Exchange 2010 Deployment Permissions Reference

This topic describes the permissions that are required to set up a Microsoft Exchange Server 2010 organization. The universal security groups (USGs) that are associated with management role groups, and other Windows security groups and security principals, are added to the access control lists (ACLs) of various Active Directory objects. ACLs control what operations can be performed on each object. By understanding what permissions are granted to each role group, security group, or security principal, you can determine what minimum permissions are required to install Exchange 2010.

In some cases, the ACL isn't applied on the usual property, ntSecurityDescriptor, but on another property, such as msExchMailboxSecurityDescriptor. The directory service can't enforce security that isn't specified in the Windows security descriptor. In most cases, these ACLs are replicated to store ACLs on appropriate objects by the store service. Unfortunately, there is no tool to view these ACLs as anything other than raw binary data.

The columns of each permissions table include the following information:

• Account   The security principal granted or denied the permissions.
• ACE type   Access control entry (ACE) type
  • Allow ACE   An allow ACE allows the user or group associated with the ACE to access an item.
  • Deny ACE   A deny ACE prevents the user or group associated with the ACE from accessing an item.
• Inheritance   The type of inheritance used for child objects.
  • All indicates that the permissions apply to the object and all sub-objects.
  • Desc indicates the permissions apply to the object class listed in the On Property/Applies To row.
  • None indicates those permissions only apply the object.
• Permissions   The permissions granted to the account.
• On Property/Applies To   In some cases, permissions apply only to a given property, property set, or object class. These limited permissions are specified here.
• Comments   When applicable, this column explains why the permissions are required or provides other information about the permissions.

The permissions are generally listed in the table by the names that are used on the Active Directory Service Interfaces (ADSI) Edit (AdsiEdit.msc) Security property page in the Advanced view on the View/Edit tab. The ADSI Edit Security property page lists a much more condensed view of the permissions. The LDP tool (Ldp.exe) displays the access mask directly as a numeric value. The setup code refers to the permissions by predefined constants.

The following table shows the relationships between these values.

ADSI Edit Summary page	ADSI Edit Advanced view, View/Edit tab	ACL entries applied to a given object	Binary value (access mask in LDP)
Full Control	Full Control	WRITE_OWNER | WRITE_DAC | READ_CONTROL | DELETE | ACTRL_DS_CONTROL_ACCESS | ACTRL_DS_LIST_OBJECT | ACTRL_DS_DELETE_TREE | ACTRL_DS_WRITE_PROP | ACTRL_DS_READ_PROP | ACTRL_DS_SELF | ACTRL_DS_LIST | ACTRL_DS_DELETE_CHILD | ACTRL_DS_CREATE_CHILD	0x000F01FF
Read	List Contents + Read All Properties + Read Permissions	ACTRL_DS_LIST | ACTRL_DS_READ_PROP | READ_CONTROL	0x00020014
Write	Write All Properties + All Validated Writes	ACTRL_DS_WRITE_PROP | ACTRL_DS_SELF	0x00000028
	List Contents	ACTRL_DS_LIST	0x00000004
	Read All Properties	ACTRL_DS_READ_PROP	0x00000010
	Write All Properties	ACTRL_DS_WRITE_PROP	0x00000020
	Delete	DELETE	0x00010000
	Delete Subtree	ACTRL_DS_DELETE_TREE	0x00000040
	Read Permissions	READ_CONTROL	0x00020000
	Modify Permissions	WRITE_DAC	0x00040000
	Modify Owner	WRITE_OWNER	0x00080000
	All Validated Writes	ACTRL_DS_SELF	0x00000008
	All Extended Rights	ACTRL_DS_CONTROL_ACCESS	0x00000100
Create All Child Objects	Create All Child Objects	ACTRL_DS_CREATE_CHILD	0x00000001
Delete All Child Objects	Delete All Child Objects	ACTRL_DS_DELETE_CHILD	0x00000002
		ACTRL_DS_LIST_OBJECT	0x00000080

Extended rights are custom rights specified by individual applications. They are specified in the ACL. However, they are meaningless to Active Directory. The specific application enforces any extended rights. Examples of Exchange extended rights are "Create public folder" or "Create named properties in the information store."

Note

For information about permissions that are set during a Microsoft Exchange Server 2003 installation, see Working with Active Directory Permissions in Exchange Server 2003. For information about permissions that are set during a Microsoft Exchange Server 2007 installation, see Exchange 2007 Setup Permissions Reference.

