For now we decided to solve the "problem" with a workaround, by adding extra user-accounts for each administrator.
Why we're doing that? At first, i'd like to pint out, that i have some pain with adding extra administrative permissions to the export-service-account. It seems to be a bad idea to grant this account such great power over the active-directory, to even manipulate admin-accounts in general.
Another way could have been to adjust the "administrative flags" which seem to prohibit changes on admin-objects in general (unless an admin is the manipulator). I guess this also a bad idea, since this would grant the service full power to admin-accounts too and we might affect additional services, which rely on these flags for proper functionality.
Since we made this decision now we have to migrate the farm-status to the "new" situation. This is not that trivial, that's why i'd like to share our current workflow, for the case somebody has to do the same:
Creating additional user-accounts for an admin in a SharePoint/Exchange-Farm (if you were working with administrative accounts before)
This solution aims at transferring the admin-username to a new and normal user-object.
- Add filter-rules to your user-profile-synchronization-connection (sorry - translated from German), which avoid the synchronization of the "new" admin-accounts. It seems to be a good idea, to rely this ruleset on the attribute
adminCount being greater or similar to 1.
- Rename the admin-account and login-name to a "new" naming-scheme for admins.
- Create a new user-object following the preferred naming-scheme for users.
- Disconnect the exchange-mailbox of the administrator. Be careful to not delete the belonging AD-account incidentially by removing the mailbox!
- Create a new exchange-mailbox for the new user (i advise to do this only if the mailbox wasn't in use before). Alternatively you might try to reconnect the admin-mailbox to the new user. Which didn't work in our installation so far.
- Check the correct synchronization-status of the specific profile within the user-profile-synchronization-service, you probably have to delete the "old" user-profile of the admin, to let the profile-service correctly reconnect to the new user.
- Do not forget to assure the correct authorization-levels in the SharePoint websites.