Exchange Server Archiver - 3.0

Exchange Server Archiver

Learning Exchange Server Archiver - 3.0

Creating the Archive Service user

The Archive Service needs a mailbox-enabled user that has 'administer information store' permissions on all mailboxes when it communicates with Exchange. For Exchange Server 2003, the Archive Service user must also have 'view information store' permissions.

You are recommended to make the Archive Service user a domain administrator; domain administrators have the necessary permissions. If you do not wish to do this, you must:

  1. Make the Archive Service user a local administrator on the Exchange servers, or add permissions to execute WMI calls on Exchange.
  2. Add read permissions to the Exchange configuration subtree in Active Directory.
  3. Make the Archive Service user a local administrator on the Archive Service computer.
  4. Grant permissions on all mailbox databases.

Adding WMI permissions

If you do not want to make the Archive Service user a domain administrator or a local administrator on the Exchange servers, add permissions to execute WMI calls on Exchange:

  1. Navigate to WMI Control.

    To launch this from a command line, run wmimgmt.msc

  2. Right-click WMI Control and select Properties.
  3. In WMI Control Properties, select the Security tab.
  4. Under Root, expand CIMV2, and then click Security.
  5. Click Advanced.
  6. Click Add, type the name of the user, and click OK.
  7. In Permission Entry for CIMV2, ensure This namespace and subnamespaces is selected in Apply to, and then select the Allow check box for:
    • Execute Methods
    • Enable Account
    • Remote Enable
  8. Click OK three times to return to the Security tab.
  9. For Exchange Server 2003 only:
    1. Under Root, expand MicrosoftExchangeV2, and then click Security.
    2. Click Advanced.
    3. Click Add, type the name of the user, and click OK.
    4. In Permission Entry for MicrosoftExchangeV2, ensure This namespace and subnamespaces is selected in Apply to, and then select the Allow check box for:
    • Execute Methods
    • Enable Account
    • Remote Enable
  10. Click OK on all the WMI Control Properties dialog boxes, and close the WMI Control.
  11. In Administrative Tools, open Component Services.
  12. Expand Component Services, expand Computers, right-click My Computer, and then click Properties.
  13. Select the COM Security tab.
  14. Under Launch and Activation Permissions, click Edit Limits.
  15. Add the Archive Service user name.
  16. If the Archive Service will run locally, select the Allow check box for Local Launch and Local Activation; if it will run remotely, select Remote Launch and Remote Activation.
  17. Click OK on all the My Computer Properties dialog boxes.
  18. For Exchange Server 2007 only: navigate to the folder on disk for each storage group, and grant the Archive Service user permissions to read the folder and its contents.

    For example, for a new, default installation, the storage group is in:

    C:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group

Adding Exchange configuration subtree permissions

If you do not want to make the Archive Service user a domain administrator, you must add permissions to read the Exchange configuration subtree:

  1. If necessary, install ADSI Edit by following the instructions on Windows Server TechCenter.
  2. Run adsiedit.msc to open ADSI Edit.
  3. Under Configuration, expand Services, right-click Microsoft Exchange, and then click Properties.
  4. In the Microsoft Exchange Properties dialog box, select the Security tab.
  5. Click Add, type the name of the Archive Service user, and click OK.
  6. Click Advanced, select the Archive Service user, and click Edit.
  7. In the Apply to box, select This object and all child objects and select the Allow check box for:
    • List Contents
    • Read All Properties
    • Read Permissions
  8. Click OK on all the Microsoft Exchange Properties dialog boxes.
  9. Under Domain, right-click Microsoft Exchange System Objects and click Properties.
  10. In the Microsoft Exchange System Objects Properties dialog box, select the Security tab.
  11. Click Add, type the name of the Archive Service user, and click OK.
  12. Click Advanced, select the Archive Service user, and click Edit.
  13. In the Apply to box, select This object and all child objects and select the Allow check box for:
    • List Contents
    • Read All Properties
    • Read Permissions
  14. Click OK on all the Microsoft Exchange System Object Properties dialog boxes.
  15. Close ADSI Edit.

Granting permissions on all mailbox databases

It is necessary to grant 'administer information store' permissions manually if the Archive Service user is not a domain administrator.

For Exchange Server 2003, it is also necessary to grant 'view information store' permissions.

In Exchange Server 2010 and Exchange Server 2007

In Exchange Server 2010 and Exchange Server 2007, you use a Powershell command to change the user permissions.

The following command gives the user UserName rights on all storage groups within any Exchange 2007 server on the domain DomainName.com:

foreach ($sg in Get-StorageGroup) { if ((Get-ExchangeServer
    $sg.Server).Domain.Equals("DomainName.com")) { get-mailboxdatabase
    -storagegroup $sg.Identity | add-adpermission -user UserName
    -ExtendedRights MS-Exch-Store-Admin; } }

The command must be run on an Exchange server in each domain.

The following command gives the user UserName rights within any Exchange 2010 mailbox database:

get-mailboxdatabase | add-adpermission -user UserName -ExtendedRights MS-Exch-Store-Admin

In Exchange Server 2003

By default, the System Manager in Exchange Server 2003 does not display the Security tab when you select an Exchange Organization object, so you cannot modify the permissions. Therefore, to change user permissions, you must enable the ShowSecurityPage registry setting:

  1. Go to the following Exchange branch in the registry editor:

    HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exadmin

  2. Create a new dword called ShowSecurityPage.
  3. Change the value of the dword to 1.

    This displays the Security tab when you select an object.

  4. Close and re-open the Exchange System Manager.

You can now change the permissions on the servers to grant full access to the user.

  1. For each Exchange server you will archive, navigate to the server object that has the Administrative group containing the user.
  2. Right-click the server object, and click Properties.
  3. In the Properties window, click the Security tab.
  4. Click Add, specify the user or group for which you want to change permissions, and then click OK.
  5. Ensure that the user or group is selected in the Group of user names list, and then under Permissions for..., select Allow Administer Information Store and Allow View Information Store Status.
  6. Click OK.

Keywords: Archive Service user, permissions, WMI,

See also

Prerequisites

Installing the services and components

Was this article helpful?

Search support
Forums
Visit the Exchange Server Archiver forum.
Learning Exchange Server Archiver
Knowledge base

Exchange Server Archiver

all products

Notes & articles

Exchange Server Archiver

all products

Demos & walkthroughs

Exchange Server Archiver