In Exchange 2007, you can apply permissions in several ways. Microsoft provides two tools to apply permissions:
-
ADSI Edit (AdsiEdit.msc)
-
DSACLS (Dsacls.exe)
Both tools are included on the Windows Server 2003 CD in Support\Tools and can be downloaded from the Internet. Several third-party products can also be used to apply permissions.
In addition, if the Exchange administrator has the necessary rights within the Active Directory domain partition, the Exchange administrator can use the Add-ADPermission cmdlet in the Exchange Management Shell to apply the appropriate permissions, instead of using either ADSI Edit or DSACLS.
重要 : |
|---|
|
Incorrectly modifying the attributes of Active Directory objects by using Active Directory Service Interfaces (ADSI) Edit, DSACLS, the LDP tool (ldp.exe), or any other LDAP (Lightweight Directory Access Protocol) version 3 clients can cause serious problems. These problems may require reinstallation of Windows Server, Exchange Server, or both. Problems that occur if Active Directory object attributes are incorrectly modified may not be resolved until you reinstall the software.
|
Changing permissions in the domain naming partition will require Domain Admin rights on the object that you are configuring.
Consider the following example that shows how you can use DSACLS to delegate certain rights to organizational unit (OU) administrators who have a business requirement to manage the UM-related data associated with UM-enabled mailboxes.
Telecommunication administrators who are assigned membership in the UM Recipient Administrators security group need to be able to manage Unified Messaging attributes for all mailboxes located in and below the organizational unit OUContainer1 in the contoso.com domain. This example assumes that the UM Recipient Administrators group is delegated the Exchange View-Only Administrators role. For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see アクセス許可に関する考慮事項.
The example shows how to apply rights on OUContainer1 by specifying read or write, or both, access on the following attributes in OUContainer1:
-
proxyAddresses
-
msExchUMDtmfMap
-
msExchUMPinChecksum
-
msExchUMEnabledFlags
-
msExchUMTemplateLink
-
msExchUMRecipientDialPlanLink
-
msExchUMOperatorNumber
-
msExchUMListInDirectorySearch
-
msExchUMServerWritableFlags
-
msExchUMAudioCodec
注 : |
|---|
|
The permissions specified here provide the UM Recipient Administrators group the ability to manage these UM-related attributes only.
|
In addition, the example shows how to grant the extended right, Access Recipient Update Service, on the Exchange Server objects for members of the UM Recipient Administrators group.
How to Use DSACLS to Apply Permissions
DSACLS is a command-line tool that you can use to query and change permissions and security attributes of Active Directory objects. It is the command-line equivalent of using the Security tab in the Windows 2000 Server or Windows Server 2003 Active Directory Users and Computers and Active Directory Sites and Services snap-ins. DSACLS is included with the Windows Server 2003 Support Tools.
The following example uses DSACLS to apply permissions. After you have completed the procedure, the UM Recipient Administrators security group can manage UM-related properties for all users contained in the OUContainer1 organizational unit hierarchy in the contoso.com forest that contains the ContosoOrg Exchange organization.
注 : |
|---|
|
DSACLS is case-sensitive. You must be precise in the syntax that you pass to DSACLS because all characters are passed literally. This includes white spaces and carriage returns. If you receive errors from DSACLS, review the command or try breaking the command into smaller segments.
|
To apply permissions by using DSACLS.exe
-
Log on to a system within the forest that has the Windows Support Tools installed and use an account that has the necessary rights to perform the required actions, such as membership in the Domain Administrators group.
