No luck on this. I ran the commands based on your link for Blackberry. The first command resulted in:
[PS] C:\Windows\System32>Get-MailboxDatabase | Add-ADPermission -User GFITest -AccessRights ExtendedRight -ExtendedRights Receive-As, ms-Exch-Store-Admin Identity User Deny Inherited Rights -------- ---- ---- --------- ------ EXCHANGE\First St... SYSTEMS\GFITest False False Receive-As EXCHANGE\First St... SYSTEMS\GFITest False False ms-Exch-Store-Admin For the adding of the user with Exchange View Only, I accomplished that via the GUI interface instead. I could not get the third command to work at all. (results below) [PS] C:\Windows\System32>Add-ADPermission -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User GFITest -Identity "CN=Users,DC=mydomain,DC=com" Add-ADPermission : Active Directory operation failed on EXCHANGE.docksystemsinc .com. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-03152492, problem 4003 (INSUF F_ACCESS_RIGHTS), data 0 At line:1 char:17 + Add-ADPermission <<<< -InheritedObjectType User -InheritanceType Descendents -ExtendedRights Send-As -User GFITest -Identity "CN=Users,DC=mydomain,DC =com" [PS] C:\Windows\System32> For kicks, I tried logging on to OWA with "GFItest" user account, and I still can't open up other user's emails/ ARGH JR Original Message: ----------------- From: Michael B. Smith [email protected] Date: Wed, 17 Feb 2010 17:40:42 +0000 To: [email protected] Subject: RE: Exch2007 permissions issue Yes, still should be ok. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Wednesday, February 17, 2010 12:39 PM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue A followup... The user was/is already added to the Exchange-View Only group. This was done months back when 2007 was introduced as the user account (Account-A) in question is the account we use for Backupexec backups. I will give a try the commands you listed in the Blackberry link. Should be okay that it's stating those commands are for 2010, right? I'll let you know this afternoon how things go, when I'm on site and able to test. Original Message: ----------------- From: Michael B. Smith [email protected] Date: Wed, 17 Feb 2010 17:15:55 +0000 To: [email protected] Subject: RE: Exch2007 permissions issue This is what you want to do: http://docs.blackberry.com/nl-nl/admin/deliverables/12142/Configure_Exchange _10_perms_for_Exchange_account_962758_11.jsp For Exchange 2007, change step 3 to "add user to 'Exchange View-Only Administrator' security group". Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Wednesday, February 17, 2010 12:08 PM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue More counterpoints. 1] Like I said - the command you show is wrong. But caching can prevent things from taking affect "immediately". 2] You didn't SAY you wanted to do it for every mailbox in the store! I'll go look up that command. But while I do, what mechanism did you use in OWA to attempt to access the other mailbox? Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Wednesday, February 17, 2010 12:04 PM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue Hmm. A few counterpoints. 1. I'm not sure the caching is the problem. We waited over 24 hours and the results was the same. 2. Your method would require me doing this for EVERY single mailbox in the store, surely the method as explain by GFI is easier?? (unless I'm not understanding you correctly?) Furthmore, if I go to Account-B and look at Manage Full Access Permissions, Account-A is already listed (because of the command I ran the other day from the command-line) Thoughts? Thanks. J Original Message: ----------------- From: Michael B. Smith [email protected] Date: Wed, 17 Feb 2010 16:59:46 +0000 The Sunbelt Exchange forum is a great place to ask questions like this. :-) Regardless, the GFI instructions are wrong, at least as you've quoted them. The easiest thing to do is open the Exchange management Console, find Account-B, then click on "Manage Full Access Permission" in the Action pane, and give Account-A rights. And yes, you need to either "restart-service msexchangeis" or wait about two hours for the permissions cache to expire. No reboot required. In re: the Domain Admin question, explicitly assigned permissions override inherited permissions. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Wednesday, February 17, 2010 11:53 AM To: NT System Admin Issues Subject: Exch2007 permissions issue Haven't had much help from other sources with this issue so I thougth I'd try here. Environment: Single Exchange 2007 server I need to be able to access another user's mailbox via OWA in order for this particular software (GFI Mail Archiver) to work properly. When I use Account-A to logon to OWA 2007, I try to access another user's mailbox (Account-B) and I receive this error: "You do not have permission to open this mailbox. For access or for more information, contact technical support for your organization. " According to the documentation from GFI, I am supposed to enter this from the Exchange 2007 command prompt: Add-ADPermission -Identity "Mailbox Database" -User "domain\UsernameJOE" -AccessRights GenericAll I did that... but when logged into OWA as UsernameJOE, the error still occurs when trying to access another user's email via OWA. Really stuck here and could use some help. Can someone tell me what I should try next? Single Exchange 2007 server with MBX/CAS/HUB roles. Note - since making that change, the Exchange server has not been rebooted (I dont think it needs to be?), and also, the user account in question is a Domain Admin (is this possibly an issue because of inherited deny permissions??) Thanks. J -------------------------------------------------------------------- myhosting.com - Premium Microsoft(r) Windows(r) and Linux web and application hosting - http://link.myhosting.com/myhosting ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web.com - Microsoft(r) Exchange solutions from a leading provider - http://link.mail2web.com/Business/Exchange ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web - Check your email from the web at http://link.mail2web.com/mail2web ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web.com – Enhanced email for the mobile individual based on Microsoft® Exchange - http://link.mail2web.com/Personal/EnhancedEmail ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
