delegation but excessive rights

[terry712]

i have use the delegation wizard and ticked the change pwd option.
logged in as this pleb and then had a look. i notice though that they can go in and edit the exchange properties for the user. they can also add to groups.

is this just an issue with the delegation wizard or where she i look. is it better if i do a customise and if so what are the options to set

 

[monsterjta]

Just curious...can you actually edit the Exchange properties and SAVE? I think you might find that you'll get an access denied if you attempt to save the settings. Let me know what you find.

I hope you find this post helpful,

Jonathan Almquist
Minneapolis, MN

 

[reynolwi]

that person will be able to see all the properties for that user and they may think they can edit it, but it shouldnt let them modify anything else but what you delegate.

Wm. Reynolds
RRWDS | TxPSS

http://www.rrwds.com

http://www.txpubsafety.com

- - - - - - - - - - - - -
Network Error:
Hit any user to continue

 

[terry712]

no they can edit them - it saves allright - i tried that when i seen it - all other parts are greyed out except exchange and pwd.

the user i have delegated - is a new user - no group membership at all except domain user and has no exchange acc

this is a third party type idea so the person in question would just be ts'ing into a box with a mmc taskpad and setting the properties

i am going to try as another user that i havent delegated anything to and see if they can do it. i'm curious to see if it is some weird right on the store or such like that is allowing them this. then i can probe the advance tab a bit
afraid i'm off now so it will be next week

 

[terry712]

created a user - just in domain users , no exchange account - no other groups and yes they can edit the exchange settings of a user

any thoughts