locked
Please help - Unable to assign Exchange Full Administrator RRS feed

  • Question

  • I'm trying to install a 2nd exchange server in our environment. The only Exchange Full Administrator account seems to be the built-in administrator account. I don't have permissions to add myself as an Exchange Full Administrator. Please help. Thanks in advance.
    Thursday, July 28, 2011 4:35 PM

Answers

  • Hi David,

    Are you running Exchange 2003, right?

    I'm afraid you have to ask administrator to add you as an Exchange Full Administrator.

    Detailed information, please see:

    Overview of Exchange administrative role permissions in Exchange 2003

    http://support.microsoft.com/kb/823018

    Frank Wang

    Forum Support

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

     

    • Proposed as answer by Sukh828 Friday, July 29, 2011 10:32 AM
    • Marked as answer by emma.yoyo Friday, August 5, 2011 1:46 AM
    Friday, July 29, 2011 7:15 AM
  • I'm a domain admin and I can add myself as an Exchange Admin but not as an Exchange Full Admin. It won't let me install a secondary Exchange server unless I have Exchange Full Admin rights. I tried adsi edit but it gives me Exchange Admin (Customized) rights and I still can't install the 2nd Exchange. 

    Knowing this environment, I didn't want to take the chance of resetting the domain\administrator account because they seem to enter a user's credential in services.


    So when you added your account and required perms to the listed objects in that article, it sill doesnt work?

    By the way, I would simply change the admin password if it were me. Anything that fails later will eventually be caught if somone is using the admin as a service account somewhere and if no one knows it, it needs to be changed regardless.

     Note this method as well
    http://support.microsoft.com/kb/296487

     



    • Marked as answer by emma.yoyo Friday, August 5, 2011 1:46 AM
    Friday, July 29, 2011 6:32 PM

All replies

  • Hi David,

    Are you running Exchange 2003, right?

    I'm afraid you have to ask administrator to add you as an Exchange Full Administrator.

    Detailed information, please see:

    Overview of Exchange administrative role permissions in Exchange 2003

    http://support.microsoft.com/kb/823018

    Frank Wang

    Forum Support

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

     

    • Proposed as answer by Sukh828 Friday, July 29, 2011 10:32 AM
    • Marked as answer by emma.yoyo Friday, August 5, 2011 1:46 AM
    Friday, July 29, 2011 7:15 AM
  • Hi Frank,

    Yes we are running Exchange 2003. The issue is that no one here knows what the administrator password is. (We didn't install the environment, the people that did are long gone.) I didn't want to reset the password as it may affect services running. I was wondering if there is any other way we can assign the Exchange Full Administrator rights.

    Friday, July 29, 2011 5:26 PM
  • No one has domain admin rights? They should be able to add you to the Exchange Admin security group.

    If you change the admin password, it wont affect Exchange services, They dont run as a user in 2003 and beyond unless someone has done something wrong and set it as that.

     

     

     

     

    Friday, July 29, 2011 5:49 PM
  • I'm a domain admin and I can add myself as an Exchange Admin but not as an Exchange Full Admin. It won't let me install a secondary Exchange server unless I have Exchange Full Admin rights. I tried adsi edit but it gives me Exchange Admin (Customized) rights and I still can't install the 2nd Exchange. 

    Knowing this environment, I didn't want to take the chance of resetting the domain\administrator account because they seem to enter a user's credential in services.

    Friday, July 29, 2011 6:08 PM
  • I'm a domain admin and I can add myself as an Exchange Admin but not as an Exchange Full Admin. It won't let me install a secondary Exchange server unless I have Exchange Full Admin rights. I tried adsi edit but it gives me Exchange Admin (Customized) rights and I still can't install the 2nd Exchange. 

    Knowing this environment, I didn't want to take the chance of resetting the domain\administrator account because they seem to enter a user's credential in services.


    So when you added your account and required perms to the listed objects in that article, it sill doesnt work?

    By the way, I would simply change the admin password if it were me. Anything that fails later will eventually be caught if somone is using the admin as a service account somewhere and if no one knows it, it needs to be changed regardless.

     Note this method as well
    http://support.microsoft.com/kb/296487

     



    • Marked as answer by emma.yoyo Friday, August 5, 2011 1:46 AM
    Friday, July 29, 2011 6:32 PM
  • When I add my account and the required perms to the listed objects this is the error that i get:

    Failed to grant permission for domain\dvang on this object: /dc=domain/cn=configuration

     

    Friday, July 29, 2011 6:46 PM
  • When I add my account and the required perms to the listed objects this is the error that i get:

    Failed to grant permission for domain\dvang on this object: /dc=domain/cn=configuration

     


    Check out the KB I posted as well. Even though its meant when the account has been deleted, the same concept still applies.

     

    Friday, July 29, 2011 6:54 PM
  • I will try it this weekend. I'll keep you posted. Thanks for your help.

    Friday, July 29, 2011 7:02 PM
  • Domain Prep was ran when we brought 2nd 2008 domain. What would happen if we run a 2003 domain prep and forest prep for Exchange? Are there any consequences and any issues? Is there a way to roll back?


    Wednesday, August 3, 2011 7:38 PM
  • You can re-run both those.  Unless you changed the Details Template, re-running ForestPrep wont change anything.

    Rerunning Domain Prep will re-apply any required permissions and create any missing Exchange security groups.

     

    Wednesday, August 3, 2011 10:05 PM
  • I thought re-running the forestprep will let me re-assign a Exchange Full Admin? The KB you posted earlier suggest running forestprep

    Wednesday, August 3, 2011 10:08 PM
  • Yes, per that article. I thought you were asking in general what those utilities  do.

     

    ForestPrep assigns Exchange Full Administrative account permissions to the account that you specify.

     

     

     

     

    Wednesday, August 3, 2011 10:18 PM
  • well I was asking because i was going to run forestprep to resolve this issue. and i was advised to run domain prep also to restore the security groups. i was just wondering if it can do anything to harm my environment and if it does is there a backout that i can do.
    Wednesday, August 3, 2011 10:20 PM
  • There is no backout . re-Running wont hurt however. ForestPrep will set the details template to the default however if you have modified that.

     

    Wednesday, August 3, 2011 11:40 PM
  • Can you please explain the details template and what it does??

    Thanks for all your help.

    Thursday, August 4, 2011 12:58 AM
  • The Details template allows you to change thw way the GAL looks in Outlook. Most people never change this.  :)

     


    Thursday, August 4, 2011 1:15 AM