Prepare Legacy Exchange Permissions

The permissions tables in this section show the permissions set when you execute the setup /PrepareLegacyExchangePermissions command.

Distinguished name of the object: DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Exchange Enterprise Servers	Allow ACE	All	Write Property	Exchange Information
Authenticated Users	Allow ACE	All	Read Property	Exchange Information

Distinguished name of the object: CN=AdminSDHolder,CN=System,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Exchange Enterprise Servers	Allow ACE	All	Read Property Write Property	Exchange Information

Distinguished name of the object: CN=<organization>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Exchange Domain Servers	Allow ACE	All	Write Property	Exchange Information

Prepare Active Directory Permissions

The permissions tables in this section show the permissions set when you execute the Setup /PrepareAD command.

Microsoft Exchange Container Permissions

The following table shows the permissions that are set on the Microsoft Exchange container within the configuration partition.

Distinguished name of the object: CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Installation Account	Allow ACE	All	Full Control		This is the account that is used to run /PrepareAD.
Organization Management	Allow ACE	All	Full Control
Exchange Trusted Subsystem	Allow ACE	All	Full Control
Exchange Servers	Allow ACE	All	Read
Authenticated Users	Allow ACE	None	Read Property List Contents
Public Folder Management	Allow ACE	All	Read Permissions List Contents Read Property List Object
Delegated Setup	Allow ACE	All	Read Permissions List Contents Read Property List Object

Microsoft Exchange Autodiscover Container Permissions

The following table shows the permissions set on the Microsoft Exchange Autodiscover container within the configuration partition.

Distinguished name of the object: CN=Microsoft Exchange Autodiscover,CN=Services,CN=Configuration,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Exchange Servers	Allow ACE	All	Read

Microsoft Exchange Organization Container Permissions

The permissions tables in this section show the permissions set on the Microsoft Exchange Organization and sub-containers within the configuration partition.

Distinguished name of the object: CN=<organization>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>

Account(s)	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Enterprise Admins Root Domain Admins Installation Account Organization Management	Deny ACE	All	Send As Receive As		Windows administrators aren't allowed to open mailboxes.
Enterprise Admins Schema Admins Root Domain Admins Installation Account Organization Management	Deny ACE	All	Exchange Web Services Impersonation Exchange Web Services Token Serialization		Extended right
Enterprise Admins Schema Admins Root Domain Admins Installation Account Organization Management Exchange Servers	Deny ACE	All	Store Transport Access Store Constrained Delegation Store Read Access Store Read Write Access
Authenticated Users	Deny ACE	Desc	Read Property	msExchAvailabilityUserPassword / msExchAvailabilityAddressSpace
Exchange Servers	Allow ACE	All	Control Access
Organization Management	Allow ACE	All	Read Permissions List Contents Read Property List Object
Public Folder Management	Allow ACE	All	Read Permissions List Contents Read Property List Object
NT Authority\Network Service	Allow ACE	All	Read
Exchange Servers	Allow ACE	All	Write Property	groupType
Exchange Servers	Allow ACE	All	Write Property	msExchOwningServer
Exchange Servers	Allow ACE	All	Write Property	msExchMailboxSecurityDescriptor
Exchange Servers	Allow ACE	All	Write Property	msExchUMServerWritableFlags
Exchange Servers	Allow ACE	All	Write Property	msExchDatabaseCreated
Exchange Servers	Allow ACE	All	Write Property	msExchUserCulture
Exchange Servers	Allow ACE	All	Write Property	msExchMobileMailboxFlags
Exchange Servers	Allow ACE	All	Write Property	siteFolderGUID
Exchange Servers	Allow ACE	All	Write Property	siteFolderServer
Exchange Servers	Allow ACE	All	Write Property	msExchEDBOffline
Exchange Servers	Allow ACE	All	Write Property	userCertificate
Exchange Servers	Allow ACE	All	Write Property	msExchUMDtmfMap
Exchange Servers	Allow ACE	All	Write Property	msExchBlockedSendersHash
Exchange Servers	Allow ACE	All	Write Property	Personal Information
Exchange Servers	Allow ACE	All	Write Property	Public Information
Exchange Servers	Allow ACE	All	Write Property	Exchange Information
Exchange Servers	Allow ACE	All	Write Property	msExchPatchMDB
Exchange Servers	Allow ACE	All	Write Property	publicDelegates
Exchange Servers	Allow ACE	All	Write Property	msExchUMSpokenName
Exchange Servers	Allow ACE	All	Write Property	msExchUMPinChecksum
Exchange Servers	Allow ACE	All	Write Property	legacyExchangeDN
Exchange Servers	Allow ACE	All	Write Property	msExchSafeSendersHash
Organization Management	Allow ACE	All	Create top level public folder
Public Folder Management	Allow ACE	All	Create top level public folder
Organization Management	Allow ACE	All	View information store status
Public Folder Management	Allow ACE	All	View information store status
Organization Management	Allow ACE	All	Administer information store
Public Folder Management	Allow ACE	All	Administer information store
Organization Management	Allow ACE	All	Create named properties in the information store
Public Folder Management	Allow ACE	All	Create named properties in the information store
Organization Management	Allow ACE	All	Modify public folder ACL
Public Folder Management	Allow ACE	All	Modify public folder ACL
Organization Management	Allow ACE	All	Modify public folder quotas
Public Folder Management	Allow ACE	All	Modify public folder quotas
Organization Management	Allow ACE	All	Modify public folder admin ACL
Public Folder Management	Allow ACE	All	Modify public folder admin ACL
Organization Management	Allow ACE	All	Modify public folder expiry
Public Folder Management	Allow ACE	All	Modify public folder expiry
Organization Management	Allow ACE	All	Modify public folder replica list
Public Folder Management	Allow ACE	All	Modify public folder replica list
Organization Management	Allow ACE	All	Modify public folder deleted item retention
Public Folder Management	Allow ACE	All	Modify public folder deleted item retention
Organization Management	Allow ACE	All	Create public folder
Public Folder Management	Allow ACE	All	Create public folder
Everyone NT Authority\Anonymous Logon	Allow ACE	All	Create named properties in the information store
Everyone NT Authority\Anonymous Logon	Allow ACE	All	Create public folder
Everyone NT Authority\Anonymous Logon	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ msExchPrivateMDB
Everyone NT Authority\Anonymous Logon	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ msExchPublicMDB
Exchange Servers	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ siteAddressing