-
Open a command prompt, and type the following commands for each container where you want to grant access:
注 : |
|---|
|
Replace the domain name, Exchange organization, and accounts by using information for your organization.
|
dsacls "OU=OUContainer1,DC=contoso,DC=com" /I:S /G "contoso\UM Recipient Administrators:RPWP;proxyAddresses;user" "contoso\UM Recipient Administrators:RPWP;msExchUMDtmfMap;user" "contoso\UM Recipient Administrators:RPWP;msExchUMPinChecksum;user" "contoso\UM Recipient Administrators:RPWP;msExchUMEnabledFlags;user" "contoso\UM Recipient Administrators:RPWP;msExchUMTemplateLink;user" "contoso\UM Recipient Administrators:RPWP;msExchUMRecipientDialPlanLink;user" "contoso\UM Recipient Administrators:RPWP;msExchUMOperatorNumber;user" "contoso\UM Recipient Administrators:RPWP;msExchUMListInDirectorySearch;user" "contoso\UM Recipient Administrators:RPWP;msExchUMServerWritableFlags;user" "contoso\UM Recipient Administrators:RPWP;msExchUMAudioCodec;user"
dsacls "OU=OUContainer1,DC=contoso,DC=com" /I:S /G "contoso\UM Recipient Administrators:RPWP;proxyAddresses;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMDtmfMap;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMPinChecksum;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMEnabledFlags;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMTemplateLink;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMRecipientDialPlanLink;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMOperatorNumber;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMListInDirectorySearch;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMServerWritableFlags;inetOrgPerson" "contoso\UM Recipient Administrators:RPWP;msExchUMAudioCodec;inetOrgPerson"
-
Using the command prompt, type the following command:
注 : |
|---|
|
Replace the domain name, Exchange organization, and accounts by using information for your organization.
|
dsacls "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=contoso,DC=com" /I:S /G "contoso\UM Recipient Administrators:CA;Access Recipient Update Service;msExchExchangeServer"
-
If the command runs successfully, it will output the revised Windows NT security descriptor at the command prompt and will state, "The command completed successfully".
How to Use the Exchange Management Shell to Apply Permissions
The Exchange Management Shell is a command-line interface that lets you retrieve and configure Exchange objects. The Exchange Management Shell includes the Add-ADPermission cmdlet that you can use to apply permissions to objects that are stored within Active Directory.
The following procedure is an example for how to use the Add-ADPermission cmdlet to apply permissions. After the permissions have been applied, the UM Recipient Administrator security group can manage e-mail addresses, display names, and move mailboxes for all users contained in the OUContainer1 organizational unit hierarchy in the contoso.com forest that contains the ContosoOrg Exchange organization.
To apply permissions by using the Exchange Management Shell
-
Log on to a system within the forest that has the Windows Support Tools installed and use an account that has the necessary rights to perform the required actions, such as membership in the Domain Administrators group.
-
Open the Exchange Management Shell and type the following commands for each container where you want to grant access.
注 : |
|---|
|
Replace the domain name, Exchange organization, and accounts by using information for your organization.
|
Add-ADPermission -identity "ou=Container1,dc=contoso,dc=com" -user "contoso\UM Recipient Administrators" -AccessRights ReadProperty,WriteProperty -Properties proxyAddresses,msExchUMDtmfMap,msExchUMPinChecksum,msExchUMEnabledFlags,msExchUMOperatorNumber,msExchUMListInDirectorySearch,msExchUMRecipientDialPlanLink,msExchUMTemplateLink,msExchUMServerWritableFlags,msExchUMAudioCodec -InheritedObjectType user -InheritanceType Descendents
Add-ADPermission -identity "ou=Container1,dc=contoso,dc=com" -user "contoso\UM Recipient Administrators" -AccessRights ReadProperty,WriteProperty -Properties proxyAddresses,msExchUMDtmfMap,msExchUMPinChecksum,msExchUMEnabledFlags,msExchUMOperatorNumber,msExchUMListInDirectorySearch,msExchUMRecipientDialPlanLink,msExchUMTemplateLink,msExchUMServerWritableFlags,msExchUMAudioCodec -InheritedObjectType inetOrgPerson -InheritanceType Descendents
-
In the Exchange Management Shell, type the following command:
Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=contoso,DC=com" -User "contoso\UM Recipient Administrators" -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents
-
If the command runs successfully, it will output the access control entries that were added to the object.
ページのトップへ