hi there, i've added my colleagues on mailbox server (exchange 2007) to make a basic administration. today one of them tried to take a full controll one of users mailbox. result was: "access is denied". those users are in Administrators Group in mailbox server (OS is Windows 2003). how i have to solve this problem?

Hi Con, Exchange Full Administrator . This is the highest level possible and gives full access permissions throughout the Exchange organization. In addition, users with the Exchange Full Administrator role can also grant permissions to other Exchange administrators if required. Exchange Administrator . The Exchange Administrator role is essentially the same as the Exchange Full Administrator role although this role does not give the ability to grant permissions to other Exchange administrators. Exchange View-Only Administrator . This gives read-only access to the Exchange organization. In other words, it is possible to see the contents and settings of an Exchange organization, but not modify them. Kindly check that which permission do you need for your users. Regards. Shafaquat Ali.M.C.I.T.P Exchange 2007/2010, M.C.I.T.P Windows Server 2008, M.C.T.S OCS Server 2007 R2, Phone: +923008210320

Shafaquat, i ve assigned them Exchange Recipient Administrator role from Exchange Management Console, i thought that it could help but unfortunately no.... i dont want to give them Exchange Full Administrator / Exchange Administrator rights, because they will have more permission than they need

The Exchange Recipient Administrators role has permissions to modify any Exchange property on an Active Directory user, contact, group, dynamic distribution list, or public folder object. Members of the Exchange Organization Recipient Administrators role have the following permissions: · Read access to all the Domain User containers in Active Directory that have had Setup /PrepareDomain run in those domains. · Write access to all the Exchange specific attributes on the Domain User containers in Active Directory that have had Setup /PrepareDomain run in those domains. · Membership in the Exchange View-Only Administrator role. Users who are members of the Exchange Recipient Administrators role will not have permissions to Domains where Setup /PrepareDomain has not been run. When you add a new Exchange domain, make sure that you run Setup /PrepareDomain in the new domain to grant permissions to the Exchange administrator roles in that domain. So the Exchange Recipient Administrators role only has full control of Exchange properties on Active Directory user object. Perhaps you need to give them Exchange administrator role. Your expertise never fails to impress!