Distinguished name of the object: CN=All Address Lists,CN=Address Lists Container,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	All	List Contents
Organization Management	Allow ACE	All	Write Property	msExchLastAppliedRecipientFilter msExchRecipientFilterFlags
Public Folder Management	Allow ACE	All	Write Property	msExchLastAppliedRecipientFilter msExchRecipientFilterFlags

Distinguished name of the object: CN=Offline Address Lists,CN=Address Lists Container, CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	All	Download Offline Address Book

Distinguished name of the object: CN=Addressing,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated users	Allow ACE	All	Read

Distinguished name of the object: CN=Recipient Policies,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management	Allow ACE	All	Write Property	msExchLastAppliedRecipientFilter msExchRecipientFilterFlags
Public Folder Management	Allow ACE	All	Write Property	msExchLastAppliedRecipientFilter msExchRecipientFilterFlags

Configuration Partition Container Permissions

The permissions tables in this section show the permissions set by the Setup /PrepareAD command on various containers within the configuration partition.

Distinguished name of the object: CN=Sites,CN=Configuration,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchVersion / site
Organization Management Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchVersion / site-link
Organization Management Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchPartnerId / site
Organization Management Exchange Trusted Subsystem	Allow ACE		Write Property	msExchTransportSiteFlags / site
Organization Management Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchCost / site-link
Organization Management Exchange Trusted Subsystem	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ msExchEdgeSyncEHFConnector
Organization Management Exchange Trusted Subsystem	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ msExchEdgeSyncMservConnector
Organization Management Exchange Trusted Subsystem	Allow ACE	Children	Create Child Delete Child Delete Tree	msExchEdgeSyncServiceConfig / site
Organization Management Exchange Trusted Subsystem	Allow ACE	Desc	Read Permissions List Contents Read Property List Object	/ msExchEdgeSyncServiceConfig
Organization Management Exchange Trusted Subsystem	Allow ACE	Children	Create Child Delete Child Delete Tree	msExchEdgeSyncMservConnector / msExchEdgeSyncServiceConfig
Organization Management Exchange Trusted Subsystem	Allow ACE	Children	Create Child Delete Child Delete Tree	msExchEdgeSyncEHFConnector / msExchEdgeSyncServiceConfig

Distinguished name of the object: CN=Deleted Objects,CN=Configuration,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Exchange Servers	Allow ACE	All	List Contents
Organization Administration	Allow ACE	All	Read Permission Write Permission List Contents Read Property List Object
Installation Account	Allow ACE	All	Read Permission Write Permission List Contents Read Property List Object		This is the account that is used to run /PrepareAD.
Exchange Trusted Subsystem	Allow ACE	All	Read Permission List Contents Read Property List Object

Exchange Administrative Group Permissions

The Setup /PrepareAD command also configures the following permissions on the administrative groups within the organization.

