บทความนี้แสดงวิธีการปรับเปลี่ยนสิทธิ์ของกล่องจดหมายบน Microsoft Exchange Server 2000 หรือกล่องจดหมาย 2003 ในเวลาเดียวกันเปิดการใช้ที่คุณกล่องจดหมายงานวัตถุผู้ใช้ที่อยู่ในบริการไดเรกทอรี Active Directory ของ Microsoft โดยทางโปรแกรม
กล่องจดหมายมีสองส่วนใน Exchange 2000 หรือองค์กร 2003 ในระบบโดเมน Microsoft Windows 2000 หรือ Microsoft Windows Server 2003
ผู้ใช้เปิดกล่องจดหมายใช้ Active Directory: นี่คือเพียงเป็นวัตถุผู้ใช้ใน Active Directory คุณสมบัติที่เกี่ยวข้องกับจดหมายและคุณสมบัติที่เกี่ยวข้องกับกล่องจดหมายหลายถูกตั้งค่าบนวัตถุนี้ผู้ใช้
เมื่อผู้ใช้เข้าถึงกล่องจดหมายแรก หรือ เมื่อมีการกำหนดเส้นทางข้อความแรกไปยังกล่องจดหมาย กล่องจดหมายที่แท้จริงถูกสร้างใน Exchange 2000 หรือเก็บข้อมูล 2003 ณจุดนี้ เมื่อ Exchange สร้างกล่องจดหมายสำหรับผู้ใช้ สิทธิ์กล่องจดหมายที่ถูกตั้งค่าบนตัวอธิบายความปลอดภัยของกล่องจดหมายในเก็บ This is based on the access control entries (ACEs) that are set on themsExchMailboxSecurityDescriptorแอตทริบิวต์
The msExchMailboxSecurityDesciptor attribute
This attribute exists on the user object in Active Directory. It stores a partial copy of the user's mailbox security descriptor. This attribute is not back-linked to the user's mailbox security descriptor.
In other words, if you modify this attribute directly, you do not update the actual mailbox security descriptor on the user's mailbox in the Exchange information store, unless you set this attribute before the actual mailbox has been created in the information store.
In fact, if there is a conflict between the security descriptor that is reflected by themsExchMailboxSecurityDescriptorattribute on the user object in Active Directory and the security descriptor that is stored on the user's mailbox in the information store, Exchange fixes themsExchMailboxSecurityDescriptorattribute to reflect the security descriptor on the user's mailbox. If you modify the security descriptor of the user's mailbox from ADUnC or through the CDOEXM IExchangeMailbox interface, themsExchMailboxSecurityDescriptorattribute is updated automatically to reflect these changes.
Limitations of using the msExchMailboxSecurityDescriptor attribute
The changes that you make on this attribute are reflected on the security descriptor of the user's mailbox only when you set this attribute before the mailbox is created in the information store. Note that the Exchange 2000 and 2003 mailbox for a mailbox-enabled user in Active Directory is created in an Exchange store when the user first accesses the mailbox or when any mail is sent to this user.
Another limitation of this attribute is that the attribute does not reflect any of the inherited ACEs on the actual mailbox's security descriptor. Hence, reading this directory attribute is not the most accurate approach to read a user's mailbox rights.
Advantages of using the msExchMailboxSecurityDescriptor attribute
This attribute is defined on a user object in Active Directory. Therefore, it can be accessed using any API that is compliant with Lightweight Directory Access Protocol (LDAP), such as the ADSI APIs or the LDAP APIs.
Because this code does not require CDOEXM, you can run it from a server that does not have the Microsoft Exchange 2000 and 2003 System Management Tools installed. But, again, you must set the mailbox rights before the user's mailbox is created in the information store. Also, you can read the mailbox rights at any time on this user's mailbox. But keep in mind the limitations that are mentioned in this article. (See the "Limitations of Using themsExchMailboxSecurityDescriptorAttribute" section.)
If you do not set themsExchMailboxSecurityDescriptorattribute on the mailbox-enabled user before the actual mailbox is created in the information store, the actual security descriptor property on the mailbox in the information store does not include an ACE with the following:
If this is the case, the user may experience problems when the user tries to access public folders or any resources that are outside the local Exchange server. This is one of the reasons why the IMailboxStore interface in the CDOEXM library is the only supported mechanism to programmatically mailbox-enable an Active Directory user against an Exchange 2000 or 2003 store.Here is a sample that shows you how to use ADSI and CDOEXM to make a mailbox-enabled user object in Active Directory. Then you manually set themsExchMailboxSecurityDescriptorinterface to include an ACE with the trustee specified in the code. The sole purpose of this sample is to show you how to set this attribute before the user's mailbox has been accessed and created in the information store if the attribute was not set correctly in the past.
