Temporary permissions to all archives

[Cheryle_Weather]

Hi All,

I am working on a project which will require 3 helpdesk analysts to have read/write/delete permissions to everyone's archives.  This will only be until the project is completed.

What would be the easiest way to accomplish this?  Whenever I have used the evpm scripts to grant all, I've had to run it again to deny all.  This leaves the user in the perms list.

EV 7.5 sp1 on exchange 2007

thank you!

[MichelZ]

Unfortunately, I think EVPM is your best bet. The other option(s) would be: - Grant permissions in Active Directory (The then can view the Exchange Mailbox, too) - Grant permissions in the GUI (This takes a really long time) - Grant permissions via the API (Probably too complicated for most people, and requires an API license) Cheers Michel

[Wayne_Humphrey]

"Unfortunately, I think EVPM is your best bet."

Why unfortunately? there is nothing wrong with EVPM?

GUI = lame admins :)

[Cheryle_Weather]

Ok, well EVPM is easy enough, just don't like that it leaves the user in the perms list with a "deny all".  Would rather it just be stripped away.  Oh well, wish in one hand and you-know-what in the other...

Thanks!

[MichelZ]

Yes, that's why I said "unfortunately", because in the GUI you can remove the permissions completely, without denying, I think ;)

[Wayne_Humphrey · Accepted solution]

Just to save you diving into the docs, im feeling happy tonight so here you go:

[Directory]
directorycomputername = evdir
sitename = evsite

[ArchivePermissions]
ArchiveName = ALL_MAILBOX
DenyAccess = delete, domain\groupwhocannotdelete
GrantAccess = read write delete, domain\userwhocandelete

ArchiveName = ALL_JOURNAL
GrantAccess =  read write delete, domain\userwhocandelete

[Cheryle_Weather]

I created a group in AD hoping that this would allow me to grant/deny access based on group membership.  The script seems to be processing mailboxes, however, there is no change in the perms list even after provisioning and resynching.

Here is the script... what am I missing?  This will work if I change the ArchiveName to a single DN, but seems to have issues with "All_mailbox".

Any suggestions?

[Directory]
directorycomputername = vault.wsgr.com
sitename = wsgr

[ArchivePermissions]
ArchiveName = ALL_MAILBOX
GrantAccess = read write delete, wsgrdom\vault project

[Joseph_Rodgers]

Cheryle,

Just a quick check, did you Refresh your EV Admin console (highlight the "Archive" category and press F5)?  It won't reflect the changes until you do so.

-Joe

[Wayne_Humphrey]

Did EVPM thow any errors?  If not then it could be AD replication or as Joe says a refresh of the MMC.

[Cheryle_Weather]

OMG... I'm an idiot!  I just needed to refresh... DOH

Thanks!

[Wayne_Humphrey]

Easily forgotten :)

Please remember to mark your thread as resolved.

[Joseph_Rodgers]

Cheryle,

Don't feel too much like an idiot I drill this into every student & client I have, the MMC is a static view and when in doubt refresh and then I promptly forgot my own advice time after time!

-Joe

[MichelZ]

Maybe we should file an enhancement request for an auto-refresh feature ;)

[Wayne_Humphrey]

NO PLEASE NO! *g* could you imagine an auto refresh when you have 200,000 archives? Think about it :p

[MichelZ]

Configurable that you can disable it? :D

[Wayne_Humphrey]

You are dreaming then :)