Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Best practice for Exchange Administration Delegation

Posted on 2008-10-31
3
Medium Priority
?
655 Views
Last Modified: 2012-08-14
I'm reading about DST patch applied to the Exchange Server 2003 and how it can cause the mailbox store to unmount among other things. I'm reading that control should be delegated to a non-ambiguous user. I'm on the mail server where it was instructed I should go to the server, right-click and choose delegate control which brings up the Exchange Administration Delegation Wizard. The two accounts I see there are these:

<domain-name>\Administrator
<domain-name>\Backup

I have two questions. I see this entry on the MS page of unacceptable SID's:

SID: S-1-5-domain-500
Name: Administrator
Description: A user account for the system administrator. By default, it is the only user account that is given full control over the system.

I'm guessing this is the \Administrator account I see listed. Is it?

My other question if it is. If I remove it and assign a newly created specialized group for control and add this account to the group, will I be in the clear as far as avoiding this problem?

Oh, and is there anything else I should consider before making this move?

 
0
Comment
Question by:numb3rs1x
  • 2
3 Comments
 
LVL 5

Expert Comment

by:madhusk
ID: 22857197
Hi,

You have 3 types of Accesses
1.Exchange Full Admistrator
2.Exchange Administrator
3.Exchange View Only Administrator.

Exchange Full Administrator will have Exchange Organisation wide full control.
Exchange Administrator role best suits for day to day operations.
Exchange View only Administrators can only view all the objects.

Regards,
Madhu
0
 
LVL 5

Expert Comment

by:madhusk
ID: 22857217
The following link gives you the best picture of the Access types.

http://www.msexchange.org/articles/Understanding-Exchange-Access-Control-Administrative-Delegation.html

Regards,
Madhu
0
 

Accepted Solution

by:
numb3rs1x earned 0 total points
ID: 22927459
I answered my own question by running the update and therefore updating the store file. My mailbox store did not unmount after I applied the update, so the domain administrator account is not one of the accounts they mention as having a generic SID.

0

Featured Post

[Webinar] Cloud Security

In this webinar you will learn:

-Why existing firewall and DMZ architectures are not suited for securing cloud applications
-How to make your enterprise “Cloud Ready”, and fix your aging DMZ architecture
-How to transform your enterprise and become a Cloud Enabler

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you an Exchange administrator employed with an organization? And, have you encountered a corrupt Exchange database due to which you are not able to open its EDB file. This article will explain all the steps to repair corrupt Exchange database.
Are you looking for the options available for exporting EDB files to PST? You may be confused as they are different in different Exchange versions. Here, I will discuss some options available.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
Suggested Courses

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question