[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 912
  • Last Modified:

Outlook 2003 - delegating calendar access to entire company using AD group - cannot get to work.

Management had requested that everyone in company be able to see everyone else's calendar.
This has been achieved by previous staff by using delegate of EVERY user and granting access individually  to every other company staff member.

So if you look at the delegates list for one user, they have every other company user listed there
As you can imagine this makes for a management headache.

On learning this I thought, surely rather then add each company member to the delegate list why don't you just add a group (e.g. ALL-IN-COMPANY)

However when I done an experiment I could not actually get this to work. Therefore I took my user in AD, removed all the individual delegates that had been granted permission to my calendar and added the group "ALL-IN-COMPANY".

However when ever I added this and then went back to it, I found the permission for calendar had been set back to "none"

I checked out the group "ALL-IN-COMPANY" in AD and I see that it is a "Distribution Group - Global"

My question is why can't a grant the group "All-IN-COMPANY" permission to view / edit my calendar?

Do I have to do something special to the group or does this indicate a problem?

Thanks for any input.
0
afflik1923
Asked:
afflik1923
  • 8
  • 4
  • 3
4 Solutions
 
wpathanCommented:
You can't give permissions to a distribution group - only to security group.
Just change the group type in the AD (in the group properties from Distribution to Security) and then try.
Hope this helps.
0
 
afflik1923Author Commented:
Thanks for this. Are there any other implications of changing the group type I shold be aware of. I will Google but might as well as what is the difference from the group types other then a distribution group I assume if purely for the purposes of emailing a mass of people.
0
 
afflik1923Author Commented:
Also in going into AD the option to change it into a Security group is greyed out. What could that mean?

I did not originally setup this server.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
wpathanCommented:
Security groups are groups that can be assigned permissions to resources or rights to perform certain tasks. Security groups can be mail-enabled and be used for addressing mail by Exchange Server recipients.

Distribution groups are groups that are not security principals; they have no security identifier and thus cannot be assigned any rights or permissions. Distribution groups are intended for use with a mail system that integrates with Active Directory, such as Exchange Server. There is a subset of distribution groups called a query-based distribution groups (QBDGs); a QBDG's membership list is dynamic based on some criteria the administrator defines.



0
 
MesthaCommented:
What version of Exchange is this?
What mode is your Windows domain in, and what mode is the Exchange org in?

Simon.
0
 
afflik1923Author Commented:
Exchange 2003, Server 2003.

Not sure what mode domain is in? How do I know. Also not sure what mode Exchange org is. Again how can I tell?

Thanks!!
0
 
wpathanCommented:
if a distribution group containes one or more contacts - it can't be converted into security group.
Try creating a new security group and assign permissions to this group.
0
 
MesthaCommented:
Right click on the Exchange org at the top of the tree and choose Properties. That will tell you the mode of Exchange.

For the domain, similar thing but in ADUC.

Simon.
0
 
afflik1923Author Commented:
Exchage mode:
Mixed Mode (can support pre-Exchange 2000 Servers)
Not sure why actually as we only have one exchange server - perhaps they did migrate to this however.

Not sure I found the right place for the Windows Server but maybe
"Windows 2000 mixed" would be what your after.

would this explain why when thye log onto the domain from a PC it shows the short version of the domain name.

Another topic so no advanced answer needed but would performance benefit from moving over to an 03 mode only - or more effort then it's worth?

0
 
afflik1923Author Commented:
Another thing.

Is it possible that if the company moved from having a big list of delegates listed (one for each member of staff) in everyones delegate list. To having eeryone just delegate access to a sinlge security group, performance could be improved in any way?




0
 
afflik1923Author Commented:
One final related question. How comes some of the existing security groups have a row of exchange related tab options and other do not.
How does one define the difference when setting up a security group?
Only the ones with the exchange tab seem to show up in the list of available delegates.

0
 
MesthaCommented:
The two settings that you have flagged are how Exchange comes up by default. If you have no older versions of Exchange I would certainly switch to native mode. For the domain, again if you have no older versions of Windows in the forest, switch it up.

There is no performance gain, but the group behaviour is changed slightly.

Unless the groups are created on a server with Exchange system tools installed they will not be mail enabled. If you have no tabs on them then they are not mail enabled.

Are you sure that it is delegates that you want to set, and not just permissions on the Calendar folder so that everyone can see the contents? If it is just permissions to view, then grant the permission to your "All Staff" security group equivalent.
Personally I create all groups as Security groups, then I can use them for permissions as well as distribution.

Simon.

0
 
afflik1923Author Commented:
Ok all good stuff.
Rearding:
"Are you sure that it is delegates that you want to set, and not just permissions on the Calendar folder so that everyone can see the contents? If it is just permissions to view, then grant the permission to your "All Staff" security group equivalent."

No I'm not sure. They way it is currenlty acheived is
Tools-> Options-> Delegates (Tab)
Thn adding the user to the list and setting it so they have rights to view, edit and etc.

I think the way you have suggested (which I am not familar with anyway) just gives permission to view, right?

Thanks.
0
 
MesthaCommented:
Delegates is more than just viewing the content, with the relevant permissions it can allow users to do other things, including getting calendar requests. I don't actually recommend using delegates for this kind of permission. If it is just calendar access that you want to grant, then that is best done on the calendar folder itself, with the basic permission (Reviewer most likely) given to the equivalent of All Staff.

I have outlined a method for making the required permission change globally here:
http://www.amset.info/exchange/folderpermissions.asp

Simon.
0
 
afflik1923Author Commented:
Great input. Security group now created and seems to do the trick.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 8
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now