FSA on a Filesever that is also DC

[Jens_Monrad]

A customer who wants to use FSA on a Fileserver which also serves as a DC.  Since it is not possible to grant local user rights, I may be forced to use a domain admin account? Or have you guys tried other workarounds.

If I use a domain admin account, I would also be forced to look into the rights within Exchange as they use Mail Archiving as well ? (I know domain admins are denied as send as and receive as)

[MichelZ]

Jens

No, you don't need a Domain Admin Account.
You can make the VSA a "local admin" on the DC's by adding the Account to the "BUILTIN\Administrators" Group of your Domain. (Which is the "Administrators" Group for all your Domain Controllers).

But remember that granting BUILTIN\Administrators right gives the User the ability to promote itself to higher Permissions, so a "BUILTIN\Administrators" right is *almost* the same as a Domain Admin in the end....

Cheers
Michel

[jimbo2]

I agree with MichelZ.

Also remember that you should be able to run the FSA task under a separate account. Not sure if this helps.

Jim S