Delegate Object Creation when Full Exchange Admin Permission already applied

Question

So I have a task of restricting Exchange Administrators access to certain OUs. We have a Forest and the accounts reside in a sub domain to the forest root. In sub domains Admins have full control. In the Forest Root they need access to create contacts only.

For the Exchange settings they have the permissions needed to create all their tasks in the sub domain but it means they have the permissions in the root domain as well since we use the Exchange Groups built in.

Using AD Delegation I've Denied User Objects Full Control access for the Domain and it doesn't appear to block account creation. If I deny read access to an OU they can't see it.

How would I go about restricting User account creation? What am I missing?

Answer 1

Hi,

Did you try create a group in root domain , set delegation for this group then add admin account from child domain?

The group scope in root domain must be local to accept members from another domain.

Please if this reply help you to fix your issue mark it as answer

Answer 2

Hello,

Thank you so much for posting here.

We mainly focus on the AD issue since we are not professional with exchange issue. In AD, if we would like to restrict user account creation for certain user, we could try the below.

1, Create the new OU and then add the specific user accounts to the OU.
2, Right click the OU and choose "Properties", then choose "Security" tab.
3, Select Advances button. For example:

4, Select the ADD button

5, Then, from the list with the permissions entries, add the users or groups you do not want them to create the user account.
In the Type checkbox, select: Deny
In the Applies to dropdown box select: This Object and all descendant objects

6, Click "Clear all" and then check "Create User objects". For example:

7, When the user tried to create the user account, Access is denied was shown. For example:

Hope the information is helpful. We could kindly have a recheck whether it is helpful to solve our issue. For any question, please feel free to contact us.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.