Proper Security Settings on Exchange Install Folder?

I am trying to nail down the security of our Exchange 2003 servers
before we start a mass migration off 5.5.   

One issue I am dealing with is securing the Exchange install
directory, in my case c:\program files\exchsrvr

I have a Microsoft Press Book "Secure Messaging with MS Exchange
Server 2003" that talks about doing this on page 144, but the details
aren't as clear as I would like them.

For example, they say to remove the everyone inheritance.  I don't
have that.  (thats not my question - but right away I'm seeing the
book completely different from what I have)

They show Authenticated Users as having read, list and execute allow
(for OWA purposes)

They show creator owner, domain admins, system and exadmins (exadmins
I assume is a local group they created for admin rights purposes)

I have local administrators group (should a local Exchange
administrators group replace this?  We do have a subset of our usual
admins that should have rights to exchange.

I have power users and terminal server user having all but full
control.

Users (local) has read, list & execute.

Has anyone gone in and modified these from what is there by default?

I want to lock it down so Exchange has the ability to run normally,
OWA users can access the server, and only a small set of Exchange
Administrators can get into this area.
0
gomer (19)
11/5/2004 3:23:26 PM
exchange.admin 57650 articles. 2 followers. Follow

1 Replies
1058 Views

Similar Articles

[PageSpeed] 58

Ex Gomer <gomer@nowhere.com> wrote:

>I am trying to nail down the security of our Exchange 2003 servers
>before we start a mass migration off 5.5.   
>
>One issue I am dealing with is securing the Exchange install
>directory, in my case c:\program files\exchsrvr
>
>I have a Microsoft Press Book "Secure Messaging with MS Exchange
>Server 2003" that talks about doing this on page 144, but the details
>aren't as clear as I would like them.
>
>For example, they say to remove the everyone inheritance.  I don't
>have that.  

That's correct. The "Program Files" directory doesn't grant Everyone
any permissions.

>(thats not my question - but right away I'm seeing the
>book completely different from what I have)

Just because it's in a book doesn't make it correct. :)

>They show Authenticated Users as having read, list and execute allow
>(for OWA purposes)

"Read & Execute", "List Folder Contents", and "Read" should be allowed
for Authenticated Users.

>They show creator owner, domain admins, system and exadmins (exadmins
>I assume is a local group they created for admin rights purposes)

Administrators, Authenticated Users, CREATOR OWNER, Server Operators,
and SYSTEM should be in then ACL.

Domain Admins is usually a member of the local Administrators group
and doesn't need explicit permissions.

Exadmins may be a group created to allow Exchange Administrators
access to areas of the server they wouldn't have if they were not a
member of the local administrators group. It is not, however, created
by MS.

>I have local administrators group (should a local Exchange
>administrators group replace this?  

No. But they may be members of that group. I'd create the Exadmins
group in the AD, populate it with the necessary people, and use it to
assign permissions. You can, if you like, place that group into the
local Administrators group. Being a local administrator is necessary
for an "Exchange Administrator" or "Exchange Full Administrator" to
control the configuration of Exchange.

>We do have a subset of our usual
>admins that should have rights to exchange.

Then you don't need the distinction.


-- 
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
0
richnews (7315)
11/6/2004 10:29:27 PM
Reply:

Similar Artilces:

Sum formula is not adding up properly
I am summing up hours in Excel and the sum formula is not working Properly. For 2 of my 5 cells are adding correctly, but the other 2 when added to the formula throw the entire thing off. They are all formatted the same in 13:33 format to measure the # of hours spent on an activity. What would the reason be that two of them are not working? (it is almost like exel is substracting hours when these 2 cells are added) No real problem. Your math is probably fine; formatting needs fixing. Select the cell with the sum in it. Format this cell as Time 37:30:55 -- Gary's Student &quo...

Exchange 2003 Reaches 16GB Limit
My Exchange 2003 standard edition complains of reaching 16GB even though the mailbox store shows a combined size of about 2GB. Priv1.edb is reading 15.8GB. What could be the cause of this. This server is only handling 50 users and is 2 months old. The largest mailbox is about 107MB. First, it's the _combined_ size of priv1.edb and priv1.stm that is limited to 16GB in the Std Edition. You could start by reading MSKB article 828070 which will show you how to _temporarily_ increase the permitted DB size so that you can delete stuff. Gordon "Leonard Okoh" <lokoh@tranterse...

Exchange 5.5 SMTP
I am trying to route outbound SMTP mail to a child and parent domain using two seperate smart hosts. I do not want to use DNS to resolve these two address. Can this be accomplished using the address space, routing, or connection tabs of the IMS? I have tried using the email domain and listing the child and parent, but I am unable to use * or other wildcards to represent the child domain Y.NET 198.155.2. X.Y.NET 198.155.2. SMTP conversation between servers starts with a DNS lookup of the MX record to find the other server. I don't get what you are trying to do here?? or what you want...

