Solved

Microsoft Exchange User permissions

Posted on 2009-05-04
6
221 Views
Last Modified: 2013-11-05
In Microsoft Exchange Server Manager I'm setting up a new user and am setting permissions in under the security tab. What happens is after a 1/2 hour or so those permissions disappear back to the original settings.

Anybody have any ideas?
0
Comment
Question by:thenrich
  • 3
  • 2
6 Comments
 
LVL 14

Expert Comment

by:dmwynne
Comment Utility
Have you tried using the delegate permissions wizard?
0
 
LVL 5

Author Comment

by:thenrich
Comment Utility
No I have not. I will give it a shot.
0
 
LVL 65

Expert Comment

by:Mestha
Comment Utility
What permissions are you setting?
If the user is an administrator or a member of another protected group then Exchange will remove some of the permissions by default. That is what it sounds like you are seeing.

Simon.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 5

Author Comment

by:thenrich
Comment Utility
Yup I'm an admistrator and am trying to setup BESAdmin for my blackberry account. But for whatever reason after a 1/2 hour or so BESAdmin is removed.
0
 
LVL 65

Accepted Solution

by:
Mestha earned 500 total points
Comment Utility
If you are an administrator and you are trying to set the permissions on your own account, then the behaviour you are seeing is expected. Microsoft made a change in the behaviour of the permissions that means that someone in a protected group (Administrators, Domain Admins etc) cannot have other permissions applied, they will be removed.

There is a very long MS article about this here: http://support.microsoft.com/kb/912918

Simon.
0
 
LVL 5

Author Comment

by:thenrich
Comment Utility
Here is what is going on:

If you change the rights or the permissions on the adminSDHolder object for a protected account, a background task will undo the change within several minutes. For example, if you grant the Send As permission on a domain administrator object for an application service account, the background task will automatically revoke the permission.

Therefore, you cannot grant the Send As permission to an application service account for an account that is protected by the adminSDHolder object unless you change the adminSDHolder object itself. If you do change the adminSDHolder object, the access permissions for all protected accounts will change. You should only change the adminSDHolder object after a complete review of the security implications that may occur with the change.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Email signatures have numerous marketing benefits. Here are 8 top reasons to turn your email signature into a marketing channel.
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now