|
That's correct. Domain admins are denied those.
What happened if you created a new account?
When i
log in as their admin of their domain, i see nothing.
when i
log in as an admin into my domain, i see everything.
in my
domain, the admin account has full exchange rights.
the
same for their domain.
yet,
they see nothing, not even the org.
i
think the restriction for domain admins in exchange is "send as" "recieve
as", and "full mail box rights" are explcitly or implicitly(depending on the
location in the tree) denied so domain admins can't open up and read
everyones mail in the org or ag.
thanks
You can see that they have full Exchange Admin Rights on
their AG and when you log in as one of them (is this correct? I've been
going back over the thread and it's not clear if you have the problem from
your domain or when logged in as an admin in their domain locally or what?)
you can't see the details of the server? I think that's what you're
saying.
Try this: Create a new user in that child domain
and delegate full exchange permissions to it. Don't make it a domain
admin. Let replication occur and then log in locally to that domain as
that new user. What were the results?
I'm wondering if there isn't some other restriction going
on for the domain admins group (by default, domain admins will be restricted
in some ways to prevent them from overrunning the Exchange org, but....
Maybe something could have happened?)
-ajm
no. they cannot see any AG or the ORG in exchangeMan.
In asdiedit, they can only see the org.
what i'm saying is, if from my domain i can see they have full
exchange admin rights on their AG, why can't they see it?
where should i look? what are they missing and most importantly, why
would it change sudddenly?
-----Original Message-----
From: Mulnick, Al
[mailto:[EMAIL PROTECTED]
Sent: Thu 4/15/2004 5:24 PM
To: [EMAIL PROTECTED]
Cc:
Subject: RE: [ActiveDir] moving domain
admins
Would you expect them to see the details without rights at
the Exchange
level? I wouldn't. I'd expect that they can see
that there is another AG,
but not have rights to do anything with it by
default. Domain admins has
nothing to do with Exchange rights per
se.
Even in the config container, they shouldn't have too many
rights unless
you've granted them.
-----Original
Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 4:53 PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
Correct.
Why is it when in look into the AG from
exchangeMan in my domain, I see that
their domainAdmins have full
exchange rights?
Yet, they can't see any AG or even the Org in
exchangeMan? And in adsiedit,
they can only see the ORG in the config
container.
Seems very strange. Someone had to have done something and
it would have to
be someone with enterpriseAdmin rights which no one has
in that domain.
Are you sure a misconfigured exchange 2003 server
could not do this?
What could?
thanks
-----Original
Message-----
From: Mulnick, Al [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 4:36 PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
So to summarize, you can't see details in their AG and they
can't see
details in your AG? That about right?
Sounds like
you need to redelegate the permissions to the AG, but I'm
guessing.
It's tough to get a read on the situation over time :)
Seems odd
though.
-----Original Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 11:39 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
yes they are mixed with the latest hotfixes.
they have all
rights on their AG except send as and recieve as.
on the org, they are
not listed, except of course their exchange domain
servers group. same as
us, and we see everything.
further info- the root domain in the
forest is in win2k native mode.
they
are running one exchange2003
server on a win2k box.
thanks
-----Original Message-----
From:
Mulnick, Al [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 11:28 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
Are both child domains at SP3&4 mixed? Any
hotfixes?
I do know that e2k3 does work with permissions on the first
install.
But if
you have perms in the one child domain and not the
other, that doesn't sound
like the issue directly. Sounds more like
an Active Directory issue or some
change that was made that nobody told
you about/realized was made.
Can you double check the permissions on
the ORG and AG's?
-----Original Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 10:42 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
child domains are at sp3 and sp4.
exchange2k sp3
child
domains were not prepped
-----Original Message-----
From: Mulnick,
Al [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 9:55 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
What version is the child domain at (sp level of Windows
DC?) and were the
child domains domain prepp'd?
Were both child
domains treated the same?
-----Original Message-----
From:
Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 9:13 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
they moved it to another ou that has no group policy applied
to it. i moved
it back, still the same.
i don't think it has anything
to do with moving the group anymore.
we are a multi domain win2k forest.
the root domain is in win2k native mode,
every other domain is mixed. we
are in exchange2k native mode, though i
think ther is a exchange2003
server in the root domain now.
thats all that has been changed
this
specfic domain is the only one with an issue.
hope that helps a
little
-----Original Message-----
From: Mulnick, Al [mailto:[EMAIL PROTECTED]]
Sent:
Thursday, April 15, 2004 9:03 AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
Well, let's backup. Where and why did they move the
domain admins group?
Can you move it back and see if your issue gets
resolved?
-----Original Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Wednesday, April 14, 2004 4:25 PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
I see nothing strange in ldp and no replication errors in
event log or rep
monitor.
I think its a permissions issue but i have
nowhere to begin looking and as
far as i know nothing has been changed.
They don't really have an IT dept(we
admin them) so no one would even
know how to change something anyway.
I can see the server and admin group
using enterprise manager from my domain
just not theirs(where the server
is located). However when i try to access
the directory tab of the
server, i get "information about directory services
could not be entirely
obtained. make sure exchange management service is
running". exchange
management service IS running.
very strange indeed.
any other
thoughts, tips?
thanks
-----Original Message-----
From:
Mulnick, Al [mailto:[EMAIL PROTECTED]]
Sent:
Wednesday, April 14, 2004 3:38 PM
To:
'[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] moving domain
admins
If you open it up in LDP, what do you see (authenticated
of course)?
Is it possible that there's a replication issue?
Have you checked the logs
of the domains to see what's logged when you
attempt to connect?
Just where did they move the domain
administrators from/to? Just from
cn=users to something
else?
Al
-----Original Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Wednesday, April 14, 2004 2:01 PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] moving domain
admins
another labyrinthine cross post(sorry)-
Also, i fire up
adsi edit from their domain and i can only get to the
organization in the
config partition. when on go to the security tab, there
are no
entries.
how can they just lose permissions to certain parts of the
config
paritition? the only change made was the root domain of the forest
installed
exchange 2003, but i doubt that had anything to do with.
i'm
very puzzled.
-----Original Message-----
From:
Mulnick, Al [mailto:[EMAIL PROTECTED]]
Sent:
Wednesday, April 14, 2004 1:16 PM
To:
'[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] moving domain
admins
Heck of a cross post, isn't it?
Moving the domain
administrators group is not something that should cause
this type of
issue.
What else was done during those
changes?
-----Original Message-----
From: Kern, Tom [mailto:[EMAIL PROTECTED]]
Sent:
Wednesday, April 14, 2004 12:45 PM
To: Admin Issues (E-mail)
Cc:
ActiveDir (E-mail)
Subject: [ActiveDir] moving domain admins
I
know moving the default exchange groups out of the users folder can
screw
things up as exchange expects to find them there, but will moving
the domain
admins from the users folder into another ou(no gpo applied)
screw things up
with exchange or any other services in ad?
I only ask
because some admin in another domain moved this group and now
when i open
exchange manager in their domain, i can't see the servers or any
admin
groups. i'm running exchange manager as their administrator account
and
thier domain admins have full exchange rights on their admin group.
other
than that exchange is functioning normally.
thanks
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List
info : http://www.activedir.org/mail_list.htm
List
FAQ : http://www.activedir.org/list_faq.htm
List
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
|
