Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So our environment is basically we have an Exchange 2003 server, and we're attempting to move to Exchange 2010 gradually, and move to new hardware while we're at it.

So our first step was obviously to get Exchange 2010 installed on the new box. However, after running the domainprep steps listed in (including PrepareLegacyExchangePermissions) our mailbox permissions get messed up.

Normally, we have an AD security group for Exchange Administrators that allows anyone in that group to view all folders inside any user's mailbox. However, now, this functionality is gone and our Exchange Admins can't access anyone's mailboxes. We'd like to get this functionality back if we could.


share|improve this question
up vote 0 down vote accepted

Standard AD permissions on Exchange mailboxes include an explicit deny to the Domain Admins and Enterprise Admins groups (and some other ones); this ACE is applied at the organization level, and inherited by everything Exchange-related (including databases and mailboxes). I don't know how ALCs were configured in your environment, but there are very good chances the preparation steps of Exchange 2010 applied some default permissions which were different than what you are used to; the standard rule for Exchange is that nobody should have access to someone else's mailbox contents unless that kind of access is explicitly granted by the owner, and this is true for everyone, including Exchange Organization Administrators.

I suggest looking into actual object ACLs using some tool such as ADSIEdit; alternatively, you can manage security on the Exchange organization object (and downwards) using the "Services" node of the Active Directory Sites and Services console.

share|improve this answer

When you look at the ACL on a mailbox is your Exchange Administrators group still there? Or has it been removed.

Also there is normally a Deny entry in the ACL for Domain Admins, so even if you've got another group with Allow the Deny will override that.

share|improve this answer
Yeah the exchange administrators group is still there, and as mentioned, there's an explicit deny in the rules. – tearman Nov 15 '10 at 9:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.