Exchange 2007 access restrictions
So is there a way for me to limit an admins access on exchange 2007 for just creating a mail enabled distribution group? If someone has a link or something, let me know. I don't know how far you can narrow down restrictions
Thanks
November 18th, 2010 12:31pm
To create new distribution groups, uses need:
Exchange Recipient Administrator role
Account Operator role for the applicable Active Directory containers
http://technet.microsoft.com/en-us/library/aa998856(EXCHG.80).aspx
To modify existing distribution groups, users need:
Exchange Recipient Administrator role
http://technet.microsoft.com/en-us/library/bb124955(EXCHG.80).aspx
Free Windows Admin Tool Kit Click here and download it now
November 18th, 2010 1:46pm
Just to add to Andy's post, while Account Operators gives you full control over group objects it is a bit of a blunt instrument and confers a number of additional privileges over other object types (including computer and user objects). The Account
Operators group and its members are also protected by the AdminSDHolder, which can sometimes cause confusion.
It might be better to create a separate AD group and delegate explicit permissions to that group to create group objects.Alexei
November 18th, 2010 2:35pm