Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have recommendations on what to do differently, or a checklist, when setting up an Exchange 2003 mailbox for outside consultants? I assume I still need to create an AD user?

Only webmail will be needed.

share|improve this question
Doesn't everyone have their own email accounts these days? Direct them to – Kevin Kuphal Aug 18 '09 at 19:37
up vote 5 down vote accepted

All mailboxes in Exchange require an Active Directory user account be created, since the mailbox is, effectively, a property of the AD user account.

If your concern is limiting the use of these accounts to prevent access to shared file resources on server computers you may have a large task ahead of you. If you used a lot of "Authenticated Users" in permissions you may regret it.

You could limit the usefulness of these accounts a bit by placing the users into the "Domain Guests" group, setting that as their primary group, and removing their membership from "Domain Users". That will cause them not to be a member of "Users" on member computers in the domain and, depending on how you've done your shared folder permissions, may also limit their access to shared folders.

You could make a "Consultant Users" group and go around applying "Deny" permissions on resources with that group, too, but that's messy. (It's generally bad form to use "Deny" permissions unless you can't accomplish what you're looking for with the implicit denial capabilities of the underlying security model.)

share|improve this answer
I love how the "bad form" and "worst practices" part of your posts give me things to check (and correct) on my inherited network. ;) – Kara Marfia Aug 18 '09 at 18:16
Just one of my little "gifts" to the world. I can see the dark cloud around any silver lining. >smile< – Evan Anderson Aug 18 '09 at 18:33
Also answers the question 'But why would I want to create a security group for a share that everyone will have access to??!' – JS. Aug 18 '09 at 20:58

Are these consultants going to be logging onto your company-owned PCs inside the domain? If so, then Evan is correct.

Another option to this is if they are going to be bringing in their own computers, and connecting to your network or connecting to webmail over the internet, you can set a group policy to deny local logon on the OU that you set the consultants in.

share|improve this answer
No logging into the domain, only webmail – Kyle Brandt Aug 18 '09 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.