Select the product you need help with
Using the Exchange Calendar Update Tool to address daylight saving time changes for Exchange ServerArticle ID: 930879 - View products that this article applies to. Important The update that is described in this Microsoft Knowledge Base article has been replaced by the update that is described in Microsoft Knowledge Base article 941018. To make sure that Windows has the latest time-zone data, install the update that is described in Microsoft Knowledge Base article 941018.
You do not have to uninstall the update that is described in this Microsoft Knowledge Base article before you install the update that is described in Microsoft Knowledge Base article 941018.
For more information, click the following article number to view the article in the Microsoft Knowledge Base: 941018
(http://support.microsoft.com/kb/941018/
)
How to address daylight saving time by using the Exchange Calendar Update Tool
On This PageINTRODUCTIONDaylight saving time is a system of setting clocks ahead so that both sunrise and sunset occur at a later hour. The effect is additional daylight in the evening. Many countries observe daylight saving time, although most have their own rules and regulations for when it begins and ends. The dates of daylight saving time (otherwise known as DST) may change year to year, and users have to update their Microsoft Office Outlook calendar every time that the DST law or rules change. The dates between the previous DST rules and the current DST rules are referred to in this article as the "extended DST period." This article focuses on the actions that you can take to address calendar items in Microsoft Outlook that occur during the extended DST period. For more information about how to prepare for changes in daylight saving time in 2007 (DST 2007) for all affected Microsoft products, visit the following Microsoft Web site: http://www.microsoft.com/DST2007 This article focuses on the actions that should be taken to update
calendar items that are stored in Microsoft Exchange Server according to the
new DST rules. The solution that is presented in this article involves the
Exchange Calendar Update Tool (“the Exchange tool”). The Exchange tool relies
on the Time Zone Data Update Tool for Microsoft Office Outlook (“the Outlook tool”).
(http://www.microsoft.com/DST2007)
For more information about the Outlook tool, click the following article number to view the article in the Microsoft Knowledge Base: 931667
(http://support.microsoft.com/kb/931667/
)
How to address the daylight saving time changes in 2007 by using the Time Zone Data Update Tool for Microsoft Office Outlook
About the Exchange toolAfter you install the DST updates for Microsoft Windows, all old appointments that occur during the DST change periods will be incorrectly displayed as occurring one hour later. This is true for both recurring and single-instance appointments. These appointments must be updated so that they will be displayed correctly in Outlook, in Outlook Web Access, and in CDO-based applications.Outlook provides a tool that is named the Time Zone Data Update Tool for Microsoft Office Outlook . This tool enables users to update their own calendars. Note In Microsoft Office Outlook 2007, the Time Zone Data Update Tool is built in. However, we recommend that you use the stand-alone version of the Time Zone Data Update Tool. 931667 The Exchange Calendar Update Tool ("the Exchange tool")
enables you to avoid the challenges that are involved when you deploy the
Outlook tool widely to all users and enables you to make sure that each user
runs the tool correctly.
(http://support.microsoft.com/kb/931667/
)
How to address the daylight saving time changes in 2007 by using the Time Zone Data Update Tool for Microsoft Office Outlook
High-level description of the Exchange toolThe Exchange tool consists of two separate executable files. These files are described in the following table.Collapse this table
Version 2 of the Exchange toolVersion 2 of the Exchange Calendar Update Tool was released on February 21, 2007. This article refers to version 2 of the Exchange tool. If you are running version 1 of the Exchange tool, uninstall it and install version 2. Version 2 of the Exchange tool includes the following improvements:
Risks and limitations of running the Exchange toolThere are two issues to consider before you run the Exchange tool. The following table lists these issues, their potential effects on the IT infrastructure, and on users and their mitigation strategies.Collapse this table
Options for updating mailboxesThe following table lists five options that can be used to update user mailboxes to use the DST 2007 time zone rules.Collapse this table
How to install the Exchange toolThe Exchange Calendar Update Tool is available in the form of the self-extracting executable file Msextmz.exe.After installation, the files in the installation directory should include the following files:
941018
(http://support.microsoft.com/kb/941018/
)
How to address daylight saving time by using the Exchange Calendar Update Tool
Languages that are supported by the Exchange toolThe Exchange tool is available only in English. The tool will run only on an English (US) computer.Versions of Exchange Server that are compatible with the Exchange toolThe Exchange tool can update mailboxes on the following versions of Exchange Server:
Operating systems that are supported by the Exchange toolThe Exchange tool will run on the following operating systems:
What to do before you run the Exchange toolInstall updatesBefore you run the Exchange tool, make sure that client and server computers are updated correctly with the following updates:
Verify the system requirementsThe Exchange tool must be run on a computer that has Microsoft Office Outlook 2003 or Microsoft Office Outlook 2007 installed, and that has the Outlook Time Zone Data Tool installed. Additionally, Microsoft .NET Framework Version 2.0 must be installed on the client computer.Outlook and the Zone Data Update Tool for Microsoft Office Outlook are not part of the Exchange tool download package. They have to be installed separately. Note Do not confuse the Outlook tool installer package that is named Tzmove.exe with the actual Outlook tool executable file that is also named Tzmove.exe. To run the Exchange tool successfully, the computer must not have the PickLogonProfile registry value set. Alternatively, this registry value must be set to 0. To determine whether this registry value exists, follow these steps. Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756
(http://support.microsoft.com/kb/322756/
)
How to back up and restore the registry in Windows
Microsoft Exchange Calendar Update Tool cannot be
installed with Microsoft Exchange. How to manually configure and run Msextmz.exeConfigure the Msextmz.ini fileThe Msextmz.ini file must be configured correctly for Msextmz.exe to run correctly. We recommend that you read the comments in the Msextmz.ini file carefully before you modify the Msextmz.ini file.Specify the Msextmz.exe execution modeMsextmz.exe runs in two modes. To specify the mode of execution, specific parameters have to be set in the Msextmz.ini file. The following list describes the three modes and describes how to configure the modes in the Msextmz.ini file.
Configure permissions for Msextmz.exeThe permissions that are required to run Msextmz.exe depend on the execution mode that is used. The following table lists the permissions that are needed for each execution mode.Collapse this table
"Grant Mailbox Permission" scriptYou can use the sample GrantMailboxPermission.vbs script to grant a domain user Full Mailbox Access and Send As rights to all mailboxes.This script can be run only by an Exchange administrator on a computer that is running Exchange 2000 Server or Exchange Server 2003. This script cannot be run on a computer that is running Exchange Server 2007. However, you can use the Exchange Management Shell to grant the necessary permissions. The code for the VBS script is provided in the "References" section. The following table describes the two modes in which this script runs. Collapse this table
Note The output file of the Time Zone Extraction mode cannot be used as an input file for this script. To create the input file for this script, you can paste the contents of the Time Zone Extraction output file into Notepad, save the contents as a new document, and then use the new document as the input file. How logging works in Update modeLogs from the Outlook Time Zone Data Update toolWhen the Outlook tool is run, the tool creates a log file in the temp directory. This file is named "Outlook Time Zone Update.log." Msextmz.exe extracts the information from "Outlook Time Zone Update.log," and then creates per-user log files in the directory that is specified in the LogDirectory of the .ini file.These files are named by using the following format: MSExTmz-User’s CN from the User DN-Random number.LOG For example, the Outlook tool logs the following information: MSExTmz-USER3-0x0131273E.LOG The Outlook tool does this when it processes a user who has the
