Exchange Server

Civic · Guest

I have Exchange 2003 Sp1 running on Windows 2003 Standard Sp1 in a Windows
2003 AD -Native Mode, domain. I have been creating additional address lists
and allowing restricted access to them for specific offices or users. I
recently created 2 that contain users from the 2 different sides of our
business. the lists were created identically -with the exeception of some
rights application to them -tryting to restrict access to view their contents
by specific people.
at this point I, and exchange administrator, can only see only 1 (Address1)
of them in System Manager, and therefore can only manage the rights on the
other list (Address2).
All Users -including myself, can see both address lists (Address1 &
Address2) and their contents in their address book, but i can not see
Address2 in System Manager to modify its rgihts -I must have applied a deny
right to this address list somewhere that is not allowing me, or even the
exchange system account, to mdify the rights assignments in SM.
How do i correct the rights on this address list if i can not see the
address list to reset or modify them?
Any help on this is greatly appreciated. Thank You

Bharat Suneja · Guest

Try to assign permissions on the parent Address Lists container in ADSIEdit
and make sure permissions are inherited to the child objects (address
lists).

.... one reason why Deny permission should be handled with extreme care in
ACLs - avoid it if possible.
--
Bharat Suneja
MCSE, MCT
www.zenprise.com
blog: www.suneja.com/blog

Civic · Guest

thank you. should i be able to see this missng address list though adsiedit
before i reset these permissions? the problem that i have resetting the
permissions is we created many different address lists with many differeent
rights and the missing list is right under All Address Lists and i would
reset all of these other address lists also.
is it strange that i can see the address list and it works fine through out
look but i can not see it in system manager?

Bharat Suneja · Guest

Not sure what permissions you assigned to be able to see the AL in Outlook
but not in ESM.

I was able to replicate this to some extent. If you know the name of the
Address List, you can list permissions using:
DSACLS distinguishedname /A

This can help you figure out which user/group has deny permissions assigned.

Once you have that information, you can remove the group from ACLs using:
DSACLS distinguishedname /R "domain\GroupOrUserName" (I used
"MyDomain\Domain Admins" - if the group name has a space, you'll need to
enclose in quotes... )

Doing this successfully revealed the Address List that was hidden earlier in
ESM.
--
Bharat Suneja
MCSE, MCT
www.zenprise.com
blog: www.suneja.com/blog

Civic · Guest

This worked for me. thank you very much for your help.

	Exchange Server Forum Index -> Design	All times are GMT
Page 1 of 1