Distinguished name of the object: CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Organization Management	Allow ACE	Desc	Access Recipient Update Service	msExchExchangeServer	Allows Exchange Recipient Administrators to stamp recipients with proxy address information.
NT AUTHORITY\SYSTEM	Allow ACE	Desc	Access Recipient Update Service	msExchExchangeServer	Allows the servers to stamp recipients with proxy address information.
Public Folder Management	Allow ACE	Desc	Access Recipient Update Service	msExchExchangeServer	Allows Exchange Public Folder Administrators to stamp recipients with proxy address information.

Distinguished name of the object: CN=Advanced Security Settings,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	List Contents

Distinguished name of the object: CN=Encryption,CN=Advanced Security Settings,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	Read Property

Distinguished name of the object: CN=Arrays,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	List Contents

Distinguished name of the object: CN=Database Availability Groups,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	List Contents

Distinguished name of the object: CN=Databases,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	List Contents

Distinguished name of the object: CN=Servers,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Exchange Servers	Deny ACE	All	Receive As		Exchange Servers aren't allowed to open mailboxes.
Authenticated Users	Allow ACE	None	List Contents

Microsoft Exchange Security Groups Container Permissions

The permissions tables in this section show the permissions set on the Microsoft Exchange Security Groups container within the root domain partition.

Distinguished name of the object: OU=Microsoft Exchange Security Groups,DC=<root domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management	Allow ACE	All	Full Control
Exchange Trusted Subsystem	Allow ACE	All	Create Child Delete Child	/ Group
Exchange Trusted Subsystem	Allow ACE	Desc	Write Property	Member / group

Distinguished name of the object: CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=<root domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management	Allow ACE	All	Full Control

Distinguished name of the object: CN=ExchangeLegacyInterop,OU=Microsoft Exchange Security Groups,DC=<root domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management	Allow ACE	All	Full Control

Distinguished name of the object: CN=Exchange Servers,OU=Microsoft Exchange Security Groups,DC=<root domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Organization Management	Allow ACE	All	Full Control
Root Domain Administrators	Allow ACE	All	Read Members Write Members
Child Domain Administrators	Allow ACE	All	Read Members Write Members

Prepare Domain

The following tables show the permissions set when you execute the Setup /PrepareDomain command.