following DN: /O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=USER3 Error fileIf Msextmz.exe is unable to run the Outlook tool against any mailbox, the DN of the user will be logged in the error file. Msextmz.exe will not log anything to the error file if the Outlook tool ran successfully.Log fileIf the Log file option is configured in the Msextmz.ini file, the information output from Msextmz.exe to the Command Prompt window is also available in the specified file.How to run Msextmzcfg.exeMsextmzcfg.exe automates the process of extracting time zones, of resolving time zones for each user, and of generating the user lists and .ini files that are required to run Msextmzcfg.exe in Update mode. We recommend that you use Msextmzcfg.exe to perform these steps instead of performing them manually. This section describes how to run Msextmzcfg.exe.Permissions that are requiredThe account that is used to run Msextmzcfg.exe must have the following permissions on the client:
Example of the process to update an Exchange server by using Msextmzcfg.exe
What to do after you run the Exchange toolInstall updatesAfter you finish updating all Exchange servers in your environment, install the following update on the Exchange servers:926666
(http://support.microsoft.com/kb/926666/
)
Update for daylight saving time changes in 2007 for Exchange 2003 Service Pack 2
Known issues
Error messages and resolutions
REFERENCES"Grant Mailbox Permission" scriptOption Explicit
' For FileSystemObject
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
Const TristateTrue = -1
Const TristateUseDefault = -2
Const TristateFalse = 0
'Permission Type: Allow or Deny
Const ADS_ACETYPE_ACCESS_ALLOWED = &H0
Const ADS_ACETYPE_ACCESS_DENIED = &H1
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT = &H5
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = &H6
Const ADS_ACEFLAG_INHERIT_ACE = &H2
Const ADS_ACEFLAG_NO_PROPAGATE_INHERIT_ACE = &H4
Const ADS_ACEFLAG_INHERIT_ONLY_ACE = &H8
Const ADS_ACEFLAG_INHERITED_ACE = &H10
Const ADS_ACEFLAG_VALID_INHERIT_FLAGS = &H1f
Const ADS_ACEFLAG_SUCCESSFUL_ACCESS = &H40
Const ADS_ACEFLAG_FAILED_ACCESS = &H80
'Declare ADSI constants
Const ADS_SCOPE_SUBTREE = 2
Const ADS_OPTION_SECURITY_MASK = 3
Const ADS_OPTION_REFERRALS = 1
Const ADS_SECURITY_INFO_DACL = 4
Const ADS_CHASE_REFERRALS_NEVER = &h00
Const ADS_CHASE_REFERRALS_SUBORDINATE = &h20
Const ADS_CHASE_REFERRALS_EXTERNAL = &h40
'Microsoft Exchange
Const EX_MB_SEND_AS_ACCESSMASK = &H00100
Const EX_FULLMAILBOX_ACCESSMASK = 1
Const EX_MB_SEND_AS_GUID = "{AB721A54-1E2F-11D0-9819-00AA0040529B}"
'Application Parameter Index
Const ARG_INDEX_MODE = 0
Const ARG_INDEX_USERNAME = 1
Const ARG_INDEX_FILENAME = 2
Const MIN_ARG = 1
Const MODE_INVALID = -1
Const MODE_ADD = 0
Const MODE_REMOVE = 1
Const ADD = "-ADD"
Const REMOVE = "-REMOVE"
'Application Const String
Const EMPTYSTRING = ""
Const ERROR_FILENAME = "GrantMailboxPermission.err"
Const OUTPUT_FILENAME = "GrantMailboxPermission.log"
Dim OUTPUT_DELIMITER
OUTPUT_DELIMITER = vbTab
'Logging file
Dim objFSO
Dim objfileError
Dim objfileOutput
Dim objfileImport
Dim objconn
Dim objCommand
Dim rootDSE
Dim sDomainContainer
Dim sUserLDAPPath
Dim objUser
Dim objSDNTsecurity
Dim objDACLNT
Dim objDACLEX
Dim objSDMailbox
Dim fFMA
Dim fSendAs
Dim AccessTypeForFMA
Dim AccessTypeForSendAS
Dim fAddedFMA
Dim fAddedSendAs
Dim fRemovedFMA
Dim fRemovedSendAs
Dim sArraySplit
Dim sOneRow
Dim sGrantedUser
Dim dArgCount
Dim cScriptMode
Dim dArgExpected
Dim fOneError
On Error Resume Next
'Parameter Checking
dArgCount = Wscript.Arguments.Count
If (dArgCount < MIN_ARG) Then
DisplaySyntax
End If
cScriptMode = MODE_INVALID
Select Case UCase(WScript.Arguments(ARG_INDEX_MODE))
Case ADD
cScriptMode = MODE_ADD
dArgExpected = ARG_INDEX_FILENAME + 1
Case REMOVE
cScriptMode = MODE_REMOVE
dArgExpected = ARG_INDEX_MODE + 1
Case Else
cScriptMode = MODE_INVALID
End Select
If (cScriptMode = MODE_INVALID Or dArgCount <> dArgExpected) Then
