07 February 2012
Forums

Search our forums for the answers to your questions.

Further support options include the FAQs and Knowledge Base.

Note - Please login if you want to post to the forums.



CELCAT Timetabler Forums
Subject: Creating an AutoCAL service account in Exchange 2007
Prev Next
Topic is locked

AuthorMessages
SupportUser is Offline

Posts:77

09 Sep 2009 10:43 AM  

Extract from

http://technet.microsoft.com/en-us/library/bb310792.aspx

Q: I have a third-party messaging application that requires full access to each user's mailbox. With Exchange Server 5.5, we grant a special account the Service Account Admin permissions, and then tell the application to use this account. How can I achieve similar functionality in Exchange 2007?
A: Exchange 2007 security works differently from that of Exchange Server 5.5. In fact, Exchange 2007 does not use a site service account. Instead, all services start as the local computer account.
If your logon account is the Administrator account, a member of the root Domain Administrators, a member of the Enterprise Administrators groups, or a member of the Exchange Organization Administrators role, you are explicitly denied access to all mailboxes that are not your mailbox, even if you have full administrative rights over the Exchange system. All Exchange 2007 administrative tasks can be performed without having to grant an administrator sufficient rights to read other people's mail.

You can achieve the results that you want in the following ways, but do so only in accordance with your organization's security and privacy policies:

In the Exchange Management Shell, use the following command to allow access to all mailboxes on a given mailbox store:

Add-ADPermission -identity "mailbox database" -user "serviceaccount" -ExtendedRights Receive-As


In the Exchange Management Shell, use the following command to allow access to an individual mailbox:

Add-MailboxPermission -identity "user" -user "serviceaccount" -AccessRights FullAccess

CELCAT Addition to MS Link

In the Exchange Management Shell, use the following command to allow access to all mailboxes on a given mailbox store. Note: this command also allows inheritence for future accounts that are created:

Get-MailboxDatabase -server YourServername | add-adpermission -user YourAutocalService -accessRights GenericRead, GenericWrite -extendedrights Send-As, Receive-As -inheritanceType all

Jenny ChittendenUser is Offline

Posts:23

29 Oct 2009 12:44 PM  
Our Exchange administrators are (understandably) nervous about the level of rights which AutoCal needs in order to operate. I'd be grateful to hear from anyone using AutoCal with Exchange 2007, on or off list, about their experiences.
Thank you
Topic is locked
Forums > Using Timetabler Applications > Other > Creating an AutoCAL service account in Exchange 2007



ActiveForums 3.7


Privacy Statement  |  Terms Of Use
Copyright © 2011 CELCAT, All Rights Reserved