Re: Audit exchange 2000 permission

From: John Speare [MSFT] (jspeare_at_online.microsoft.com)
Date: 05/13/04 

Date: Thu, 13 May 2004 10:57:01 -0700

There are a couple ways to do this. The tedious way, and the less tedious
way. :)

You can use ADSIedit (or AD Users and Computers snap-in in "Advanced" mode,
which is toggled by clicking "Advanced Features" on the view menu; this will
then display a Security tab for each object on the object's property page,
which in turn, has an "Advanced" button) if you are more comforatable
clicking through an MMC UI. If you fiddle around with the UI here (with a
"view-only" perms account to be safe), it becomes pretty apparent how things
are laid out and you can then look at permissions on each object. Note that
to really get a good picture of the permissions on Exchange objects in the
AD using this method, it will take quite some time.

The quicker way to do this is by using DSACLS, a command line tool that
allows you to specify a given object in the AD (such as the Exchange
organization object) and get the permissions associated with that object. I
find it helpful to have ADSIedit/Advanced view of ADUC open, as I enter the
commands into DSACLS. Be forwarned that DSACLS is pretty finicky about
syntax. Again, you should use a view-only account here, as this is a pretty
powerful tool.

Information on DSACLS is here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;281146 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
"Javier" <jbisono@tricom.com.do> wrote in message 
news:eXVBHTGOEHA.3264@tk2msftngp13.phx.gbl...
> Hi,
>
> Platform : windows 2000 advance server, exchange 2000 enterprise edition,
> active directory.
>
> I'd like to get any information about how to audit exchange 2000 
> permission.
>
> Thank You.
>
>