Solved

ACL Inheritance on Exchange 2003 Servers

Posted on 2011-03-09
6
789 Views
Last Modified: 2012-05-11
We are in the process of transitioning from Exchange 2003 to 2010 and are having a permissions issue.  So far, we have installed 2 CAS/HUB servers into the organization and the temporary routing groups have been automatically created.  The problem is, our 2003 servers do not inherit permissions from above (for an unknown reason) and the new permissions for groups "Exchange Servers" and "Exchange Trusted Subsystem" are not present on any 2003 server.

We are afraid of just clicking the inherit permissions checkbox fearful that something will stop working.  My question...is there a tool out there that will allow us to easily compare ACL permissions between parent and child?  I was able to use dsacls to export but that is going to take a lot of sifting through.  Or would it just be easier to add the new 2010 groups to each server node?  I do see "Exchange Trusted Subsystem" has Full Permission and "Exchange Servers" have read and extended rights.  Are there any other permissions to note?
0
Comment
Question by:msCCare
  • 4
6 Comments
 
LVL 37

Expert Comment

by:Neil Russell
ID: 35087366
Although this guide covers a LOT more than just the 2003 to 2010 migration it is a very very guide guide to how to move from 2003 to 2010.

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2881-Migrate-Small-Business-Server-2003-to-Exchange-2010-and-Windows-2008-R2.html

Read it all, mainly from section 6 for exchange and make sure you followed ALL the right steps
0
 
LVL 1

Author Comment

by:msCCare
ID: 35087826
Thanks, that is a great document, but the issue still remains that we have permission issues on our 2003 server objects.  We already ran all prerequisites, schema updates, and installed 2 CAS/HUB servers.  Apparently, the Exchange 2010 install does not check for these permissions prior to installing.
0
 
LVL 12

Expert Comment

by:Navdeep
ID: 35094217
You can use tool called dumpsec or user powershell command

get-acl -path x:\folderName\files.txt | FL AccessToString

To get the acl on the folder or file
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Accepted Solution

by:
msCCare earned 0 total points
ID: 35148179
i was able to resolve this by adding "Exchange Trusted Subsystem" and "Exchange Servers" to have full permission to the objects in question
0
 
LVL 1

Author Comment

by:msCCare
ID: 35148193
Resolved on own
0
 
LVL 1

Author Closing Comment

by:msCCare
ID: 35178761
Resolved on own
0

Featured Post

Free book by J.Peter Bruzzese, Microsoft MVP

Are you using Office 365? Trying to set up email signatures but you’re struggling with transport rules and connectors? Let renowned Microsoft MVP J.Peter Bruzzese show you how in this exclusive e-book on Office 365 email signatures. Better yet, it’s free!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video discusses moving either the default database or any database to a new volume.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now