Distinguished name of the object: DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Authenticated Users	Allow ACE	All	Read Property	Exchange Information
NT AUTHORITY\NETWORK	Allow ACE	All	Read Property	Exchange Personal Information	Grants Transport service read permissions.
Exchange Servers	Allow ACE	All	Write Property	groupType
Exchange Servers	Allow ACE	All	Write Property	msExchMailboxSecurityDescriptor
Exchange Servers	Allow ACE	All	Write Property	msExchUMServerWritableFlags
Exchange Servers	Allow ACE	All	Read Property	userAccountControl
Exchange Servers	Allow ACE	All	Read Property	canonicalName
Exchange Servers	Allow ACE	All	Read Property	Exchange Personal Information
Exchange Servers	Allow ACE	All	Read Property	Exchange Information
Exchange Servers	Allow ACE	All	Write Property	msExchUserCultulre
Exchange Servers	Allow ACE	All	Read Property	memberOf
Exchange Servers	Allow ACE	All	Read Property	garbageCollPeriod
Exchange Servers	Allow ACE	All	Replication Synchronization		Extended right
Exchange Servers	Allow ACE	All	Create Child Delete Chile List Children	msExchActiveSyncDevices / User
Exchange Servers	Allow ACE	All	Write Property	msExchSafeSendersHash
Exchange Servers	Allow ACE	All	Write Property	msExchPublicDelegates
Exchange Servers	Allow ACE	All	Write Property	msExchMobileMailboxFlags
Exchange Servers	Allow ACE	All	Write Property	msExchSafeRecipientsHash
Exchange Servers	Allow ACE	All	Write Property	userCertificate
Exchange Servers	Allow ACE	All	Write Property	msExchUMDtmfMap
Exchange Servers	Allow ACE	All	Write Property	msExchBlockedSendersHash
Exchange Servers	Allow ACE	All	Write Property	msExchUMSpokenName
Exchange Servers	Allow ACE	All	Write Property	msExchUMPinChecksum
Organization Management	Allow ACE	All	Read
Organization Management	Allow ACE	All	Write Property	Exchange Information
Organization Management	Allow ACE	All	Write Property	garbageCollPeriod
Organization Management	Allow ACE	All	Write Property	legacyExchangeDN
Organization Management	Allow ACE	All	Write Property	msExchPublicDelegates
Organization Management	Allow ACE	All	Write Property	textEncodedORAddress
Organization Management	Allow ACE	All	Write Property	proxyAddresses
Organization Management	Allow ACE	All	Write Property	mail
Organization Management	Allow ACE	All	Write Property	displayNamePrintable
Organization Management	Allow ACE	All	Write Property	showInAddressBook
Organization Management	Allow ACE	All	Write Property	Exchange Personal Information
Organization Management	Allow ACE	All	Full Control	/ msExchDynamicDistributionList
Organization Management	Allow ACE	All	Write Property	adminDisplayName
Organization Management	Allow ACE	All	Write Property	displayName
Exchange Trusted Subsystem	Allow ACE	All	Read
Exchange Trusted Subsystem	Allow ACE	All	Write Property	displayName
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Public Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchPublicDelegates
Exchange Trusted Subsystem	Allow ACE	All	Write Property	adminDisplayName
Exchange Trusted Subsystem	Allow ACE	All	Full Control	/ msExchDynamicDistributionList
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Exchange Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Exchange Personal Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	garbageCollPeriod
Exchange Trusted Subsystem	Allow ACE	All	Write Property	textEncodedORAddress
Exchange Trusted Subsystem	Allow ACE	All	Write Property	showInAddressBook
Exchange Trusted Subsystem	Allow ACE	All	Write Property	legacyExchangeDN
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Personal Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	proxyAddresses
Exchange Trusted Subsystem	Allow ACE	All	Write Property	displayNamePrintable
Exchange Trusted Subsystem	Allow ACE	All	Write Property	mail
Exchange Windows Permissions	Allow ACE	All	Write Property	pwdLastSet
Exchange Windows Permissions	Allow ACE	All	Delete Tree WriteDACL	/ user
Exchange Windows Permissions	Allow ACE	All	Delete Tree WriteDACL	/ inetOrgPerson
Exchange Windows Permissions	Allow ACE	All	Write Property	sAMAccountName
Exchange Windows Permissions	Allow ACE	All	Create Child Delete Child	/ contact
Exchange Windows Permissions	Allow ACE	All	Create Child Delete Child	/ user
Exchange Windows Permissions	Allow ACE	All	Create Child Delete Child	/ organizationUnit
Exchange Windows Permissions	Allow ACE	All	Create Child Delete Child	/ group
Exchange Windows Permissions	Allow ACE	All	Create Child Delete Child	/ computer
Exchange Windows Permissions	Allow ACE	All	Write Property	Member
Exchange Windows Permissions	Allow ACE	All	Write Property	wwwHomePage
Exchange Windows Permissions	Allow ACE	All	Write Property	countryCode
Exchange Windows Permissions	Allow ACE	All	Write Property	userAccountControl
Exchange Windows Permissions	Allow ACE	All	Write Property	managedBy
Exchange Windows Permissions	Allow ACE	All	Reset Password		Extended right
Exchange Windows Permissions	Allow ACE	All	Change Password		Extended right

