Access to mailboxes and public folders
| Rights and Permissions | Where Specified |
|---|---|
|
The account should be a member of the Domain Admins or Enterprise Admins group (See the note below the table) Alternatively, if you want to avoid granting such broad privileges, make the account a member of the Organization Management and Public Folder Management roles. |
To assign the roles to the account (<User>), run the following commands in the Exchange Management Shell: Add-RoleGroupMember "Organization Management" -Member <User> Add-RoleGroupMember "Public Folder Management" -Member <User> |
Exchange impersonation (step 1)
| Rights and Permissions | Where Specified |
|---|---|
| The ApplicationImpersonation role enables the Exchange processing user account to impersonate other users. |
To enable the account (<User>) to impersonate all users in an organization, run the following in the Exchange Management Shell: New-ManagementRoleAssignment –Name <AssignmentName> -Role ApplicationImpersonation –User <User> See http://msdn.microsoft.com/en-us/library/bb204095.aspx for more details related to enabling Exchange impersonation, such as limiting the scope of users. |
Exchange impersonation (step 2)
| Rights and Permissions | Where Specified |
|---|---|
| In addition to enabling Exchange impersonation for an account, give it the necessary access privileges by granting the ms-Exch-EPI-May-Impersonate extended right. |
To give the account (<User>) the right to impersonate all users on all Client Access Servers, run the following in the Exchange Management Shell: Get-ExchangeServer | where {$_.IsClientAccessServer -eq $TRUE} | ForEach-Object {Add-ADPermission -Identity $_.distinguishedname -User ((Get-User -Identity <User>) | select-object).identity -extendedRight ms-Exch-EPI-Impersonation} To give the account (<User>) permission to impersonate all accounts on all MailboxDatabases, run the following in the Exchange Management Shell: Get-MailboxDatabase | ForEach-Object {Add-ADPermission -Identity $_.DistinguishedName -User <User> -ExtendedRights ms-Exch-EPI-May-Impersonate} See http://msdn.microsoft.com/en-us/library/bb204095%28EXCHG.80%29.aspx for more details related to granting Exchange impersonation rights, such as narrowing the scope of accounts, servers and databases. |
|
|
IMPORTANT: Since membership in the Domain Admins or Enterprise Admins group denies Send As and Receive As permissions, you cannot continue using single administrative account. In this case it is advised to create separate processing service account. |