DisplaySyntax
End If
If (cScriptMode = MODE_ADD) Then
sGrantedUser = WScript.Arguments(ARG_INDEX_USERNAME)
If (IsValidUserName(sGrantedUser) = False) Then
DisplaySyntax
End If
End If
CreateImportExportFiles
If (cScriptMode = MODE_ADD) Then
err.Clear
'Prepare LDAP connection
Set objconn = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objconn.Provider = "ADSDSOObject"
objconn.Open "ADs Provider"
If (err.number <> 0) Then
WScript.StdOut.WriteLine("Failed to bind to Active Directory server, error:" & err.Description)
objfileError.WriteLine("Failed to bind to Active Directory server, error:" & err.Description)
WScript.Quit
End If
Set rootDSE = GetObject("LDAP://rootDSE")
sDomainContainer = rootDSE.Get("defaultNamingContext")
If (err.number <> 0) Then
WScript.StdOut.WriteLine("Failed to find a Domain Container:" & err.Description)
objfileError.WriteLine("Failed to find a Domain Container:" & err.Description)
WScript.Quit
End If
Set objCommand.ActiveConnection = objconn
Do While objfileImport.AtEndOfStream <> True
fOneError = False
sUserLDAPPath = EMPTYSTRING
err.Clear
sOneRow = Trim(objfileImport.ReadLine)
If sOneRow <> EMPTYSTRING Then
sUserLDAPPath = GetLDAPPathFromLegacyDN(sOneRow)
If (err.number <> 0) Then
objfileError.WriteLine("Failed to get user's LDAP path from " & sOneRow)
fOneError = True
err.Clear
End If
If (fOneError = False) Then
Set objUser = GetObject(sUserLDAPPath)
If (err.number <> 0) Then
objfileError.WriteLine("Failed to get user object from " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
End If
If (fOneError = False) Then
Set objSDMailBox = objUser.MailboxRights
Set objDACLEX = objSDMailbox.DiscretionaryAcl
Set objSDNTsecurity = objUser.ntSecurityDescriptor
Set objDACLNT = objSDNTsecurity.DiscretionaryAcl
If (err.number <> 0) Then
objfileError.WriteLine("Failed to get DACL of " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
End If
' Check Full Mailbox Access and Send As permission
fFMA = False
fSendAs = False
AccessTypeForFMA = ADS_ACETYPE_ACCESS_ALLOWED
AccessTypeForSendAS = ADS_ACETYPE_ACCESS_ALLOWED
If (fOneError = False) Then
CheckFullMailboxAccess objDACLEX, sGrantedUser, fFMA, AccessTypeForFMA
CheckSendAs objDACLNT, sGrantedUser, fSendAs, AccessTypeForSendAS
If (err.number <> 0) Then
objfileError.WriteLine("Failed to Check permission of " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
End If
'If we don't have either SendAS or FMA, we're going to add these permission
If ( (AccessTypeForFMA = ADS_ACETYPE_ACCESS_DENIED) Or (AccessTypeForSendAs = ADS_ACETYPE_ACCESS_DENIED_OBJECT) ) Then
'Deny access already granted, won't add permission to this user
objfileError.WriteLine("Deny permission already added: " & sUserLDAPPath)
fOneError = True
End If
If ( fOneError = False And ((fFMA = False) Or (fSendAs = False)) ) Then
fAddedFMA = False
fAddedSendAs = False
If (fFMA = False) Then
'Add FMA permission
err.Clear
AddAce objDACLEX, sGrantedUser, EX_FULLMAILBOX_ACCESSMASK, ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0,0,0
objSDMailbox.DiscretionaryAcl = objDACLEX
objUser.MailboxRights = Array(objSDMailbox)
If ( err.number <> 0 ) Then
objfileError.WriteLine("Failed to add FullMailbox Access: " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
fAddedFMA = False
err.Clear
Else
fAddedFMA = True
End If
End If
If (fSendAs = False) Then
'Add SendAs permission
err.Clear
AddAce objDACLNT, sGrantedUser, EX_MB_SEND_AS_ACCESSMASK, ADS_ACETYPE_ACCESS_ALLOWED_OBJECT, 0,1, EX_MB_SEND_AS_GUID, 0
objSDNTsecurity.DiscretionaryAcl = objDACLNT
objUser.Put "ntSecurityDescriptor", Array( objSDNTsecurity )
objUser.SetOption ADS_OPTION_SECURITY_MASK, ADS_SECURITY_INFO_DACL
If ( err.number <> 0 ) Then
objfileError.WriteLine("Failed to add SendAs permission: " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
fAddedSendAs = False
err.Clear
Else
fAddedSendAs = True
End If
End If
If (fOneError = False ) Then
objUser.SetInfo
If (err.number <> 0) Then
objfileError.WriteLine("Failed to update user: " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
Else
'Update Logging
objfileOutput.WriteLine(sUserLDAPPath & OUTPUT_DELIMITER & fAddedFMA & OUTPUT_DELIMITER & fAddedSendAs)
End If
End If
End If
Set objUser = Nothing
Set objSDNTsecurity = Nothing
Set objDACLNT = Nothing
Set objDACLEX = Nothing
Set objSDMailBox = Nothing
If (fOneError = True) Then
WScript.StdOut.Write("!")