Distinguished name of the object: CN=AdminSDHolder,CN=System,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Exchange Servers	Allow ACE	All	Write Property	groupType
Exchange Servers	Allow ACE	All	Write Property	msExchMailboxSecurityDescriptor
Exchange Servers	Allow ACE	All	Write Property	msExchUMServerWritableFlags
Exchange Servers	Allow ACE	All	Read Property	userAccountControl
Exchange Servers	Allow ACE	All	Read Property	canonicalName
Exchange Servers	Allow ACE	All	Read Property	Exchange Personal Information
Exchange Servers	Allow ACE	All	Read Property	Exchange Information
Exchange Servers	Allow ACE	All	Write Property	msExchUserCultulre
Exchange Servers	Allow ACE	All	Read Property	memberOf
Exchange Servers	Allow ACE	All	Read Property	garbageCollPeriod
Exchange Servers	Allow ACE	All	Replication Synchronization		Extended right
Exchange Servers	Allow ACE	All	Create Child Delete Chile List Children	msExchActiveSyncDevices / User
Exchange Servers	Allow ACE	All	Write Property	msExchSafeSendersHash
Exchange Servers	Allow ACE	All	Write Property	msExchPublicDelegates
Exchange Servers	Allow ACE	All	Write Property	msExchMobileMailboxFlags
Exchange Servers	Allow ACE	All	Write Property	msExchSafeRecipientsHash
Exchange Servers	Allow ACE	All	Write Property	userCertificate
Exchange Servers	Allow ACE	All	Write Property	msExchUMDtmfMap
Exchange Servers	Allow ACE	All	Write Property	msExchBlockedSendersHash
Exchange Servers	Allow ACE	All	Write Property	msExchUMSpokenName
Exchange Servers	Allow ACE	All	Write Property	msExchUMPinChecksum
Organization Management	Allow ACE	All	Read
Organization Management	Allow ACE	All	Write Property	Exchange Information
Organization Management	Allow ACE	All	Write Property	garbageCollPeriod
Organization Management	Allow ACE	All	Write Property	legacyExchangeDN
Organization Management	Allow ACE	All	Write Property	msExchPublicDelegates
Organization Management	Allow ACE	All	Write Property	textEncodedORAddress
Organization Management	Allow ACE	All	Write Property	proxyAddresses
Organization Management	Allow ACE	All	Write Property	mail
Organization Management	Allow ACE	All	Write Property	displayNamePrintable
Organization Management	Allow ACE	All	Write Property	showInAddressBook
Organization Management	Allow ACE	All	Write Property	Exchange Personal Information
Organization Management	Allow ACE	All	Full Control	/ msExchDynamicDistributionList
Organization Management	Allow ACE	All	Write Property	adminDisplayName
Organization Management	Allow ACE	All	Write Property	displayName
Exchange Trusted Subsystem	Allow ACE	All	Read
Exchange Trusted Subsystem	Allow ACE	All	Write Property	displayName
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Public Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	msExchPublicDelegates
Exchange Trusted Subsystem	Allow ACE	All	Write Property	adminDisplayName
Exchange Trusted Subsystem	Allow ACE	All	Full Control	/ msExchDynamicDistributionList
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Exchange Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Exchange Personal Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	garbageCollPeriod
Exchange Trusted Subsystem	Allow ACE	All	Write Property	textEncodedORAddress
Exchange Trusted Subsystem	Allow ACE	All	Write Property	showInAddressBook
Exchange Trusted Subsystem	Allow ACE	All	Write Property	legacyExchangeDN
Exchange Trusted Subsystem	Allow ACE	All	Write Property	Personal Information
Exchange Trusted Subsystem	Allow ACE	All	Write Property	proxyAddresses
Exchange Trusted Subsystem	Allow ACE	All	Write Property	displayNamePrintable
Exchange Trusted Subsystem	Allow ACE	All	Write Property	mail

Distinguished name of the object: CN=Microsoft Exchange System Objects,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
NT AUTHORITY\NETWORK	Allow ACE	All	Read Property	Exchange Personal Information
Authenticated Users	Allow ACE	All	Read Permissions
Authenticated Users	Allow ACE	All	Read Property	garbageCollPeriod
Authenticated Users	Allow ACE	All	Read Property	adminDisplayName
Authenticated Users	Allow ACE	All	Read Property	modifyTimeStamp
Exchange Servers	Deny ACE	All	Delete Tree
Exchange Servers	Allow ACE	All	Read Delete Tree
Exchange Servers	Allow ACE	All	Create Child Delete Child	/ msExchSystemMailbox
Exchange Servers	Allow ACE	All		/ publicFolder
Exchange Servers	Allow ACE	Desc	Write Property	/ publicFolder
Exchange Servers	Allow ACE	Desc	Write Property	/ msExchSystemMailbox
Organization Management	Allow ACE	All	Read
Organization Management	Allow ACE	Desc	Write Property	/ msExchSystemMailbox
Organization Management	Allow ACE	All	Create Child Delete Child	/ msExchSystemMailbox
Organization Management	Allow ACE	Desc	Read Property Write Property	mail / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	displayNamePrintable / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	displayName / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	textEncodedORAddress / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	proxyAddresses / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	cn / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	showInAddressBook / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	Exchange Information / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	legacyExchangeDN / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	Exchange Personal Information / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	msDSPhoneticDisplayName / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	msExchPFContacts / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	garbageCollPeriod / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	name / publicFolder
Organization Management	Allow ACE	Desc	Read Property Write Property	msExchPublicDelegates / publicFolder
Public Folder Management	Allow ACE	All	Read
Public Folder Management	Allow ACE	Desc	Read Property Write Property	mail / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	displayNamePrintable / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	displayName / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	textEncodedORAddress / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	proxyAddresses / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	cn / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	showInAddressBook / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	Exchange Information / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	legacyExchangeDN / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	Exchange Personal Information / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	msDSPhoneticDisplayName / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	msExchPFContacts / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	garbageCollPeriod / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	name / publicFolder
Public Folder Management	Allow ACE	Desc	Read Property Write Property	msExchPublicDelegates / publicFolder
Exchange Trusted Subsystem	Allow ACE	All	Read
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	mail / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	displayNamePrintable / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	displayName / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	textEncodedORAddress / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	proxyAddresses / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	cn / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	showInAddressBook / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	Exchange Information / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	legacyExchangeDN / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	Exchange Personal Information / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	msDSPhoneticDisplayName / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	msExchPFContacts / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	garbageCollPeriod / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	name / publicFolder
Exchange Trusted Subsystem	Allow ACE	Desc	Read Property Write Property	msExchPublicDelegates / publicFolder

