Article ID: 262054 - View products that this article applies to.
This article was previously published under Q262054
In Microsoft Exchange Server 5.5, when you grant Service Account Admin privileges on the Site container to a Microsoft Windows account, you grant that account unrestricted access to all mailboxes. In Exchange 2000, there is no service account, and even accounts with Enterprise Administrators rights are denied rights to access all mailboxes, by default.
In some cases (for example, offline recovery of an entire mailbox database), it may still be useful to grant permissions to all mailboxes without having to explicitly do it mailbox by mailbox. This article explains how to do this.
Note Do not use this procedure in a production environment to allow unauthorized access to user data in violation of corporate policies regarding privacy and security. Implement an auditing plan on your network to detect and record improper use of network privileges by system administrators.
For an Exchange 2003 version of this article, view the following article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/821897/ )How to assign service account access to all mailboxes in Exchange Server 2003
If your logon account is the Administrator account or is a member of the Domain Admins or Enterprise Admins groups, then you are explicitly denied access to all mailboxes other than your own, even if you otherwise have full administrative rights over the Exchange system. Unlike Exchange Server 5.5, all Exchange 2000 administrative tasks can be performed without having to grant an administrator sufficient rights to read other people's mail.
This default restriction can be overridden in several ways, but again, doing so should be in accordance with your organization's security and privacy policies. In most cases, using these methods is appropriate only in a recovery server environment.
Method OneIf you are NOT the Administrator, or a member of the Domain Admins or Enterprise Admins groups, then you can add your account to the Exchange Services or Exchange Domain Servers groups, and you will be allowed full access to all mailboxes on servers in the domain.
Note The Exchange Services group may not exist if you have never deployed the Active Directory Connector in your organization.
Method TwoTo grant your administrative account access through Exchange System Manager to all the mailboxes that are in a single database (regardless of inherited explicit denials), follow these steps: