Denying access to a specific mailbox

[sneeland]

We want to restrict access to a specific mailbox to only the person assigned to the mailbox and a specific security admin. We do not want exchange admins or domain admins to access the mailbox. I realize I can select the 'Deny' box on the security tab from A/D, but the problem is that if the mailbox belongs to a Domain Admin, and I say Domain Admins are denied access, then he will not be able to get to his own mailbox.

Ideally I would like to remove some entries from the access list for that specific mailbox only. It is inheriting permissions from the parent. Unlike files & folders, I cannot turn of permission inheritance from the parent for this specific mailbox only.

If anyone knows how I can turn off the permission inheritance for this specific mailbox only then it would be greatly appreciated!!!

Thanks!
Steve

 

[markdmac]

Use Active Directory Users & Computers. Turn on Show Advanced Features. View the properties of the user. You will now have a Security tab and can restrict access as needed.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[sneeland]

That is our normal method to grant access to a mailbox to someone else and that works fine. If I want to restrict access for Domain Admins to access the mailbox, and that person is in the Domain Admins group also, security gives precidence to the Deny and will not let the Domain Admin access his own mailbox, so I cannot Deny access to the Domain Admins. Now if I could turn off the security permissions being inherited from the 'parent' then delete the Domain Admins entry from that security access list for that specific Domain Admin's mailbox then it should work as desired.

Anything else I could try?

Thanks!
Steve

 

[markdmac]

I am curious why you are so concerned with restricting the domain admins when with domain admin rights they could easily bypass this restriction. Seems to me you are spinning your wheels for nothing. Do you find you really have a problem with Admins trying to spy on people? If so get Admins you can trust.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[sneeland]

Preachin to the choir....

Sometimes "Cant do it" is a vslid answer. I think I have shown them enough to make my point that technically it can't be done (easily) and that their management issue may have to be addressed differently.

But if anyone does have a technical solution....

Stave