Server Role Installation

During installation of the Client Access, Hub Transport, Unified Messaging, and Mailbox server roles, Setup adds the Organization Management USG to the administrator security group on the local computer so that members of the management role group named Organization Management can manage the server.

The following permissions table shows the permissions set when you install the Client Access, Hub Transport, Unified Messaging, or Mailbox server roles.

Distinguished name of the object: CN=<server>,CN=Servers,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
MACHINE$	Allow ACE	All	Read
MACHINE$	Allow ACE	None	Write Property	msExchServerSite msExchEdgeSyncCredential
Exchange Servers	Allow ACE	All	Store Transport Access Store Constrained Delegation Store Read Only Access Store Read and Write Access		Extended rights
NT AUTHORITY\NETWORK	Allow ACE	All	Exchange Web Services Token Serialization		Extended right Only granted on Client Access server role objects.
NT AUTHORITY\NETWORK	Allow ACE	All	Read		Only granted on Hub Transport server role objects.
Delegated Setup	Allow ACE	All	Full Control
Delegated Setup	Allow ACE	All	Read
Delegated Setup	Deny ACE	All	Create Child Delete Child	/ msExchPublicMDB
Authenticated Users	Allow ACE	All	Read Property
Delegated Setup	Deny ACE	All	Receive As Send As		Extended right

Database Availability Groups

The permissions tables in this section show the permissions set with regards to the database availability groups and its members.

Distinguished name of the object: CN=<DAGName>,CN=Database Availability Groups,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	None	Read Properties

Distinguished name of the object: CN=<DAGName>,CN=Computers,DC=<domain>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Mailbox Server Computer Account$	Allow ACE	None	Delete Read Permissions List Contents Read Property Delete Tree List Object
Mailbox Server Computer Account$	Allow ACE	None	Write Property	Logon Information
Mailbox Server Computer Account$	Allow ACE	None	Write Property	description
Mailbox Server Computer Account$	Allow ACE	None	Write Property	displayName
Mailbox Server Computer Account$	Allow ACE	None	Write Property	sAMAccountName
Mailbox Server Computer Account$	Allow ACE	None	Write Property	Account Restrictions
Mailbox Server Computer Account$	Allow ACE	None	Write Property	Validated write to DNS host name
Mailbox Server Computer Account$	Allow ACE	None	Write Property	Validated write to service principal name

Edge Transport

If you install an Edge Transport server and establish an Edge Subscription with the Exchange organization, the permissions in the following permissions table are set when the Edge Transport server is instantiated into the organization.

Distinguished name of the object: CN=<server>,CN=Servers,CN=<admin group>,CN=Administrative Groups,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Exchange Servers	Allow ACE	All	Write Property
Authenticated Users	Allow ACE	None	Read Properties		ACE is defined in schema for msExchExchangeServer class objects defaultSecurityDescriptor.

Client Access Server Installation

During installation of the first Client Access server, the following container is created. The following permissions table shows the permissions that are applied.

Distinguished name of the object: CN=Availability Configuration,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
Exchange Servers	Allow ACE	Desc	Read Property	msExchAvailabilityUserPassword / msExchAvailabilityAddressSpaceObjects	Extended right

Hub Transport Server Installation

During installation of each Hub transport server, the following permissions are set.

