So we are moving from Ex2k3, to 2010... the only problem I have is that for some odd reason, my FSO (Field Security Officer) needs to see some verbiage from MS or anyone else for that matter, defining the permissions of the Exchange Enterprise Server (EES) group in AD.
So here's the issue: The concern is the level of permission the EES group has on the Domain Controllers OU in AD. When the permission set is viewed in AD, the ESS group does not appear to have any other permission outside of Read and List. However, when looking at the Advanced Security Settings feature, for the Domain Controller OU, the EES group has a special "Write Property" list under permissions. When selecting any of the entries for EES with "Write Property", and clicking the "Edit" button, no permissions are selected i.e. of all the possible permissions that could be set; none of them are selected or have check mark in the boxes corresponding to the available permission. So the question is: What if any, permissions do the Exchange Enterprise Server group have on the objects listed in the Domain Controllers OU?
For sh$ts and giggles, I looked at the same permission group on a 2k8 server, and the write permission does not show up.
Thanks in advance!!! for any help provided...