Admin rights on Mailboxes

[LittleFishy]

What is the best way or software that can restrict the way administrators change mailbox access? We have WAN and two Exchange 2K servers, we currently have a large number of users who have Domain Admin rights and can therefore give themselves access (in active dir) to other user’s emails. My MD wants to stop/restrict or log this, so that an administrator has to get his (MDs) permission to change these rights and if they don't they are committing an offence. A simple way of doing this would be nice and is Server & Exchange 2003 any better? Thanks for any help.

 

[xmsre]

You desperately need some IT policies. If you are a publicly held US company, your executives have violated SOX and are subject to criminal penalties up to and including jail time. Turn them in. Immediately after turning in your executives, seek protection under the wistleblower's statues. They can't fire you. Now that the idiots who instituted the policy of giving everyone admin priviledges are gone, take it away. Problem solved.


Each time a user other than the owner of a mailbox accesses a mailbox, event id 1016 is logged in the application log of the exchange server.

 

[LittleFishy]

We are in the UK & as I understand it, if the executives/directors consider an employee to be abusing the system, disclosing company information etc, they can view user’s activities. Our problem is that until we resolve our Domain Admin issues, we want to know if & who has changed rights and possibly reading other users email.

 

[Grenage]

we currently have a large number of users who have Domain Admin rights

What you really need to do is evaluate your entire permission strategy. The list of reasons as to why the above is a bad idea is too long to list. Global administrators are just that, if you want the users to require permission - they have to be basic users.

There is no quick and easy hash solution to your problem.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.