How do I set the worksheet to save before closing?
When there is a change in a worksheet and I try to close it, a message asks me whether I want to save the worksheet or not? How do I turn on this notification before closing the sheet? Open your workbook. Hit Alt+F11 or Tools-->Macro-->Visual basic editor (VBE). On the left, double-click ThisWorkbook. Paste the following code into the ThisWorkbook code window. Hit the Save diskette at top-left. Close the VBE. Make a change to the workbook, and close it to test. Was the change saved? Should be. :) Option Explicit Private Sub Workbook_BeforeClose(Cancel As Boolean) ActiveWorkbook.Save...

BUG in O2K3
I posted this yesterday, with no response, and am posting again today as this is clearly a bug in Office 2003. Office 2003 is not properly integrated (well not at all!) with the IE setting "Reuse windows for launching shortcuts" (Internet Options - Advanced). This causes severe readability issues for users who need to make many url clicks from within Outlook, and don't want multiple instances of the IE window opening. See this for someone else's report of the same issue: http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&frame=right&th=b9c079b670 8a7bde&...

Outlook Express
In Outlook Express, all entries go into the 'Main Identity's Contacts' folder. If I move an entry into a sub folder, it still also remains in the Main Identity's folder. Is it possible to delete entries from this folder but still keep them in a sub folder or to delete the Main Identity's folder altogether and just keep sub folders for common groups? ...

error when deleting mailbox in exchange 55
Hi, i am having problems when trying to delete a mailbox in my exch 55. i receive the error c1040af4. does anybody know how to solve it? ...

Windows 7
How do I allow only certain computers on our network to access certain folders? I have my music folder that can be accessed by any pc on our network but wish to limit other folder to certain pc not all of them. Can anyone advise how I could do this ? Oh I have Windows 7 and the other pc's in the house are all Vista. Permissions in Windows are based on users, not computers. You have to create identical users with identical passwords on all the computers then give users permissions to shares based on who you want to access the shares. -- Kerry Brown MS-MVP - Wind...

domain added then removed from exchange but emails still route to exchange ?
Hi, Was wondering if someone can explain this: added external domainA to accepted domains added domainA mail address to users mailbox (mx was not changed) sent email from mailbox/account/domainB (hosted on exchange server) to domainA , arrived in users mailbox on exchange as expected removed domainA from accepted domains removed domainA email address from users mailbox to domainA , arrived in users mailbox on exchange as expected, arrived in users mailbox, this was not expected. When using Outlook (domainB exchange accounts) and entering the email address user@domainA.co...

Set of Dialogs -Delete Any Dialog at Runtime-Organize Pos
Hai I Have set of Dialogs created a Runtime and those are placed sequentially in a postion by using SetWindowPos and now i want to delete a Dialog using close button associated with that Dialog which is placed at a Position the Dialog Order shoulnd rearrange automatically and is there any way to do that Thanks and Regards Mike SetWindowPos. Uusually if you have a set of dialogs there is an application window of some sort associated with the application. What I would do is have the dialog's close handler post a message indicating the dialog had closed, then...

My Account Settings, Icons, Files are "Missing"
Recently, I booted up and discovered that my personalized icons (under my account) had disappeared from the desktop. The Account Name is "Gilxxx" but my data is under "Curxxx" When I looked closer, I was able to see the directory structure in my "Documents and Settings" folders, but none of the files. The files are there, however, as I can play MP3s in Windows Media Player (and they are in my My Music directory). And, when I tried to add new desktop icons to "re-create" my old desktop, Windows tells me that a shortcut with that name alread...

How do I properly attach vba code to a workbook
I have a function and entered it into the vba editor, syntax and all is clean, but my spreadsheet won't recognize the new command when I go to use it. displays #name? etc. etc. This is my first time to actually use the vba editor, so obviously I'm missing some basics somewhere... T-I-A... Where did you put the code? It should be in a regular code module, NOT a sheet's code module or the ThisWorkbook code module. In the VBA Editor, go to the Insert menu and choose Module. Put the code in that module. Also, if you are attempting to call the function from another workbook,...

Mail Security
I am running Exchange 5.5 on Windows advanced server2K. From my Exchange server, logged in as Administrator, you can do the following: start->settings->control panel->mail....then change the mailbox user to anyone in the company......open MS Outlook and read their email... Is there a way I can prevent this from happening (even if only for my own mailbox) Thank you! If Administrator has the role of Service Account Admin on the site object, then this can happen. You wouldn't be the first person who used this account as the service account. You could change the service ac...

List servers and their DNS server settings
I am trying to get a list of server names and their primary and secondary DNS server settings. If I try the following command: get-wmiobject Win32_networkadapterconfiguration -computername "servername | select name, DNSServerSearchOrder It would give me the specific servername and its dns addresses. I know have a list of computernames which I would like to list out and their DNSserversearchorder settings (DNS settings) I tried putting the list of computernames in a text file by using get-qadcomputer | export-csv C:\computername.txt -notype Then I used the get-con...