Else
WScript.StdOut.Write(".")
End If
End If
Loop
Set rootDSE = Nothing
Set objCommand = Nothing
Set objconn = Nothing
End If
If (cScriptMode = MODE_REMOVE) Then
'Retreive the granted user from the first line of import file
sGrantedUser = objfileImport.ReadLine
If (IsValidUserName(sGrantedUser) = False) Then
WScript.StdOut.WriteLine("Invalid User in import file. please check import file..")
objfileError.WriteLine("Invalid User in import file. please check import file..")
WScript.Quit
End If
Do While objfileImport.AtEndOfStream <> True
fOneError = False
sUserLDAPPath = EMPTYSTRING
fAddedFMA = False
fAddedSendAs = False
fRemovedFMA = False
fRemovedSendAs = False
err.Clear
sOneRow = objfileImport.ReadLine
sArraySplit = Split(sOneRow, OUTPUT_DELIMITER)
'First column is Ldap path
sUserLDAPPath = sArraySplit(0)
'Second column is FullMailbox Permission
fAddedFMA = sArraySplit(1)
'Third column is SendAs
fAddedSendAs = sArraySplit(2)
Set objUser = GetObject(sUserLDAPPath)
If (err.number <> 0) Then
objfileError.WriteLine("Failed to get user object from " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
If ((fOneError = False) And (fAddedFMA = "True")) Then
Set objSDMailBox = objUser.MailboxRights
Set objDACLEX = objSDMailbox.DiscretionaryAcl
fRemovedFMA = RemoveFullMailboxAccess(objDACLEX, sGrantedUser)
If (err.number <> 0) Then
objfileError.WriteLine("Failed to Remove Full MailboxAccess from " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
If (fRemovedFMA = False) Then
objfileError.WriteLine("Couldn't find Full mailbox access permission on " & sUserLDAPPath)
End If
If ((fOneError = False) And (fRemovedFMA = True)) Then
objSDMailbox.DiscretionaryAcl = objDACLEX
objUser.MailboxRights = Array(objSDMailbox)
End If
End If
If ((fOneError = False) And (fAddedSendAs = "True")) Then
Set objSDNTsecurity = objUser.ntSecurityDescriptor
Set objDACLNT = objSDNTsecurity.DiscretionaryAcl
fRemovedSendAs = RemoveSendAs(objDACLNT, sGrantedUser)
If (err.number <> 0) Then
objfileError.WriteLine("Failed to Remove SendAs from " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
End If
If (fRemovedSendAs = False) Then
objfileError.WriteLine("Couldn't find SendAs permission on " & sUserLDAPPath)
End If
If ((fOneError = False) And (fRemovedSendAs = True)) Then
objSDNTsecurity.DiscretionaryAcl = objDACLNT
objUser.Put "ntSecurityDescriptor", Array( objSDNTsecurity )
objUser.SetOption ADS_OPTION_SECURITY_MASK, ADS_SECURITY_INFO_DACL
End If
End If
If ((fOneError = False) And (fRemovedFMA Or fRemovedSendAs)) Then
objUser.SetInfo
If (err.number <> 0) Then
objfileError.WriteLine("Failed to update ADSI for user: " & sUserLDAPPath)
objfileError.WriteLine("Error: " & err.Description)
fOneError = True
err.Clear
Else
If ( fRemovedFMA Or fRemovedSendAs ) Then
'Update Logging
objfileError.WriteLine("Removed Permission from " & sUserLDAPPath & OUTPUT_DELIMITER & fRemovedFMA & OUTPUT_DELIMITER & fRemovedSendAs)
End If
End If
End If
If (fOneError = True) Then
WScript.StdOut.Write("!")
Else
WScript.StdOut.Write(".")
