Vault Service Account and Exchange Server Admin

Honestly i have no idea, if you can test that would be the best thing to do, i've always added EV as the local admin so no idea if it should have that level of access or not...

My suggestion is as above, if you have a test exchange server, remove the EVAdmin from the local admins and see what happens

In my lab i have a DC with Exchange 2010 on the same box. since it's a DC there is no local admin group. I just used the powershell scripts to assign the proper rights for the EV (9.02) service account and it works fine.

there is a local admin group on a DC, you just have to set it via AD

AndrewB,

So I'm assuming since it isn't a BP your Vault Service account isn't a Domain Admin.  Also when you say "used the powershell scripts to assign the proper rights for the EV (9.02) service account and it works fine" that you are referring to the scripts that assign mailbox level permissions to the VSA and not specific admin rights on the server.  So it would seem in your scenario the VSA is not a admin on the Exchange box and your EV is working ok.  Is this correct?

JesusWept2,

I can certainly test it out, however I was hoping for a specific statement from Symantec on it, and perhaps since I can't find it in their documentation anymore than the statement is that the VSA doesn't need to be a local admin.  The problem I'm having is that our Security/Compliance people want all admins removed from the Exchange servers unless there is a documented reason for them to be there.  So if the VSA needs to be there I need to show them Symantec documentation showing this as a requirement.

Thanks!

no the VSA is not a domain admin. should be documented somewhere not to do it.

yes, the scripts i'm referring to are: SetEVExchangePermissions.ps1 and SetEVThrottlingPolicy.ps1

although i don't see it in the documentation either, i'm with JW that you should test in your environment before making such a change anyway.

I don't think I've ever given the VSA local admin rights on the Exchange servers, except in labs when I've done other stuff with the same server.

I'm curious to why you would need to ?

I did find this article:

http://www.symantec.com/business/support/index?page=content&id=TECH48928&actp=search&viewlocale=en_US&searchid=1302091590088

It lists pretty much all versions from 9.0 on down and it says this "Make sure you add the VSA to the Local Administrators group on the new Exchange server(s)".  So I guess that answers my question and provides the documentation I'm looking for. 

It does seem odd though that I can't find this in the admin guide or the installation guide, if this is a requirement you would think it would be in one of those documents.

Thanks everyone for the comments!