Exchange 2010 and public folder security inheretence
I have installed a plain vanilla exchange 2010 rtm -> SP1 -> RU1 and created a new public folder database. I am logging in from a PC with Outlook 2010 logged on as administrator. I have attached a .pst file that is an earlier exported public folder
database from ex 2003. When trying to copy the folder hierarchy from the pst file to the Public folders within Outlook I get access denied errors. I have tried several things:
add-publicfolderadministrativepermission -user administrator -identity "\" -accessrights allextendedrights -inheritencetype all
When using PFDAVAdmin to replicate folder acl down the folder hierarchy I am able to fill a folder with items, but when creating a new folder it inherets the security setting from the public folder tree root. That is Default ->
none AND Anonymous - > none.
What am I missing here?
Regards
Henning
October 18th, 2010 6:27am
Rather than use administrator, manage Exchange with a regular mailbox-enabled account that has the necessary rights.
PFDAVADMIN does not work with Exchange 2010. Use ExFolders to replicate client permissions.
http://msexchangeteam.com/archive/2009/12/04/453399.aspx
Free Windows Admin Tool Kit Click here and download it now
October 18th, 2010 7:51am
I am using ExFolders to accomplish the replication, that was what I should have written.
Still, when creating new folders in the hierarchy it does not inherit rights from parent folder but from root of the public folder hierarchy hence only default - none AND anonymous - none.
October 18th, 2010 10:27am
How exactly are you creating these new folders?
Free Windows Admin Tool Kit Click here and download it now
October 18th, 2010 10:59am
Well, thats the point. I am not trying to create them rather let the copy process do the job by right clicking a root folder in the pst file that has a lot of content, selecting "copy folder" and pointing to the root of the public folder tree (or a sub folder
for that matter with the same result). Getting "you may not have sufficent right to ......" Only a new folder is created in the target, with no content, with insufficent rights on it (anonymous none and default none)
Henning
October 18th, 2010 12:58pm
Please add the client permission to administrator on all public folders
AddUsersToPFRecursive.ps1 -TopPublicFolder "\" -User Administrator -Permission owner
Add Permissions for Client Users to Access Public Folder ContentJames Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com
Free Windows Admin Tool Kit Click here and download it now
October 18th, 2010 10:39pm
I get the following result:
[PS] C:\Program Files\Microsoft\Exchange Server\V14\Scripts>.\AddUsersToPFRecursive.ps1 -TopPublicFolder "\" -User Admi
istrator -Permission owner
Failed to commit the change on object "000000001A447390AA6611CD9BC800AA002FC45A0300695FE24B35BA3C4D93E21E6778CA54CF0000
000000010000" because access is denied.
+ CategoryInfo : NotSpecified: (0:Int32) [Add-PublicFolderClientPermission], MapiAccessDeniedException
+ FullyQualifiedErrorId : F7D83191,Microsoft.Exchange.Management.MapiTasks.AddPublicFolderClientPermission
RunspaceId : b3e08cac-93ba-40a8-9ef4-c336070866e4
Identity : \Bergen
User : na.no/Users/Administrator
AccessRights : {Owner}
RunspaceId : b3e08cac-93ba-40a8-9ef4-c336070866e4
Identity : \Delte kontakter
User : na.no/Users/Administrator
AccessRights : {Owner}
------------------------------------------------------------------
Looks like it fails on the root foilder itself and then sucessfully processes all the subfolders. Sort of the same thing I get when using ExFolders on the top folder trying to add Administrator as owner, no error messages but cannot save result.
Henning
October 19th, 2010 1:18am
Please refer
KB 313866 to check the security tab on the “CN=Public Folders” entry, see which authentication
settings has been granted to your “Administrator”. Please also check if “Include inheritable …” option has been unchecked
Notes: “Create top level public folder” permission is
the one that must be set in order for a user to have permissions for creating a public folder off of the public folder root
Please also run ExBPA against the exchange server for permission checkJames Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com
Free Windows Admin Tool Kit Click here and download it now
October 19th, 2010 2:41am