End If
Loop
End If
CloseImportexportFiles
Function IsValidUserName (sUserName)
Dim dPosition
dPosition = InStr(1, sUserName, "\")
If (dPosition = 0 ) Then
IsValidUserName = False
objfileError.WriteLine("Invalid User:" & sUserName)
Else
IsValidUserName = True
End If
End Function
Function CheckSendAs (objNTSD, sUser, fSendAs, AccessType)
Dim intACECount
Dim objACE
err.Clear
fSendAs = False
AccessType = ADS_ACETYPE_ACCESS_ALLOWED
intACECount = objNTSD.AceCount
If intACECount Then
For Each objACE In objNTSD
err.Clear
If ( (UCase(objACE.Trustee) = UCase(sUser)) And (objACE.ObjectType = EX_MB_SEND_AS_GUID) ) Then
fSendAs = True
AccessType = objACE.AceType
End If
Next
End If
If (err.number <> 0) Then
objfileError.WriteLine("Check SendAs permissions Failed : " & sUser)
objfileError.WriteLine("Error: " & err.Description)
err.Clear
fOneError = True
End If
Set objACE = Nothing
End Function
Function CheckFullMailboxAccess (objACL, sUser, fFoundFMA, AccessType)
Dim intACECount
Dim objACE
err.Clear
fFoundFMA = False
AccessType = ADS_ACETYPE_ACCESS_ALLOWED
intACECount = objACL.AceCount
If intACECount Then
For Each objACE In objACL
If ( (UCase(objACE.Trustee) = UCase(sUser)) And ((objACE.AccessMask And EX_FULLMAILBOX_ACCESSMASK) <> 0)) Then
fFoundFMA = True
AccessType = objACE.AceType
End If
Next
End If
If (err.number <> 0) Then
objfileError.WriteLine("Check FullMailbox permissions Failed : " & sUser)
objfileError.WriteLine("Error: " & err.Description)
err.Clear
fOneError = True
End If
Set ObjACE = Nothing
End Function
Function RemoveSendAs (objNTSD, sUser)
Dim intACECount
Dim objACE
Dim fFound
fFound = False
intACECount = objNTSD.AceCount
If intACECount Then
For Each objACE In objNTSD
If ((UCase(objACE.Trustee) = UCase(sUser)) And (objACE.ObjectType = EX_MB_SEND_AS_GUID) ) Then
objNTSD.RemoveAce objACE
fFound = True
End If
Next
End If
RemoveSendAs = fFound
End Function
Function RemoveFullMailboxAccess (objACL, sUser)
Dim intACECount
Dim objACE
Dim fFound
fFound = False
intACECount = objACL.AceCount
If intACECount Then
For Each objACE In objACL
If((0 <> Instr(UCase(objACE.Trustee), UCase(sUser))) And (objACE.AccessMask And EX_FULLMAILBOX_ACCESSMASK) <> 0) Then
objACE.AccessMask = (objACE.AccessMask Xor EX_FULLMAILBOX_ACCESSMASK)
fFound = True
End If
Next
End If
RemoveFullMailboxAccess = fFound
End Function
Function GetLDAPPathFromLegacyDN (sLegacyDN)
Dim rsUsers
Dim sLdapPath
objCommand.CommandText = "<GC://" & sDomainContainer & ">;(&(&(& (mailnickname=*) (| (&(objectCategory=person)(objectClass=user)(legacyExchangeDN=" & sLegacyDN & ")) ))));adspath;subtree"
objCommand.Properties("searchscope") = ADS_SCOPE_SUBTREE
objCommand.Properties("Page Size") = 10
objCommand.Properties("Timeout") = 30
objCommand.Properties("Chase referrals") = (ADS_CHASE_REFERRALS_SUBORDINATE Or ADS_CHASE_REFERRALS_EXTERNAL)
err.Clear
Set rsUsers = objCommand.Execute
If (err.number <> 0) Then
objfileError.WriteLine("Search for mailbox owners failed, error:" & err.Description)
fOneError = True
End If
If (rsUsers.RecordCount = 0) Then
objfileError.WriteLine("No mailbox owner user accounts found for " & sLegacyDN & " in " & sDomainContainer & ".")
fOneError = True
End If
If (rsUsers.RecordCount > 1) Then
objfileError.WriteLine("Multiple mailboxs owner user accounts found for " & sLegacyDN & " in " & sDomainContainer & ".")
