),CN=First Storage Group,CN=InformationSto
re,CN=EX2K7DC1,CN=Servers,CN=First Administrative Group,CN=Administrative Groups
,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=OTH
ERDOMAIN,DC=Internal" /G Everyone:GA

If you are still having problems, look at the value of the "DistinguishedName" attribute on the "CN=Mailbox Store" object using ADSIEdit.msc. Just copy that in to the DSACLS command and it should work.


Can't actually get that attribute as it errors when I try to get the properties of CN=Mailbox Store (which is why I'm attepmting it throug DSALCS).

But I can over over it and see the distinguished name and I have put put it in exact as it is there.

Is there anything else I need to do - dismount the store, stop any services, logon as a different user etc?

Thanks, Brad.

What level of Administrator rights are you logged on with?

I was using an Enterprise Admin account in my test domain.


It has Domain and Enterprise Admin rights.

Hmmm I wonder if the tool can't see the object because the Everyone permission has been removed.

You could try running "domainprep" again. This resets permissions on Exchange related Active Directory objects.

Obviously make sure you have a backup of your AD before you do so :)


That would make sense but I thought that was the point of DSALCS; re-applying the permissions.

If I domain prep will that reset ALL permissions, not just on Exchange?  Ie on all shared folders etc - will I need to re-apply permissions on the mailboxes for every user?  What other implications are there?

It's an SBS box by the way, any other way of doing it?

If you are logged on using a Enterprise Administrator account and you still cannot view the object, then I would say that a "DomainPrep" command is the only way to go. You could try restoring the object from before the permission was removed, but I would try to "DomainPrep" command first.

The "DomainPrep" command will ONLY touch Exchange related objects in AD. It will not touch any shares or anything like that and, as far as I am aware, it doesn't remove any permissions. It just re-applies the default ones that were there the first time it was run.

I have had to run this command on my live domain some time ago because the RUS wasn't working properly. This didn't remove any of the custom permissions I had set anywhere.