Cannot even install any longer
I have Outlook 2003 which I have used for several years and 2002 before that. This past week my machine crashed and I have installed and reinstalled all of my software many, many times. I now have everything back installed except Outlook. I cannot install at all now because I get the message that the installation source has been corrupted. I guess this is because I have tried to reinstall so many times over the past couple of weeks. All of my personal information and doctors appointments are in Outlook and now I cannot even install it! I understand the problem with bootleg copies of sof...

shared sa password
Hi all, My client is using Microsoft Great Plains v8. They have 4 people that knows the sa pasword, the password is never changed and 3 of them has system maintenance access. just wondering, i'm pretty sure there can be a security issue there. i dont know much about microsoft great plains, but could you share a quick thought of what can go wrong when the above happens.. btw, they are all working in finance. Cheers, Thano. Having the 'sa' password would enable them to perform actions using Query Analyzer, Enterprise Manager, and other SQL tools if they were able to gai...

Exchange Server/Relay Server Problem
I am in the process of moving all users from our old e-mail domain to the new e-mail domain. The old e-mail accounts reside on a Linux server running QMail with a domain similar to organization.com. All new accounts are being moved to an Exchange Server with the domain name of organization.ca; The Exchange server had been configured to relay all mail through the Linux server. As we moved people to the new domain name (organization.ca) the QMail server was configured to forward the users mail to the new accounts. It did so flawlessly until Friday... On Friday administration decided they...

OU is blocking Exchange attributes
I have a perplexing issue that I am trying to solve. I have one particular OU in our AD structure that will not allow a user account to be populated with any Exchange attributes. Let me explain a little further. In this OU are users that do not have a mail box on our corporate email server, but they need their user account enabled with an email address. I can run the wizard to mail enable the account, but the user properties do not populate with the global settings. Things like the SMTP address, ccMail etc. I can move the user to another OU and have no problem enabling email. The big pr...

Multiple Exchange Servers and Email Router
When installing CRM 4 Email Router in an environment with 2 Exchange servers, where do I need to install the Email Router? it is not requirement in CRM 4.0 to install the exchange router on exchange. All you need to do is to choose the exchange server name while configuring the router . I myself had installed the router on CRM server. /Aamir ...

Move Exchange mailboxes from one Domain to another.
Okay, this is the scenario... I got called in to fix a big mess. I am not the one that set this up! (Just wanted to clear that up. ;)) Windows 2003 network.. 2 Domains Domain one: Active Directory DNS DHCP File Server Domain two: Active Directory DNS Exchange Both domains are under separate forests. The person that set this up setup duplicate user accounts under both domains. Why he didn't put the exchange server under the same domain, I have no clue. I just figure he didn't know what he was doing. So what I have is everyone logging in to Domain one to do their everyday work ...

Search folder criteria
I am using Outlook 2007. How can I customise my search folder to filter messages that contain "KSC" in subject OR belong to "Sports" category? Is there a reason why "KSC" cannot not be assigned "Sports" catagory? Melissa wrote: > I am using Outlook 2007. > How can I customise my search folder to filter messages that contain "KSC" > in subject OR belong to "Sports" category? ...

How to combine contents of 2 outlook caledar folders back into onl
Trying to undo archiving of calendar "golfingsailor" <golfingsailor@discussions.microsoft.com> wrote in message news:1447A0BF-070A-4AD5-B991-A9B4074C3C7E@microsoft.com... > Trying to undo archiving of calendar If it's not open already, open the archive PST (File>Open>Outlook Data File). Using either the Calendar or Folder List view of the Navigation Pane, open the calendar in the archive PST. Display that calendar in a table view like By Category or Events. Select all the items in the calendar by pressing Ctrl+A or select the ones you wish to re...

Rename Favorite Folder
There is an extra mailbox I'm assigned to and monitor, however, it is not noticable because it is at the bottom of "All Mail Folders", and would like the mailbox listed with number of mail waiting in my Favorite Folders. I dragged and dropped the mailbox to my Favorite Folders, however, the results was not what I expected. The folder name became long pushing number of mail waiting far out of sight. I tried to rename folder to make it short and noticed the rename function was greyed out, and folder properties were in read-only mode. Do you know of a way to rename fol...

I need installation software.
I write my software in Visual C++ version 6. It has been many years since I used InstallShield and I don't think I have that software anymore. Right now I need a fairly simple installation utility program. Is there any good FREE (or low cost) installation software that I can download? TonyG wrote: > I write my software in Visual C++ version 6. It has been many years > since I used InstallShield and I don't think I have that software > anymore. Right now I need a fairly simple installation utility program. > > Is there any good FREE (or low cost) installation soft...

Exchange database size priv1.edb increasing fast
Dear Sirs, Few days ago we start new server (2 processors HT, RAID1, SCSI) with SBS2003 Premium. We noticed that size of Exchange database priv1.edb is big and increasing constantly. During last 24hrs the size increased from 10Gb to 16Gb. The checkbox "Enable circular logging" is set. The Exchange database in prevoius server was 3Gb only, and work almost 1.5 year. What is the cause of this situation? How to stop this process? Is it possible to decrease size of Exchange database? Regards Darek you have to first isolate what is causing the increase go to the system manager and...