fOneError = True
End If
sLdapPath = Replace(rsUsers.Fields(0).Value, "GC://", "LDAP://")
GetLDAPPathFromLegacyDN = sLdapPath
Set rsUsers = Nothing
End Function
Function CloseImportexportFiles
objfileError.WriteLine("*******************************************************")
objfileError.WriteLine("End at " & Date & " " & Time)
objfileError.WriteLine("*******************************************************")
objFSO.Close
objfileError.Close
objfileOutput.Close
objfileImport.Close
Set objFSO = Nothing
Set objfileError = Nothing
Set objfileOutput = Nothing
Set objfileImport = Nothing
End Function
Function CreateImportExportFiles
Dim sErrorsFileName
Dim sImportFileName
Dim sOutputFileName
err.Clear
Set objFSO = CreateObject("Scripting.FileSystemObject")
sErrorsFileName = ERROR_FILENAME
sImportFileName = EMPTYSTRING
sOutputFileName = EMPTYSTRING
Select Case cScriptMode
Case MODE_ADD
sImportFileName = WScript.Arguments(ARG_INDEX_FILENAME)
sOutputFileName = OUTPUT_FILENAME
Case MODE_REMOVE
sImportFileName = OUTPUT_FILENAME 'Use output file name as import file
sOutputFileName = EMPTYSTRING
Case Else
DisplaySyntax
End Select
Set objfileError = objFSO.OpenTextFile(sErrorsFileName, ForAppending, True, TristateTrue)
objfileError.WriteLine("*******************************************************")
objfileError.WriteLine("Start at " & Date & " " & Time)
objfileError.WriteLine("*******************************************************")
If (cScriptMode = MODE_REMOVE) Then
Set objfileImport = objFSO.OpenTextFile(sImportFileName, ForReading, False, TristateTrue)
Else
Set objfileImport = objFSO.OpenTextFile(sImportFileName, ForReading, False, TristateFalse)
End If
If (sOutputFileName <> EMPTYSTRING) Then
'Check if output file already exists.
If (objFSO.FileExists(sOutputFileName)) Then
Set objfileOutput = objFSO.OpenTextFile(sOutputFileName, ForReading, False, TristateTrue)
sOneRow = objfileOutput.ReadLine
'If user name in the file is different from parameter, we can't proceed.
If ( sOneRow <> sGrantedUser ) Then
WScript.StdOut.WriteLine("The Domain\User must be the same as " & sOneRow )
WScript.Quit
End If
Set objfileOutput = objFSO.OpenTextFile(sOutputFileName, ForAppending, True, TristateTrue)
Else
Set objfileOutput = objFSO.OpenTextFile(sOutputFileName, ForWriting, True, TristateTrue)
'The first line of Log file is the user who is going to be granted the permissions
objfileOutput.WriteLine(sGrantedUser)
End If
End If
If (err.number <> 0) Then
WScript.StdOut.WriteLine("Failed to open Log file, error:" & err.Description)
WScript.Quit
End If
End Function
Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)
Dim Ace1
Set Ace1 = CreateObject("AccessControlEntry")
Ace1.AccessMask = gAccessMask
Ace1.AceType = gAceType
Ace1.AceFlags = gAceFlags
Ace1.Flags = gFlags
Ace1.Trustee = TrusteeName
'Determine whether ObjectType has to be set
If CStr(gObjectType) <> "0" Then
Ace1.ObjectType = gObjectType
End If
'Determine whether InheritedObjectType has to be set.
If CStr(gInheritedObjectType) <> "0" Then
Ace1.InheritedObjectType = gInheritedObjectType
End If
dacl.AddAce Ace1
Set Ace1 = Nothing
End Function
Function DisplaySyntax
WScript.StdOut.WriteLine("Syntax:")
WScript.StdOut.WriteLine()
WScript.StdOut.WriteLine("Grant Full mailbox access and SendAs permission to USER based on IMPORT_FILE:")
WScript.StdOut.WriteLine(" CSCRIPT " & WScript.ScriptName & " -Add DOMAIN\USER IMPORT_FILE")
WScript.StdOut.WriteLine(" NOTE: """ & OUTPUT_FILENAME & """ will be created for -Remove option ")
WScript.StdOut.WriteLine()
WScript.StdOut.WriteLine("Remove Full mailbox access and SendAs permission based on " & OUTPUT_FILENAME & ":")
WScript.StdOut.WriteLine(" CSCRIPT """ & WScript.ScriptName & """ -Remove ")
WScript.StdOut.WriteLine()
WScript.StdOut.WriteLine("For all modes, errors are saved to " & ERROR_FILENAME )
WScript.Quit
End Function
RevisionsCollapse this table
PropertiesArticle ID: 930879 - Last Review: January 15, 2008 - Revision: 22.2 APPLIES TO
| Article Translations |
Back to the top
