How to deny domain admins access to mailboxes

[hawika]

Usually domain admins have a deny-right for send as an receive as regarding the mailboxes of other users.
But the same domain admins are able to change these acl.

how can i prevent everybody (that means all admins) from viewing the mails in the mailbox after changing the default deny for send as and receive as????


Hans

 

[Chaupa]

We had Microsoft write us a script for this. Full control by a domain admin.
" That is by design "

 

[XPSea]

Instead to taking a preventative, just turn on auditting and audit group/user management, if a user changes rights, you have an audit log which can let you know who did it and when, you don't want those people working for you.

Rob

 

[Xybertron]

Here is why it is by design.

If your a domain admin you have enough rights to add yourself back. Basically make only trustworthy people admins. Dan
Microsoft Exchange Support @ Microsoft

 

[Chaupa]

I understand that component but I don't agree with the permissions and send as. Maybe you will know this Xybertron, why is it that when you want to give a user permissions to another users mailbox through ESM, the only way you can have the user open the other users mailbox is with full control, but this also gives him send as. Under security, you should be able to deny send as.It does not work. In 5.5, you had this functionality. the only way I have found to accomplish this is to log onto the resource mailbox and grant mapi level permissions.
???
Thanks
Paul.

 

[tom11011]

Domain admins have control of the servers within their domain. All you'll be doing is presenting him a new challenge to overcome.

 

[Chaupa]

In Exchange 5.5, these permissions where clearly defined. In 2000, the AD engineer did not take this into Consideration. I am beyond this issue now. I just want to know about the managing of a resource mailbox through Active Directory user and computers permissions. I did not mean the ESM for managing the permissions on a maibox.

 

[Xybertron]

I would need to test it. Have you looked at the Permissions Whitepaper for Exchange 2000? It might answer the question.

http://www.microsoft.com/exchange

Dan
Microsoft Exchange Support @ Microsoft