Exchange 2000 Problem

[Louie]

Here is the deal. We recently migrated Exchange 5.5 to Exchange 2000. All seemed well, until I tried to access other people's mailboxes. The users themself can retrieve their mail. I am in the Domain Admin Group. I used to be able to see everyone's mail . So I went into the mailbox rights and sure enough it says that Domain Admin can do anything he want's but the boxes have grey check marks. I tried to re-add the Domain Admins but it says I can't because it propogates from the parent object. I've been trying to find the parent object or a way to fix this, because sometimes I need to go into people's mailboxes to assign Delegates.

Anyone with a suggestion, I would appreciate your ideas.

[CXGJarrod]

Louie: If you have the rights you should be able to uncheck "Allow inherietable permissions from Parent to propagate to this object" Its been awhile since my exchange 2000 class, but I think there is a Exchange 2000 Admins Group. You might have to be part of that group to see the other persons email. You can PM me if you need more info. (I have my exchange book at home)

[Louie]

CXGJarrod: I tried that and it still wouldn't let me recreate the object.

[mohaughn]

Try this.

Open active directory users and computers. Then search for your account.

When you have the properties of your account open, click on the "Exchange advanced" tab. Then click on mailbox rights.

Once you have the mailbox rights box open, there should be an account called "Self." Make sure it is there. If it is not there, add it.

The self account should have the "Associated external account" checkbox checked. I also give it full mailbox access.

Do the same process for the mailbox you are trying to access.

If that does not work, reply back and I can work through your permissions. Exchange is my specialty..

Here is a queue article that explains what could be happening. This article is specifically talking about resource mailboxes. But i have seen this occur on regular mailboxes as well.

http://support.microsoft.com/default...;en-us;q278966

[Louie]

mohaughn: I see what the problem is now. And perhaps the best way around it is as follows. I am logged in as administrator, but administrator has Full Mail Box rights but is also denied full mail box rights later on. It's some funky inherited permission that I don't truley understand. It really shouldn't be like this, but even if I tell it not to inherit other permissions it still does.

[mohaughn]

That can definitely be an issue. Explicit deny permissions always override all other permissions.

If you are having a problem with inheritence that only thing I can recommend is to step through the different permissions and try to determine where in the inherited permissions are coming from. I hate digging through AD trying to determine where permissions are inherited from

[shkuey]

It's one of the great new "features" on exchange 2000. You have to be delegated, open the Exchange system manager snap-in, and right click on the root entry in the tree. Select delegate control from the drop down menu, and set up your access through the wizard. Since it propagates rights so haphazardly (read: seeming random) doing it manually is a bad idea.

[Louie]

Thanks guys all your advice was great. I assigned the server and fixed all the delegate access. I don't think I should have any more weird ass problems.

[mohaughn]

With exchange 2000 you should be expecting a lot more weird problems... Even though it is my bread and butter.. it is a crappy product... The first six months of this year were hell for me because of exchange 2000...

Microsoft says it will scale.. But we hit some serious memory issues when we got up above 8k subscribers per server...