For some unknown reason, every mailbox in my Exchange 2007 has an unknown SID stuck to "Full Access Permission". I've just tried to create a new account & mailbox, and this SID still appears there. It must be "inherited" from some parent object. The problem is I don't know which object it is... Anybody knows which parent object gives this properties to all mailboxes? TIA

Use ADSIEDIT.msc and start in the configuration container --> services --> Microsoft Exchange and view the security of the object for the broken SID. Just keep working your way down to the DB object until you find which top level object it is set on.Maybe easier to start at the DB object and work your way, which ever way you decide you will find it.Sr. Exchange Engineer - Constellation Energy

I agree with Aaron. If this account has permissions on all mailboxes it is more then likely an admin for Exchange. Check the permissions to determine where the broken SID sits.ChrisChristopher C

I agree with AARON also try to resolve the name. http://www.joeware.net/freetools/tools/sidtoname/index.htm Vinod |CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|

I've found it. It's at the "domain name" level just beneath Microsoft Exchange: configuration container --> services --> Microsoft Exchange --> [domain name] For the record, the name can't be resolved as it's also broken. OTOH, the "PsGetSid" utility of the PsTools pack made by SysInternals can also resolve SID to user and computer and vice versa, and it's more complete than sidtoname. At least, it isn't "quick and dirty" utility ;)