Hi. The company I workhasExchange and ADseparated into 2 groups. The ADgroup is looking at limitingour permissions towards AD.I am curious what others have done about this and what permissions are actually needed to perform daily tasks. I currentlyuse elevated permissions a lot, including installing exchange servers, forcingAD replication, etc. Any thoughts guys?ThanksErik

No body has anything for me? What are other orgs doing or are we unique?

Hi Erik,Well, when you install/setup the Exchange first time it requires AD permission (Enterprise/Domain/Schema admin). At later stage, to manage or change the settings of Exchangeorganizationor server you need Exchange Server or Organization permission because when you run setup of Exchange it sets various predefined permissions on different containers of AD. http://technet.microsoft.com/en-us/library/bb310770.aspx About managing recipients at day to day operation you normally need Exchange Recipient Admin + Account Operator permissions. You may refer below references to split day to day administration of recipient at further level. http://technet.microsoft.com/en-us/library/bb232100.aspx http://technet.microsoft.com/en-us/library/bb430782.aspx Amit Tank || MVP - Exchange || MCITP - Exchange 2007 || http://ExchangeShare.WordPress.com

Hi, Besides Amits input, Id like to share article below with you: Permission Considerations http://technet.microsoft.com/en-us/library/aa996881.aspx Exchange 2007 Permissions: Frequently Asked Questions http://technet.microsoft.com/en-us/library/bb310792.aspx Regards, Xiu

Thanks guys. THis helps explains things better. Merry Christmas!Erik

Thanks Erik... You too... :)Amit Tank || MVP - Exchange || MCITP - Exchange 2007 || http://ExchangeShare.WordPress.com