Setting up the Visual Basic environment to run the Visual Basic sample
Start Microsoft Visual Basic 6.0 on the Exchange 2000 or 2003 server.
Create a New Standard EXE Project. เมื่อต้องการทำเช่นนั้น คลิกใหม่ในการแฟ้ม:เมนู และคลิกสองครั้งที่แล้วEXE มาตรฐาน.
ในการProjectเมนู คลิกอ้างอิง:แล้ว เลือกไลบรารีชนิด DS ที่ใช้งานอยู่และCDO Microsoft สำหรับการจัดการการแลกเปลี่ยน.
'********************************************************************
'*
'* Function AddAce(dacl, TrusteeName, gAccessMask, gAceType,
'* gAceFlags, gFlags, gObjectType, gInheritedObjectType)
'*
'* Purpose: Adds an ACE to a DACL
'* Input: dacl Object's Discretionary Access Control List
'* TrusteeName SID or Name of the trustee user account
'* gAccessMask Access Permissions
'* gAceType ACE Types
'* gAceFlags Inherit ACEs from the owner of the ACL
'* gFlags ACE has an object type or inherited object type
'* gObjectType Used for Extended Rights
'* gInheritedObjectType
'*
'* Output: Object - New DACL with the ACE added
'*
'********************************************************************
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
' Create a new ACE object
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'Check to see if ObjectType needs to be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'Check to see if InheritedObjectType needs to be set
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
' Destroy objects
Set Ace1 = Nothing
End Function
Private Sub Form_Load()
Dim objContainer As IADsContainer
Dim objUser As IADsUser
Dim objMailbox As CDOEXM.IMailboxStore
Dim oSecurityDescriptor As SecurityDescriptor
Dim dacl As AccessControlList
Dim ace As AccessControlEntry
' ********************************************************************
' You must change this variable according to your environment
'
sContainerADsPath = "LDAP://domain.com/cn=Users,DC=domain,DC=com"
sUserLoginName = "testUser"
sUserFirstName = "Test"
sUserLastName = "User"
sMBXStoreDN = "CN=Mailbox Store (ExServer),CN=First Storage Group," & _
"CN=InformationStore,CN=ExServer,CN=Servers,CN=AdminGP," & _
"CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange," & _
"CN=Services,CN=Configuration,DC=domain,DC=com"
sTrustee = "domainName\userName"
' ********************************************************************
' Get directory container object object
Set objContainer = GetObject(sContainerADsPath)
' Create the user object in the target container in Active Directory
Set objUser = objContainer.Create("User", "CN=" & sUserFirstName & " " & _
sUserLastName)
objUser.Put "samAccountName", sUserLoginName
objUser.Put "givenName", sUserFirstName
objUser.Put "sn", sUserLastName
objUser.SetInfo
objUser.SetPassword "password"
objUser.SetInfo
' Mailbox-enable the user object by using the CDOEXM::IMailboxStore
' interface
' This also sets the msExchMailboxSecurityDescriptor appropriately
Set objMailbox = objUser
objMailbox.CreateMailbox sMBXStoreDN
objUser.SetInfo
'**************************************************************************
' The msExchMailboxSecurityDescriptor attribute is a backlink attribute
' from the Exchange Mailbox in the Web store to the directory. What this
' implies is that the mailbox rights are stored on the actual mailbox in
' the Web store and this directory attribute reflects these mailbox
' rights.
' By default, changing this attribute does not affect the mailbox rights
' in the store. This attribute can only be modified before the actual
' mailbox in the store is created. If it is set before the mailbox in
' the Web store is created, Exchange will use the DACL set on this
' attribute as the DACL for mailbox rights on the mailbox in the store.
' Therefore, it can only be set before the mailbox-creation time.
' On installing Exchange 2000 SP2 on the Exchange Server where this code
' is being run, that would enable modifying the actual mailbox rights
' even after mailbox creation.
