How to get service account access to all mailboxes in Exchange 2000
This article was previously published under Q262054
This article has been archived. It is offered "as is" and will no longer be updated.
In Microsoft Exchange Server 5.5, when you grant Service Account Admin privileges on the Site container to a Microsoft Windows account, you grant that account unrestricted access to all mailboxes. In Exchange 2000, there is no service account, and even accounts with Enterprise Administrators rights are denied rights to access all mailboxes, by default.
In some cases (for example, offline recovery of an entire mailbox database), it may still be useful to grant permissions to all mailboxes without having to explicitly do it mailbox by mailbox. This article explains how to do this.
Note Do not use this procedure in a production environment to allow unauthorized access to user data in violation of corporate policies regarding privacy and security. Implement an auditing plan on your network to detect and record improper use of network privileges by system administrators.
For an Exchange 2003 version of this article, view the following article in the Microsoft Knowledge Base:
821897 How to assign service account access to all mailboxes in Exchange Server 2003
If your logon account is the Administrator account or is a member of the Domain Admins or Enterprise Admins groups, then you are explicitly denied access to all mailboxes other than your own, even if you otherwise have full administrative rights over the Exchange system. Unlike Exchange Server 5.5, all Exchange 2000 administrative tasks can be performed without having to grant an administrator sufficient rights to read other people's mail.
This default restriction can be overridden in several ways, but again, doing so should be in accordance with your organization's security and privacy policies. In most cases, using these methods is appropriate only in a recovery server environment.
Method OneIf you are NOT the Administrator, or a member of the Domain Admins or Enterprise Admins groups, then you can add your account to the Exchange Services or Exchange Domain Servers groups, and you will be allowed full access to all mailboxes on servers in the domain.
Note The Exchange Services group may not exist if you have never deployed the Active Directory Connector in your organization.
Method TwoTo grant your administrative account access through Exchange System Manager to all the mailboxes that are in a single database (regardless of inherited explicit denials), follow these steps:
- Create an appropriately-scoped security group in the Microsoft Active Directory directory service. For example, create a global security group that is named EXCHANGE_RECOVERY.
- Add the group or the user account (or user accounts) that you want to use for general mailbox access to this security group. You must log off and then log back on before your membership in this group takes effect.
- In Exchange System Manager, grant this security group permissions on the database or server object that contains the mailboxes that you want to access. If the purpose of granting such access is to permit use of the ExMerge utility, grant Receive As permissions. You can also grant Full Control permissions if you want complete access.
Article ID: 262054 - Last Review: 12/05/2015 20:04:10 - Revision: 3.4
Microsoft Exchange 2000 Server Standard Edition
- kbnosurvey kbarchive kbinfo KB262054