Security problem for restore and archive explorer problem

[Jason_Mok]

Hi ,



As the scenario, have two domain in this site , one is Win NT4 domain, and the second one is Win2K AD, NT4 domain have a one-way trust to Win2K, all of user account use clonepr(ADMT) to clone SID from NT4 to Win2K, all of the user right are same between them. EV Server and all of user are stand in Win2K Domain, Exchange5.5 is stand in WinNT domain.

Problem: user cannot restore after search, I discover that we must add the user in local admin group(EV machine) and restart the task controller service, it will be normal, but it may be have security issue, pls advise how to do

Another problem, user cannot use archive explorer to restore, only service account can to do it. It may prompt the error
"Fail to copy item,
Reason : cannot log on, Incorrect server or mailbox.
Click "OK"to continue or "cancel" to stop the operation

Pls advise how to do

Best regards

Jason

[Aaron_Mears]

Where does the EV Service Account reside and what rights does the EV Service Account have to the other domain?

Have you tried explicitly adding Win2K users to the Archive permissions from the Exch 5.5 server mailbox (in EV)

Aaron

[Michael_Bilsbor]

Hi,

You need to ensure that the user doing the restore has sufficient permissions to write back to the mailbox.

What access do they have. Remember it's the account that you are logged into that is used.

[Jason_Mok]

Hi,

The service account is local admin group in EV machine, service account admin in exchange 5.5 in site and Organization Setting, Normal user will be domain user.

Normal user can use Outlook toolbar to restore, restore after search i try it ok if assign local admin right in EV machine, but it is not reasonable.

[David_Messeng1]

Jason,

I think Dodo is after the permissions assigned to the Archive in the EV Administration console.

What is the O/S on the EV server?


David

[Jason_Mok]

O/S is Win2003 Enterprise Server
EV Version 6.0

Target Exchange is 5.5(SP4) in WinNT(SP6)

[David_Messeng1]

Do you have Win2K3 SP1 on the EV server? Check out:

http://seer.support.veritas.com/docs/279588.htm

and

http://forums.veritas.com/discussions/thread.jspa?forumID=106&threadID=55543&messageID=4401357⣍

[Tremaine]

If you go to the permissions of the Mailboxes in the NT 4 domain, do the mailboxes have the w2k users added as mailbox owners on the permissions tab (not just mapped to the w2k account)

Then also if you look at the permissions on the Archive in the vault admin console what permissions do you see applied to the archive?

Cheers