Reducing permissions required to run Exchange Server when you use the Shared Permissions Model

Scenario

Consider the following scenario:

• You are running Exchange Server by using the Shared Permissions Model that is installed by default for Exchange Server.

• Access Control Entries are put into the Active Directory forest. This gives Exchange Server an elevated level of directory permission.

Cause

Exchange Server is a directory services-enabled application. Therefore, it must be able to modify attributes that are related to Exchange Server-enabled objects. This includes the ability to modify Discretionary Access Control Lists (DACLs) in some instances. Because these objects can exist anywhere in the domain hierarchy, Exchange Server grants rights to servers that are running Exchange Server at the root of the domain. This is done to make sure that the rights are passed on to all applicable objects.

Exchange Server does not currently make use of the Inherit Only flag when DACL propagation is evaluated. This does not apply to the Active Directory Split Permissions model. In a split permissions configuration, Exchange Server applies a permissions model that does not grant servers the ability to create or modify security principals in the directory.

Status

This behavior is by design. It provides Exchange administrators the flexibility to manage attributes on Exchange Server objects that are consistent with their role as an Exchange administrator. Exchange administrators are expected to be able to create user accounts and mailboxes, and reassign mailbox-type objects as resource mailboxes or shared mailboxes if Exchange Server is running in the Shared Permissions Model.

Resolution

Microsoft has evaluated the rights that are granted to servers that are running Exchange Server and to Exchange administrators in the identified scenarios. Microsoft has determined that it is possible to make changes that lower the permissions that are granted within an Active Directory domain. The actual permission changes will vary depending on the version of Exchange Server that is used.

The procedure in this section returns all environments to a common, reduced directory permission profile.

To resolve this issue on Exchange Server 2013 or a later version, customers should install the following cumulative update, as appropriate for their environment:

• Exchange Server 2019 – Cumulative Update 1

• Exchange Server 2016 – Cumulative Update 12

• Exchange Server 2013 – Cumulative Update 22

Environments in which Exchange Server 2013 or a later version is in use require the updated cumulative update package to manually execute /PrepareAD in any Active Directory forest in which Exchange Server is installed or in which the directory schema has been prepared to host servers that are running Exchange Server. Additionally, customers who employ multiple domains in a single forest will have to run /PrepareDomain in all domains in the forest to lower the permissions that are granted to Exchange Server and to Exchange administrators.

Note The /PrepareDomain operation automatically runs in the Active Directory domain in which /PrepareAD is run. However, it may not be able to update other domains in the forest. For this reason, a domain administrator should run /PrepareDomain in other domains in the forest.

For more information about the /Prepare switches that are used by Exchange Server, see Prepare Active Directory and domains for Exchange Server.

The prepare operations in these updated cumulative updates make the following changes to the Active Directory environment.