To quote the resource kit (or Technet somewhere) regarding Admin groups...
"Windows 2000 sets the value of "Allow inheritable permissions from the parent to propagate to this object" to FALSE to avoid security issues stemming from elevation of privilege attacks. For example, if Group X is made a member of the Administrators group and someone left Access Control Lists (ACLs) on Group X such that Group Y can modify the group, members of Group Y could make themselves a member of Group X and transitively become a member of the Administrators group." -----Original Message----- From: Michael Semiglia [mailto:[EMAIL PROTECTED]] Sent: 06 June 2002 21:04 To: Exchange Discussions Subject: Delgating access to domain admins in exchange 2000 Hi all, I am trying to allow the account operators group to manage exchange 2000 user objects in the domain admins group. I have it working for all the other users. Some of the issues I am having is that the account operators group can modify the exchange specific attributes due to the fact that they are also exchange administrators in system manager, however, anyone in the domain admin groups is greyed out. This stops them from creating a mailbox, changing the display name, deleting the mailbox and removing the exchange attributes. I tried delgating the users container in the AD, however, the permission inheritance seems to be blocked on the domain admins group object. If anyone has any ideas that would be great. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] This e-mail (and any attachments) is confidential and may contain personal views which are not the views of the BBC unless specifically stated. If you have received it in error, please delete it from your system, do not use, copy or disclose the information in any way nor act in reliance on it and notify the sender immediately. Please note that the BBC monitors e-mails sent or received. Further communication will signify your consent to this. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
