Exchange Admins - Permissions Help!

[Don]

Chaps.

We have a new "module" in our web-based application. What it does is poke Appointments into users' Exchange Calendar whenever they book an Absence/Holiday whatever. It then updates these Appointments if they change status. It even removes them if they are deleted from our system etc etc.

So anyway. All this works just great. However the Active Directory Account that is used to authenticate with the little web app that does this work clearly needs enough permissions to do the job.

At our development site we just shove in a Domain Admin's account and, of course, this is all fine!

I'd like to configure an account with the minimum priveliges necessary to do the job. Bugger knows what these are!

Any ideas?

[agent006]

You can do this, but i can't remember how offhand. If i remember i'll have a scoot round our exchange system tomorrow and post back.

[Don]

agent006 said:

You can do this, but i can't remember how offhand. If i remember i'll have a scoot round our exchange system tomorrow and post back.

Thanks! I'd appreciate it.

So far any user account seems to work! But our system is an SBS Domain and far, far, too much runs utterly insecure so its hard to be sure what's really needed in an Enterprise situation.

[malman]

Don said:

agent006 said:

You can do this, but i can't remember how offhand. If i remember i'll have a scoot round our exchange system tomorrow and post back.

Thanks! I'd appreciate it.

So far any user account seems to work! But our system is an SBS Domain and far, far, too much runs utterly insecure so its hard to be sure what's really needed in an Enterprise situation.

Sounds like someone was over generous with the group membership or worse

[agent006]

malman said:

Sounds like someone was over generous with the group membership or worse

Sounds like standard practice for most exchange systems i've worked on. A few admin accounts given rights to all mailboxes for ease of maintenance and recovery from far cups.

[malman]

Agreed, but it was the word "any" that was slightly worrying. On SBS2003 you normally find that all users have been made domain admins by mistake as the docs say you need to be a local admin on your pc for things to work properly.

Back to the question though.

www.slipstick.com/calendar/scheduleall.htm Half way down the page "Enterprise calendar by Tom Howe" I think he opens each mailbox as an admin then adds the account he wants as owner of the folders he wants, calendar, inbox etc (standard share my calendar type stuff). I would imagine this could be scripted if you have hundreds of users. I would think a bog standard user account would work using this technique.

www.microsoft.com/seminar/shared/asp/view.asp?url=/seminar/en/20001128mec4-333/manifest.xml

[aldi]

Doesnt it depend how the app works? IIRC you can create/modify appointments simply by sending an email, so that wouldn't require any permissions beyond that would it?

[agent006]

malman said:

Agreed, but it was the word "any" that was slightly worrying.

Not as worrying as me losing the ability to read properly.