Help! Need an Exchange Admin's Advice!

[Don]

Hi. A recurring problem for me.

I have an application that "pokes" an appointment in users' Calendars in Exchange 2003. However - how it does this is by a web app running on a server (somewhere else) communicating with a tiny web app on the Exchange Server itself. Nice!

The main web app has to authenticate with the Exchange server - and all this is OK. So far so good. The authentication (for bizarre reasons) has to be "basic" and is done with a plain old username and password. Again - no problem.

Now comes the hard part. If I authenticate as a user with a mailbox etc I can happily update their Calendar. I can't update anyone elses.

But that is precisely what I want to do. I want to store a username password combination in my web app - and use the same one for updating as many users' Calendars as I like.

So on my little Domain I just shove a suitable account into the Domain Admins Group and it all works a charm. On my client's site, of course, a Domain Admin account will not be acceptable.

So what I need to know is...

...what is the minimum set of priveliges this account will need and how do I give them to it.

I should add I'm a programmer - not a Windows Administrator, Exchange Administrator or anything like so I need a "crib sheet" solution.

If anyone can help there are many beers involved.

[GregE240]

Don,

For Calendar access, the MINIMUM access level needed would have to be Author.

In short, you have:

Reviewer – can only read items
Author – can read and create items
Editor – can read, create, and modify items

Does this help? You could create your external user as a Contact in E2K3 and set the Contact to have Author access to the Calendar(s).

Is this what you're after?

Edited by GregE240 on Wednesday 22 November 11:05

[plasticpig]

http://msexchangeteam.com/archive/200

This article should help. You will need to grant create message permission for this user for each mailbox.

[Don]

Much thanks chaps.

So...how do I give a particular account "Editor" (create, edit and delete) access to (preferably) all Calendars - or even a particular Calendar - presumably one could have a script do it?

I should like to point out I am very, very stupid and know less than nothing - I have been looking in System Manager and can't really find anything in there! Where do I look, chaps?

And thx for the link - I'll read the article now...

[GregE240]

Don said:

Much thanks chaps.

So...how do I give a particular account "Editor" (create, edit and delete) access to (preferably) all Calendars - or even a particular Calendar - presumably one could have a script do it?

I should like to point out I am very, very stupid and know less than nothing - I have been looking in System Manager and can't really find anything in there! Where do I look, chaps?

And thx for the link - I'll read the article now...

You could script it, yes. Or alternatively use a product by a company called Symprex called Folder Permissions Manager, which can perform multiple permissions settings on mailboxes.

HTH
Greg

[Don]

GregE240 said:

Don said:

Much thanks chaps.

So...how do I give a particular account "Editor" (create, edit and delete) access to (preferably) all Calendars - or even a particular Calendar - presumably one could have a script do it?

I should like to point out I am very, very stupid and know less than nothing - I have been looking in System Manager and can't really find anything in there! Where do I look, chaps?

And thx for the link - I'll read the article now...

You could script it, yes. Or alternatively use a product by a company called Symprex called Folder Permissions Manager, which can perform multiple permissions settings on mailboxes.

HTH
Greg

It does help a LOT, Greg, and that beer is already owed...

So I've just been into System Manager, right-clicked on the Mailbox Store, gone to the Security tab. I've added myself and given myself EVERYTHING. Now I'll see if I can open everyone's mailboxes...

[GregE240]

Good stuff, Don. Let us know how it goes.

[plasticpig]

I use admodify.net which does the same sort of thing as the product greg suggested.

[Don]

plasticpig said:

I use admodify.net which does the same sort of thing as the product greg suggested.

GregE240 said:

Good stuff, Don. Let us know how it goes.

Thanks both of you. It looks if I provide myself with "Full Mailbox Access" permissions to the Mailbox Store I can open and update any mailboxes I like with Calendar appointments. Cool! Now I need to see if this sorts it out for the client...

[GregE240]

plasticpig said:

I use admodify.net which does the same sort of thing as the product greg suggested.

AdModify is great, although its got a bit of a "This is f***ing complicated, so you'd better know what you're doing. If not, you need to grow some bollox...fast" type look of it, whilst the Symprex product has the warm cosseting bosom of a nice Outlooky GUI look and feel to it.

