この資料では、Microsoft Active Directory ディレクトリ サービスでユーザー オブジェクトのメールボックスを有効にするのと同時に、プログラムによって Exchange 2000 Server または Exchange Server 2003 のメールボックスに対するメールボックスの権利を修正する方法について説明します。
'********************************************************************
'*
'* Function AddAce(dacl, TrusteeName, gAccessMask, gAceType,
'* gAceFlags, gFlags, gObjectType, gInheritedObjectType)
'*
'* Purpose: Adds an ACE to a DACL
'* Input: dacl Object's Discretionary Access Control List
'* TrusteeName SID or Name of the trustee user account
'* gAccessMask Access Permissions
'* gAceType ACE Types
'* gAceFlags Inherit ACEs from the owner of the ACL
'* gFlags ACE has an object type or inherited object type
'* gObjectType Used for Extended Rights
'* gInheritedObjectType
'*
'* Output: Object - New DACL with the ACE added
'*
'********************************************************************
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
' Create a new ACE object
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'Check to see if ObjectType needs to be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'Check to see if InheritedObjectType needs to be set
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
' Destroy objects
Set Ace1 = Nothing
End Function
Private Sub Form_Load()
Dim objContainer As IADsContainer
Dim objUser As IADsUser
Dim objMailbox As CDOEXM.IMailboxStore
Dim oSecurityDescriptor As SecurityDescriptor
Dim dacl As AccessControlList
Dim ace As AccessControlEntry
' ********************************************************************
' You must change this variable according to your environment
'
sContainerADsPath = "LDAP://domain.com/cn=Users,DC=domain,DC=com"
sUserLoginName = "testUser"
sUserFirstName = "Test"
sUserLastName = "User"
sMBXStoreDN = "CN=Mailbox Store (ExServer),CN=First Storage Group," & _
"CN=InformationStore,CN=ExServer,CN=Servers,CN=AdminGP," & _
"CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange," & _
"CN=Services,CN=Configuration,DC=domain,DC=com"
sTrustee = "domainName\userName"
' ********************************************************************
' Get directory container object object
Set objContainer = GetObject(sContainerADsPath)
' Create the user object in the target container in Active Directory
Set objUser = objContainer.Create("User", "CN=" & sUserFirstName & " " & _
sUserLastName)
objUser.Put "samAccountName", sUserLoginName
objUser.Put "givenName", sUserFirstName
objUser.Put "sn", sUserLastName
objUser.SetInfo
objUser.SetPassword "password"
objUser.SetInfo
' Mailbox-enable the user object by using the CDOEXM::IMailboxStore
' interface
' This also sets the msExchMailboxSecurityDescriptor appropriately
Set objMailbox = objUser
objMailbox.CreateMailbox sMBXStoreDN
objUser.SetInfo
'**************************************************************************
' The msExchMailboxSecurityDescriptor attribute is a backlink attribute
' from the Exchange Mailbox in the Web store to the directory. What this
' implies is that the mailbox rights are stored on the actual mailbox in
' the Web store and this directory attribute reflects these mailbox
' rights.
' By default, changing this attribute does not affect the mailbox rights
' in the store. This attribute can only be modified before the actual
' mailbox in the store is created. If it is set before the mailbox in
' the Web store is created, Exchange will use the DACL set on this
' attribute as the DACL for mailbox rights on the mailbox in the store.
' Therefore, it can only be set before the mailbox-creation time.
' On installing Exchange 2000 SP2 on the Exchange Server where this code
' is being run, that would enable modifying the actual mailbox rights
' even after mailbox creation.
'**************************************************************************
' Get the copy Mailbox Security Descriptor (SD) stored on the
' msExchMailboxSecurityDescriptor attribute
objUser.GetInfoEx Array("msExchMailboxSecurityDescriptor"), 0
Set oSecurityDescriptor = objUser.Get("msExchMailboxSecurityDescriptor")
' Extract the Discretionary Access Control List (ACL) using the
' IADsSecurityDescriptor interface
Set dacl = oSecurityDescriptor.DiscretionaryAcl
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates reading all the ACEs on a
' DACL for the Exchange 2000 mailbox.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''Debug.Print "Here are the existing ACEs the mailbox's DACL - "
' Enumerate all the access control entries (ACEs) in the ACL using
' the IADsAccessControlList interface, thus displaying the current
' mailbox rights
Debug.Print "Trustee, AccessMask, ACEType, ACEFlags, Flags, ObjectType, InheritedObjectType"
Debug.Print "------- ---------- ------- -------- ----- ----------" & _
" -------------------"
Debug.Print
For Each ace In dacl
' Display all the ACEs' properties by using the IADsAccessControlEntry
' interface
Debug.Print ace.Trustee & ", " & ace.AccessMask & ", " & _
ace.AceType & ", " & ace.AceFlags & ", " & ace.Flags & ", " & _
ace.ObjectType & ", " & ace.InheritedObjectType
Next
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates adding a new ACE to the DACL
' for the Exchange 2000 mailbox with the Trustee specified in sTrustee,
' giving allow "Full Control" over this mailbox.
' This is the same task that is performed by ADUnC when selecting Add,
' specifying the Trustee, and checking the "Full Mailbox Access" Rights
' checkbox under the Mailbox Rights in the Exchange Advanced tab on the
' properties of a user.
