Our Help Desk staff are the ones managing user accounts and mailboxes in Exchange 2003, e.g. creating accounts and mailboxes, granting Send As and Full Access perms to mailboxes. How can we continue that with Exchange 2007? What groups should they be in? I already added them to the Exchange Recipient Administrators, as well as the Account Operators group. They can't seem to grant Full Access perms for mailboxes. Granting Send As perms works fine. They are getting this error: Failed to commit the change on object "8eb0e701-d4ff-497d-99ab-7c994085b2fa" because access is denied. MapiExceptionNoAccess: Unable to set mailbox SecurityDescriptor. (hr=0x80070005, ec=-2147024891) I do not want to add the Help Desk to the Exchange Organization Admins Thanks...

Do a get-mailboxpermission on a mailbox they can't accessand see what groups have a deny and then cross reference that with groups they are apart of. You can also do a get-adpermission to see if they have a deny to some level of that AD object. Also beware of any nested groups inside groups that have an explicit deny.

Hello Gustavo,I just tested this in my test environment. You can run below command which gives "Administer Information Store" (ms-Exch-Store-Admin) rights to your helpdesk staffs that allow them to give full access rights to all users of your Exchange organization.Add-ADPermission -Identity "CN=CompanyOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=company,DC=com" -User "company\HelpDeskStaffs" -ExtendedRights ms-Exch-Store-Admin -InheritanceType AllReference:Recipient Permission Delegation in Exchange Server 2007 http://msexchangeteam.com/archive/2006/11/03/430350.aspx

Tks, Solved my problem

Would anyone know how to locate the CompanyOrg name through either ADSI EDIT or some other query?