Chat now with support
Chat with Support

Security Explorer 9.8 - Release Notes

Permission requirements to manage Microsoft Exchange in Security Explorer

•
To connect to an Exchange 2007 Organization, a user must be a domain user, have a mailbox on one of the Exchange Servers, be a member of the Exchange Organization Management group, and have impersonation rights on the Exchange 2007 client access server(s) and mailbox database(s).
For more details on configuring user impersonation, see Configuring Exchange Impersonation (Exchange Web Services).
•
To connect to an Exchange 2010 Organization, a user must be a domain user, have a mailbox on one of the Exchange Servers, be a member of the Organization Management group, and have impersonation rights.
For more details on configuring user impersonation, see Configuring Exchange Impersonation in Exchange 2010.
•
To connect to an Exchange 2007–2010 Organization (Mixed Mode), a user must be a domain user, have a mailbox on the Exchange 2010 Server, be a member of the Exchange Organization Administrators group, and have impersonation rights on all versions of Exchange servers.
For more details on configuring user impersonation, see Configuring Exchange Impersonation (Exchange Web Services) and Configuring Exchange Impersonation in Exchange 2010.
•
To connect to an Exchange 2013 or 2016 Organization, a user must be a domain user, have a mailbox on one of the Exchange Servers, be a member of the Organization Management domain group, and have impersonation rights.
To configure impersonation in Security Explorer
1
In the Navigation pane, expand Role Based Access Control | Roles | ApplicationImpersonation | Assignments.
2
Select Assignments, and select File | New.
3
Enter the name and user.
4
Select RecipientRelativeWriteScope and choose Organization from the list.
5
Click OK and restart Security Explorer.
•
To connect to an Exchange 2007–2013 Organization (Mixed Mode), a user must be a domain user, have a mailbox on one of the 2013 Exchange Servers, be a member of the Organization Management domain group, and have impersonation rights on the Exchange 2007 and 2013 client access servers.
•
To connect to an Exchange 2010–2013 Organization (Mixed Mode), a user must be a domain user, have a mailbox on one of the 2013 Exchange Servers, be a member of the Organization Management domain group, and have impersonation rights on the Exchange 2010 and 2013 client access servers.
 
* 
IMPORTANT: Only a user who is a Domain Administrator and Exchange Administrator has no restrictions for mailbox management in Security Explorer. There are possible restrictions in Security Explorer for mailbox management. See Restrictions with mailbox management.

Restrictions with mailbox management

Only a user who is a Domain Administrator and Exchange Administrator has no restrictions for mailbox management in Security Explorer. If a user uses Run As to start Security Explorer and that user does not have enough privileges and enters valid Alternative Credentials (Domain User, Exchange Administrator, Local Administrator, Has Mailbox, Has Impersonation), there are some restrictions with mailbox management in Security Explorer.

•
Exchange 2007
•
Exchange 2010
•
Exchange 2013 and 2016
•
Mixed Mode (Exchange 2007–2010)
•
Mixed Mode (Exchange 2007–2013)
•
Mixed Mode (Exchange 2010–2013, 2010–2016, 2013–2016)

Exchange 2007

 
Table 19. Restrictions with mailbox management in Security Explorer with Microsoft® Exchange 2007
If the user entered in the Run as window has these privileges:
And these privileges are used to connect to Exchange Server:
Then these restrictions are possible in Security Explorer:

Domain Administrator

Exchange Organization Administrator

Windows® Authentication

Valid Alternative Credential

No restrictions

Domain User

Exchange Organization Administrator

Windows Authentication

Valid Alternative Credential

Cannot create, delete, and manage distribution groups.

Cannot manage Active Directory® permissions for mailboxes and public folders (View-only mode).

Domain User

Windows Authentication

Cannot connect to Exchange.

Domain User

Valid Alternative Credential

Cannot create, delete, and manage security and distribution groups (except dynamic distribution groups).

Cannot manage Active Directory permissions for mailboxes and public folders (View-only mode).

NOTE: Valid Alternative Credential: Domain User, Exchange Admin, Local Admin, Has Mailbox

Exchange 2010

 
Table 20. Restrictions with mailbox management in Security Explorer with Microsoft® Exchange 2010
If the user entered in the Run as window has these privileges:
And these privileges are used to connect to Exchange Server:
Then these restrictions are possible in Security Explorer:

Domain Administrator

Member of Organization Management

Windows® Authentication

Valid Alternative Credential

No restrictions

Domain User

Member of Organization Management

Windows Authentication

Valid Alternative Credential

Cannot create, delete and manage distribution groups.

Cannot manage Active Directory® permissions for mailboxes and public folders (View-only mode).

Domain User

Windows Authentication

Cannot connect to Exchange.

Domain User

Valid Alternative Credential

Cannot create, delete, and manage security and distribution groups (except dynamic distribution groups).

Cannot create mail-enabled public folders.

Cannot manage Active Directory permissions for mailboxes and public folders (View-only mode).

NOTE: Valid Alternative Credential: Domain User, Exchange Admin, Local Admin, Has Mailbox
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating