Not sure if this is your issue, but when we originally set admin permissions for a special account on every mailbox in the store (back during E2k7 Gold), we had trouble with a few as well. Turned out that at one time or another the admindsholder was set on these accounts, and so they weren't inheriting permissions that were applied.
http://msmvps.com/blogs/UlfBSimonWeidner/archive/2005/05/29/49659.aspx I seem to remember we had to take it off or temporarily set it to inherit (depending on the actual account status) long enough for it to get the updated permissions. Seems like you should be able to manage an individual account permissions now though to override this, but I have not tested to see that it does. -B -----Original Message----- From: jesse-r...@wi.rr.com [mailto:jesse-r...@wi.rr.com] Sent: Wednesday, February 17, 2010 9:39 AM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue A followup... The user was/is already added to the Exchange-View Only group. This was done months back when 2007 was introduced as the user account (Account-A) in question is the account we use for Backupexec backups. I will give a try the commands you listed in the Blackberry link. Should be okay that it's stating those commands are for 2010, right? I'll let you know this afternoon how things go, when I'm on site and able to test. Original Message: ----------------- From: Michael B. Smith mich...@smithcons.com Date: Wed, 17 Feb 2010 17:15:55 +0000 To: ntsysadmin@lyris.sunbelt-software.com Subject: RE: Exch2007 permissions issue This is what you want to do: http://docs.blackberry.com/nl-nl/admin/deliverables/12142/Configure_Exchange _10_perms_for_Exchange_account_962758_11.jsp For Exchange 2007, change step 3 to "add user to 'Exchange View-Only Administrator' security group". Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Michael B. Smith [mailto:mich...@smithcons.com] Sent: Wednesday, February 17, 2010 12:08 PM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue More counterpoints. 1] Like I said - the command you show is wrong. But caching can prevent things from taking affect "immediately". 2] You didn't SAY you wanted to do it for every mailbox in the store! I'll go look up that command. But while I do, what mechanism did you use in OWA to attempt to access the other mailbox? Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: jesse-r...@wi.rr.com [mailto:jesse-r...@wi.rr.com] Sent: Wednesday, February 17, 2010 12:04 PM To: NT System Admin Issues Subject: RE: Exch2007 permissions issue Hmm. A few counterpoints. 1. I'm not sure the caching is the problem. We waited over 24 hours and the results was the same. 2. Your method would require me doing this for EVERY single mailbox in the store, surely the method as explain by GFI is easier?? (unless I'm not understanding you correctly?) Furthmore, if I go to Account-B and look at Manage Full Access Permissions, Account-A is already listed (because of the command I ran the other day from the command-line) Thoughts? Thanks. J Original Message: ----------------- From: Michael B. Smith mich...@smithcons.com Date: Wed, 17 Feb 2010 16:59:46 +0000 The Sunbelt Exchange forum is a great place to ask questions like this. :-) Regardless, the GFI instructions are wrong, at least as you've quoted them. The easiest thing to do is open the Exchange management Console, find Account-B, then click on "Manage Full Access Permission" in the Action pane, and give Account-A rights. And yes, you need to either "restart-service msexchangeis" or wait about two hours for the permissions cache to expire. No reboot required. In re: the Domain Admin question, explicitly assigned permissions override inherited permissions. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: jesse-r...@wi.rr.com [mailto:jesse-r...@wi.rr.com] Sent: Wednesday, February 17, 2010 11:53 AM To: NT System Admin Issues Subject: Exch2007 permissions issue Haven't had much help from other sources with this issue so I thougth I'd try here. Environment: Single Exchange 2007 server I need to be able to access another user's mailbox via OWA in order for this particular software (GFI Mail Archiver) to work properly. When I use Account-A to logon to OWA 2007, I try to access another user's mailbox (Account-B) and I receive this error: "You do not have permission to open this mailbox. For access or for more information, contact technical support for your organization. " According to the documentation from GFI, I am supposed to enter this from the Exchange 2007 command prompt: Add-ADPermission -Identity "Mailbox Database" -User "domain\UsernameJOE" -AccessRights GenericAll I did that... but when logged into OWA as UsernameJOE, the error still occurs when trying to access another user's email via OWA. Really stuck here and could use some help. Can someone tell me what I should try next? Single Exchange 2007 server with MBX/CAS/HUB roles. Note - since making that change, the Exchange server has not been rebooted (I dont think it needs to be?), and also, the user account in question is a Domain Admin (is this possibly an issue because of inherited deny permissions??) Thanks. J -------------------------------------------------------------------- myhosting.com - Premium Microsoft(r) Windows(r) and Linux web and application hosting - http://link.myhosting.com/myhosting ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web.com - Microsoft(r) Exchange solutions from a leading provider - http://link.mail2web.com/Business/Exchange ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web - Check your email from the web at http://link.mail2web.com/mail2web ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