I've used Symprex on a project to set 4,000 calendars to "Reviewer". It took about 2 minutes with that product.

The Helpless Desk at the same site now use it for delegated mailbox access.

[plasticpig]

GregE240 said:

yes: AdModify is great, although its got a bit of a "This is f***ing complicated, so you'd better know what you're doing. If not, you need to grow some bollox...fast" type look of it, whilst the Symprex product has the warm cosseting bosom of a nice Outlooky GUI look and feel to it.

It beats using 15 diffrent vbscripts and trying to figure out the infernal workings of the CDOEXM object model.

[theboss]

Don said:

Hi. A recurring problem for me.

I have an application that "pokes" an appointment in users' Calendars in Exchange 2003. However - how it does this is by a web app running on a server (somewhere else) communicating with a tiny web app on the Exchange Server itself. Nice!

Just my 2p's worth.

It sounds like you're onto the right thing by granting store-level mailbox permissions to the service account that your app will use for authentication with Exchange.

However, technically speaking, I'd be careful not to take a 'cavalier' approach to frigging around with permissions at the store or server level. You can bugger Exchange up if you're not careful.

Politically speaking, you might also find yourself on the wrong side of the 'privacy is a basic human right' brigade if you go casually browsing through your users mailboxes without informing them first.

And last of all from a security perspective I'd also be reluctant to grant 'Full Mailbox Access' for the whole organisation to an account who's credentials are stored on / used by a public-facing webserver (you did say web app) and/or exchanged anywhere in cleartext.

Basically just be careful what you're doing, sometimes even quite obvious solutions can have very un-obvious implications.

[Don]

theboss said:

Don said:

Hi. A recurring problem for me.

I have an application that "pokes" an appointment in users' Calendars in Exchange 2003. However - how it does this is by a web app running on a server (somewhere else) communicating with a tiny web app on the Exchange Server itself. Nice!

Just my 2p's worth.

It sounds like you're onto the right thing by granting store-level mailbox permissions to the service account that your app will use for authentication with Exchange.

However, technically speaking, I'd be careful not to take a 'cavalier' approach to frigging around with permissions at the store or server level. You can bugger Exchange up if you're not careful.

Politically speaking, you might also find yourself on the wrong side of the 'privacy is a basic human right' brigade if you go casually browsing through your users mailboxes without informing them first.

And last of all from a security perspective I'd also be reluctant to grant 'Full Mailbox Access' for the whole organisation to an account who's credentials are stored on / used by a public-facing webserver (you did say web app) and/or exchanged anywhere in cleartext.

Basically just be careful what you're doing, sometimes even quite obvious solutions can have very un-obvious implications.

All good points.

* Held on a public facing web-app. Yep - only accessible via SSL and account details only accessible to an Administrator with a very high level of access rights (our app implements a permissions structure that makes this possible)

* Exchanged in clear text: Yep - bit of a bummer this. Still the transfer is between two servers both sitting behind firewalls. I would have done it with Active Directory authentication but their blimmin' firewalls get in the way. Not my choice - I can tell you!

* Privacy: Technically someone could indeed browse the mailboxes if they got hold of the account details. But so could any Domain Admin with access to change Exchange permissions! The account will *only* be used to poke Appointments into calendars by an application - no humans will ever log on using the account.

* Not keen on the store level thing myself. Microsoft don't recommend it. I would, personally, use Symprex or ADmOdify as Greg/plasticpig suggested. However - a store level permission (a) works, and (b) works within ten minutes of a harassed Administrator's time.

Your 2ps worth is, however, VERY much appreciated. If you can think of any other implications I'd would VERY much like to know...

[plasticpig]

Don. Out of intrest are you using CDOEX to poke your appointments or webdav? A bit torn as to which technology to go with a the moment.

[Don]

plasticpig said:

Don. Out of intrest are you using CDOEX to poke your appointments or webdav? A bit torn as to which technology to go with a the moment.

I'm using CDOEX.

Oh...and if you want *anything* to work it seems that the script *must* run on the Exchange Server itself. This is why the web-app back end does the unusual thing of using an AJAX-like call *from the back end* to a tiny web-script running on the Exchange Server. Server to Server comms over HTTP.

It works pretty well. Apart from the permissions problems...