Exchange Server 2000

I have a question for the people out there. I have an issue with my exchange server at work. There is a problem now that all the domain admins in my active directory scheme can view everyone's email box and view every folder. Is there someway that I can stop this from happening. There is a major permission problem somewhere and I can't figure out where. I have gone to Microsoft's website and found nothing. So I was hoping that the brilliant minds that search this site might be able to help me out.
Much thanks,

Not Realy... Domain Admin have all the right! They can view anything they want! Even the President Email and personnal lfile if they want! :)

That's what I thought too but the domain admins didn't have the access to it before. Myself and my boss are the only domain admins. I don't care about having the access but he does so I was just wondering if there was a way to make it so that it doesn't happen.

I believe what we did was remove the permission of the Admins from the mailboxes of the users on the M drive.... You can always go ahead and add them back if you need to. I'd test that with a dummy mailbox first though.... The old brain cell isn't what it used to be.

They didn't have access because that is the dafault in 2000.... someone changed it.

Here is some info from technet....

Exchange 2000 tightens the site service account loophole considerably; the site service account no longer exists, and the Administrator account and the Domain Admins and Enterprise Admins groups are explicitly denied access to individual mailboxes. (See the Microsoft article "XADM: How to Get Service Account Access to All Mailboxes in Exchange 2000" at http://support.microsoft.com/default...262054&sd=tech for instructions about how to give snooping power to a designated account.) You can also use message journaling in Exchange 2000.

//edit I am thinking you can reverse engineer what is stated in the article...? I am with Tiger, I would make a backup and test a dummy account. Too many sleepless night with exchange....

Thanks for that info I'll have to try those things and see what happens. Thanks for taking the time to write something in.
JP

Just a thought, this sight might help you.

http://www.labmice.net/ActiveDirectory/default.htm

Than again may be not, GOOD LUCK!!


Nightfalls_Girl

Thank you for putting those links there I'll see if they help. Thanks a bunch!

Thank you for that site once again Nightfalls_Girl that was a really great site with helpful stuff on it I really appreciate your help.
JP

Holy ****, NFG was actually helpful. ALERT THE PRESS.

Quote:

---

Originally posted here by Drunk On Duvel
Holy ****, NFG was actually helpful. ALERT THE PRESS.

---

ha ha ha its not allways this rair


Nightfalls_Girl

In a best practive environment there should never be two domain admin accounts...
The only way you should use the domain admin account is in 'run as' mode.

It sounds like you and your boss both want to have the 'keys to the kingdom'.