' Similarly, you could remove ACEs from this ACL as well using the
' IADsAccessControlEntry interfaces.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
' Setting the Access Mask to 131075 enables "full mailbox access" and
' "read" privileges
AddAce dacl, sTrustee, 131075, _
ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0
' Add the modified DACL back onto the Security Descriptor
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save New SD onto the user
objUser.Put "msExchMailboxSecurityDescriptor", oSecurityDescriptor
' Commit changes from the property cache to the Information Store
objUser.SetInfo
MsgBox "Done viewing and modifying the copy of the Mailbox Security Descriptor"
End Sub
Visual Basic スクリプトのコード
Dim objContainer
Dim objUser
Dim objMailbox
Dim oSecurityDescriptor
Dim dacl
Dim ace
' ********************************************************************
' You must change this variable according to your environment
'
sContainerADsPath = "LDAP://domain.com/cn=Users,DC=domain,DC=com"
sUserLoginName = "testUser"
sUserFirstName = "Test"
sUserLastName = "User"
sMBXStoreDN = "CN=Mailbox Store (ExServer),CN=First Storage Group," & _
"CN=InformationStore,CN=ExServer,CN=Servers,CN=AdminGP," & _
"CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange," & _
"CN=Services,CN=Configuration,DC=domain,DC=com"
sTrustee = "domainName\userName"
' ********************************************************************
' Get directory container object object
Set objContainer = GetObject(sContainerADsPath)
' Create the user object in the target container in Active Directory
Set objUser = objContainer.Create("User", "CN=" & sUserFirstName & " " & _
sUserLastName)
objUser.Put "samAccountName", sUserLoginName
objUser.Put "givenName", sUserFirstName
objUser.Put "sn", sUserLastName
objUser.SetInfo
objUser.SetPassword "password"
objUser.SetInfo
' Mailbox enable the user object by using the CDOEXM::IMailboxStore
' interface
' This also sets the msExchMailboxSecurityDescriptor appropriately
Set objMailbox = objUser
objMailbox.CreateMailbox sMBXStoreDN
objUser.SetInfo
'**************************************************************************
' The msExchMailboxSecurityDescriptor attribute is a backlink attribute
' from the Exchange Mailbox in the Web Store to the directory. What this
' implies is that the mailbox rights are stored on the actual mailbox in
' the Web store and this directory attribute reflects these mailbox
' rights.
' By default, changing this attribute does not affect the mailbox rights
' in the store. This attribute can only be modified before the actual
' mailbox in the store is created. If it is set before the mailbox in
' the Web store is created, Exchange will use the DACL set on this
' attribute as the DACL for mailbox rights on the mailbox in the store.
' Therefore, it can only be set before the mailbox creation time.
' On installing Exchange 2000 SP2 on the Exchange Server where this code
' is being run, that would enable modifying the actual mailbox rights
' even after mailbox creation.
'**************************************************************************
' Get the copy Mailbox Security Descriptor (SD) stored on the
' msExchMailboxSecurityDescriptor attribute
objUser.GetInfoEx Array("msExchMailboxSecurityDescriptor"), 0
Set oSecurityDescriptor = objUser.Get("msExchMailboxSecurityDescriptor")
' Extract the Discretionary Access Control List (ACL) using the
' IADsSecurityDescriptor interface
Set dacl = oSecurityDescriptor.DiscretionaryAcl
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates reading all the ACEs on a
' DACL for the Exchange 2000 mailbox.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''Wscript.echo "Here are the existing ACEs the mailbox's DACL - "
' Enumerate all the access control entries (ACEs) in the ACL using
' the IADsAccessControlList interface, thus displaying the current
' mailbox rights
Wscript.echo "Trustee, AccessMask, ACEType, ACEFlags, Flags, ObjectType, InheritedObjectType"
Wscript.echo "------- ---------- ------- -------- ----- ----------" & _
" -------------------"
Wscript.echo
For Each ace In dacl
' Display all the ACEs' properties using the IADsAccessControlEntry
' interface
Wscript.echo ace.Trustee & ", " & ace.AccessMask & ", " & _
ace.AceType & ", " & ace.AceFlags & ", " & ace.Flags & ", " & _
ace.ObjectType & ", " & ace.InheritedObjectType
Next
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates adding a new ACE to the DACL
' for the Exchange 2000 mailbox with the Trustee specified in sTrustee,
' giving allow "Full Control" over this mailbox.
' This is the same task that is performed by ADUnC when selecting Add,
' specifying the Trustee, and checking the "Full Mailbox Access" Rights
' checkbox under the Mailbox Rights in the Exchange Advanced tab on the
' properties of a user.
' Similarly, you could remove ACEs from this ACL as well using the
' IADsAccessControlEntry interfaces.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
' Setting the Access Mask to 131075 enables "full mailbox access" and
' "read" priviledges
AddAce dacl, sTrustee, 131075, _
ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0
' Add the modified DACL back onto the Security Descriptor
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save New SD onto the user
objUser.Put "msExchMailboxSecurityDescriptor", oSecurityDescriptor
' Commit changes from the property cache to the information store
objUser.SetInfo
MsgBox "Done viewing and modifying the copy of the Mailbox Security Descriptor"
'********************************************************************
'*
'* Function AddAce(dacl, TrusteeName, gAccessMask, gAceType,
'* gAceFlags, gFlags, gObjectType, gInheritedObjectType)
'*
'* Purpose: Adds an ACE to a DACL
'* Input: dacl Object's Discretionary Access Control List
'* TrusteeName SID or Name of the trustee user account
'* gAccessMask Access Permissions
'* gAceType ACE Types
'* gAceFlags Inherit ACEs from the owner of the ACL
'* gFlags ACE has an object type or inherited object type
'* gObjectType Used for Extended Rights
'* gInheritedObjectType
'*
'* Output: Object - New DACL with the ACE added
'*
'********************************************************************
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
' Create a new ACE object
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'Check to see if ObjectType needs to be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'Check to see if InheritedObjectType needs to be set
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
' Destroy objects
Set Ace1 = Nothing
End Function
先頭へ戻る