'**************************************************************************
' Get the copy Mailbox Security Descriptor (SD) stored on the
' msExchMailboxSecurityDescriptor attribute
objUser.GetInfoEx Array("msExchMailboxSecurityDescriptor"), 0
Set oSecurityDescriptor = objUser.Get("msExchMailboxSecurityDescriptor")
' Extract the Discretionary Access Control List (ACL) using the
' IADsSecurityDescriptor interface
Set dacl = oSecurityDescriptor.DiscretionaryAcl
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates reading all the ACEs on a
' DACL for the Exchange 2000 mailbox.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''Debug.Print "Here are the existing ACEs the mailbox's DACL - "
' Enumerate all the access control entries (ACEs) in the ACL using
' the IADsAccessControlList interface, thus displaying the current
' mailbox rights
Debug.Print "Trustee, AccessMask, ACEType, ACEFlags, Flags, ObjectType, InheritedObjectType"
Debug.Print "------- ---------- ------- -------- ----- ----------" & _
" -------------------"
Debug.Print
For Each ace In dacl
' Display all the ACEs' properties by using the IADsAccessControlEntry
' interface
Debug.Print ace.Trustee & ", " & ace.AccessMask & ", " & _
ace.AceType & ", " & ace.AceFlags & ", " & ace.Flags & ", " & _
ace.ObjectType & ", " & ace.InheritedObjectType
Next
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates adding a new ACE to the DACL
' for the Exchange 2000 mailbox with the Trustee specified in sTrustee,
' giving allow "Full Control" over this mailbox.
' This is the same task that is performed by ADUnC when selecting Add,
' specifying the Trustee, and checking the "Full Mailbox Access" Rights
' checkbox under the Mailbox Rights in the Exchange Advanced tab on the
' properties of a user.
' Similarly, you could remove ACEs from this ACL as well using the
' IADsAccessControlEntry interfaces.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
' Setting the Access Mask to 131075 enables "full mailbox access" and
' "read" privileges
AddAce dacl, sTrustee, 131075, _
ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0
' Add the modified DACL back onto the Security Descriptor
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save New SD onto the user
objUser.Put "msExchMailboxSecurityDescriptor", oSecurityDescriptor
' Commit changes from the property cache to the Information Store
objUser.SetInfo
MsgBox "Done viewing and modifying the copy of the Mailbox Security Descriptor"
End Sub
รหัสของสคริปต์ Visual Basic
Dim objContainer
Dim objUser
Dim objMailbox
Dim oSecurityDescriptor
Dim dacl
Dim ace
' ********************************************************************
' You must change this variable according to your environment
'
sContainerADsPath = "LDAP://domain.com/cn=Users,DC=domain,DC=com"
sUserLoginName = "testUser"
sUserFirstName = "Test"
sUserLastName = "User"
sMBXStoreDN = "CN=Mailbox Store (ExServer),CN=First Storage Group," & _
"CN=InformationStore,CN=ExServer,CN=Servers,CN=AdminGP," & _
"CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange," & _
"CN=Services,CN=Configuration,DC=domain,DC=com"
sTrustee = "domainName\userName"
' ********************************************************************
' Get directory container object object
Set objContainer = GetObject(sContainerADsPath)
' Create the user object in the target container in Active Directory
Set objUser = objContainer.Create("User", "CN=" & sUserFirstName & " " & _
sUserLastName)
objUser.Put "samAccountName", sUserLoginName
objUser.Put "givenName", sUserFirstName
objUser.Put "sn", sUserLastName
objUser.SetInfo
objUser.SetPassword "password"
objUser.SetInfo
' Mailbox enable the user object by using the CDOEXM::IMailboxStore
' interface
' This also sets the msExchMailboxSecurityDescriptor appropriately
Set objMailbox = objUser
objMailbox.CreateMailbox sMBXStoreDN
objUser.SetInfo
'**************************************************************************
' The msExchMailboxSecurityDescriptor attribute is a backlink attribute
' from the Exchange Mailbox in the Web Store to the directory. What this
' implies is that the mailbox rights are stored on the actual mailbox in
' the Web store and this directory attribute reflects these mailbox
' rights.
' By default, changing this attribute does not affect the mailbox rights
' in the store. This attribute can only be modified before the actual
' mailbox in the store is created. If it is set before the mailbox in
' the Web store is created, Exchange will use the DACL set on this
' attribute as the DACL for mailbox rights on the mailbox in the store.
' Therefore, it can only be set before the mailbox creation time.
' On installing Exchange 2000 SP2 on the Exchange Server where this code
' is being run, that would enable modifying the actual mailbox rights
' even after mailbox creation.
