thenrich
asked on
Microsoft Exchange User permissions
In Microsoft Exchange Server Manager I'm setting up a new user and am setting permissions in under the security tab. What happens is after a 1/2 hour or so those permissions disappear back to the original settings.
Anybody have any ideas?
Anybody have any ideas?
dmwynne
Have you tried using the delegate permissions wizard?
ASKER
No I have not. I will give it a shot.
What permissions are you setting?
If the user is an administrator or a member of another protected group then Exchange will remove some of the permissions by default. That is what it sounds like you are seeing.
Simon.
If the user is an administrator or a member of another protected group then Exchange will remove some of the permissions by default. That is what it sounds like you are seeing.
Simon.
ASKER
Yup I'm an admistrator and am trying to setup BESAdmin for my blackberry account. But for whatever reason after a 1/2 hour or so BESAdmin is removed.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Here is what is going on:
If you change the rights or the permissions on the adminSDHolder object for a protected account, a background task will undo the change within several minutes. For example, if you grant the Send As permission on a domain administrator object for an application service account, the background task will automatically revoke the permission.
Therefore, you cannot grant the Send As permission to an application service account for an account that is protected by the adminSDHolder object unless you change the adminSDHolder object itself. If you do change the adminSDHolder object, the access permissions for all protected accounts will change. You should only change the adminSDHolder object after a complete review of the security implications that may occur with the change.
If you change the rights or the permissions on the adminSDHolder object for a protected account, a background task will undo the change within several minutes. For example, if you grant the Send As permission on a domain administrator object for an application service account, the background task will automatically revoke the permission.
Therefore, you cannot grant the Send As permission to an application service account for an account that is protected by the adminSDHolder object unless you change the adminSDHolder object itself. If you do change the adminSDHolder object, the access permissions for all protected accounts will change. You should only change the adminSDHolder object after a complete review of the security implications that may occur with the change.