Distinguished name of the object: CN=Default <Server>,CN=SMTP Receive Connectors,CN=Protocols,CN=<Server>,CN=Servers,CN=<admin group>,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
ExchangeLegacyInterop	Deny ACE	All	Accept Forest Headers
ExchangeLegacyInterop	Deny ACE	All	Accept Organization Headers
Exchange Servers	Allow ACE	All	Accept Any Sender
ExchangeLegacyInterop	Allow ACE	All	Accept Any Sender
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Any Sender		This is the well-known security identifier (SID) for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Any Sender		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Accept Any Sender		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Accept EXCH50
ExchangeLegacyInterop	Allow ACE	All	Accept EXCH50
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept EXCH50		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept EXCH50		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Accept EXCH50		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Submit Messages to any Recipient
ExchangeLegacyInterop	Allow ACE	All	Submit Messages to any Recipient
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Submit Messages to any Recipient		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Submit Messages to any Recipient		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Submit Messages to any Recipient		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Accept XShadow
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept XShadow		This is the well-known SID for Edge Transport servers.
Exchange Servers	Allow ACE	All	Accept Routing Headers
ExchangeLegacyInterop	Allow ACE	All	Accept Routing Headers
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Routing Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Routing Headers		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Accept Routing Headers		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Accept Forest Headers
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Forest Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Forest Headers		This is the well-known SID for Edge Transport servers.
Exchange Servers	Allow ACE	All	Accept Authentication Flag
ExchangeLegacyInterop	Allow ACE	All	Accept Authentication Flag
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Authentication Flag		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Authentication Flag		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Accept Authentication Flag		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Bypass Anti-Spam
ExchangeLegacyInterop	Allow ACE	All	Bypass Anti-Spam
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Bypass Anti-Spam		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Bypass Anti-Spam		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Bypass Anti-Spam		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Bypass Message Size Limit
ExchangeLegacyInterop	Allow ACE	All	Bypass Message Size Limit
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Bypass Message Size Limit		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Bypass Message Size Limit		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Bypass Message Size Limit		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Accept Organization Headers
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Organization Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Organization Headers		This is the well-known SID for Edge Transport servers.
Exchange Servers	Allow ACE	All	Submit Messages to Server
ExchangeLegacyInterop	Allow ACE	All	Submit Messages to Server
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Submit Messages to Server		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Submit Messages to Server		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Submit Messages to Server		This is the well-known SID for externally secured servers.
Exchange Servers	Allow ACE	All	Accept Authoritative Domain Sender
ExchangeLegacyInterop	Allow ACE	All	Accept Authoritative Domain Sender
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Accept Authoritative Domain Sender		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Accept Authoritative Domain Sender		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Accept Authoritative Domain Sender		This is the well-known SID for externally secured servers.
Authenticated Users	Allow ACE	All	Submit Messages to any Recipient
Authenticated Users	Allow ACE	All	Accept Routing Headers
Authenticated Users	Allow ACE	All	Bypass Anti-Spam
Authenticated Users	Allow ACE	All	Submit Messages to Server

Distinguished name of the object: CN=Client <Server>,CN=SMTP Receive Connectors,CN=Protocols,CN=<Server>,CN=Servers,CN=<admin group>,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to
Authenticated Users	Allow ACE	All	Submit Messages to any Recipient
Authenticated Users	Allow ACE	All	Accept Routing Headers
Authenticated Users	Allow ACE	All	Bypass Anti-Spam
Authenticated Users	Allow ACE	All	Submit Messages to Server

SMTP Send Connector Creation

The following table shows the permissions set when you create Send connectors.

Distinguished name of the object: CN=<Connector Name>,CN=Connections,CN=<routing group>,CN=Routing Groups, CN=<admin group>,CN=<organization>

Account	ACE type	Inheritance	Permissions	On property/ Applies to	Comments
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Send Organization Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Send Organization Headers		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Send Forest Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Send Forest Headers		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Send XShadow		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Send XShadow		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-10	Allow ACE	All	Send Routing Headers		This is the well-known SID for partner servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Send Routing Headers		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Send Routing Headers		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Send Routing Headers		This is the well-known SID for externally secured servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-24	Allow ACE	All	Send Routing Headers		This is the well-known SID for Legacy Exchange servers.
NT AUTHORITY\ANONYMOUS LOGON	Allow ACE	All	Send Routing Headers
S-1-9-1419165041-1139599005-3936102811-1022490595-21	Allow ACE	All	Send Exch50		This is the well-known SID for Hub Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-22	Allow ACE	All	Send Exch50		This is the well-known SID for Edge Transport servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-23	Allow ACE	All	Send Exch50		This is the well-known SID for externally secured servers.
S-1-9-1419165041-1139599005-3936102811-1022490595-24	Allow ACE	All	Send Exch50		This is the well-known SID for Legacy Exchange servers.