'**************************************************************************
' Get the copy Mailbox Security Descriptor (SD) stored on the
' msExchMailboxSecurityDescriptor attribute
objUser.GetInfoEx Array("msExchMailboxSecurityDescriptor"), 0
Set oSecurityDescriptor = objUser.Get("msExchMailboxSecurityDescriptor")
' Extract the Discretionary Access Control List (ACL) using the
' IADsSecurityDescriptor interface
Set dacl = oSecurityDescriptor.DiscretionaryAcl
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates reading all the ACEs on a
' DACL for the Exchange 2000 mailbox.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''Wscript.echo "Here are the existing ACEs the mailbox's DACL - "
' Enumerate all the access control entries (ACEs) in the ACL using
' the IADsAccessControlList interface, thus displaying the current
' mailbox rights
Wscript.echo "Trustee, AccessMask, ACEType, ACEFlags, Flags, ObjectType, InheritedObjectType"
Wscript.echo "------- ---------- ------- -------- ----- ----------" & _
" -------------------"
Wscript.echo
For Each ace In dacl
' Display all the ACEs' properties using the IADsAccessControlEntry
' interface
Wscript.echo ace.Trustee & ", " & ace.AccessMask & ", " & _
ace.AceType & ", " & ace.AceFlags & ", " & ace.Flags & ", " & _
ace.ObjectType & ", " & ace.InheritedObjectType
Next
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' The following block of code demonstrates adding a new ACE to the DACL
' for the Exchange 2000 mailbox with the Trustee specified in sTrustee,
' giving allow "Full Control" over this mailbox.
' This is the same task that is performed by ADUnC when selecting Add,
' specifying the Trustee, and checking the "Full Mailbox Access" Rights
' checkbox under the Mailbox Rights in the Exchange Advanced tab on the
' properties of a user.
' Similarly, you could remove ACEs from this ACL as well using the
' IADsAccessControlEntry interfaces.
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
' Setting the Access Mask to 131075 enables "full mailbox access" and
' "read" priviledges
AddAce dacl, sTrustee, 131075, _
ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0
' Add the modified DACL back onto the Security Descriptor
oSecurityDescriptor.DiscretionaryAcl = dacl
' Save New SD onto the user
objUser.Put "msExchMailboxSecurityDescriptor", oSecurityDescriptor
' Commit changes from the property cache to the information store
objUser.SetInfo
MsgBox "Done viewing and modifying the copy of the Mailbox Security Descriptor"
'********************************************************************
'*
'* Function AddAce(dacl, TrusteeName, gAccessMask, gAceType,
'* gAceFlags, gFlags, gObjectType, gInheritedObjectType)
'*
'* Purpose: Adds an ACE to a DACL
'* Input: dacl Object's Discretionary Access Control List
'* TrusteeName SID or Name of the trustee user account
'* gAccessMask Access Permissions
'* gAceType ACE Types
'* gAceFlags Inherit ACEs from the owner of the ACL
'* gFlags ACE has an object type or inherited object type
'* gObjectType Used for Extended Rights
'* gInheritedObjectType
'*
'* Output: Object - New DACL with the ACE added
'*
'********************************************************************
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
' Create a new ACE object
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'Check to see if ObjectType needs to be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'Check to see if InheritedObjectType needs to be set
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
' Destroy objects
Set Ace1 = Nothing
End Function
ข้อมูลสำคัญ: บทความนี้แปลโดยซอฟต์แวร์การแปลด้วยคอมพิวเตอร์ของ Microsoft แทนที่จะเป็นนักแปลที่เป็นบุคคล Microsoft มีบทความที่แปลโดยนักแปลและบทความที่แปลด้วยคอมพิวเตอร์ เพื่อให้คุณสามารถเข้าถึงบทความทั้งหมดในฐานความรู้ของเรา ในภาษาของคุณเอง อย่างไรก็ตาม บทความที่แปลด้วยคอมพิวเตอร์นั้นอาจมีข้อบกพร่อง โดยอาจมีข้อผิดพลาดในคำศัพท์ รูปแบบการใช้ภาษาและไวยากรณ์ เช่นเดียวกับกรณีที่ชาวต่างชาติพูดผิดเมื่อพูดภาษาของคุณ Microsoft ไม่มีส่วนรับผิดชอบต่อความคลาดเคลื่อน ความผิดพลาดหรือความเสียหายที่เกิดจากการแปลเนื้อหาผิดพลาด หรือการใช้บทแปลของลูกค้า และ Microsoft มีการปรับปรุงซอฟต์แวร์การแปลด้วยคอมพิวเตอร์อยู่เป็นประจำ
กลับไปด้านบน
