Exchange Server Archiver - 1.1

Exchange Server Archiver

Learning Exchange Server Archiver - 1.1

Creating the Archive Service user

The Archive Service needs a mailbox-enabled user that has read and write permissions to all messages when it communicates with Exchange Server.

You are recommended to make the Archive Service user a domain administrator. If you do not wish to do this, you must:

and

When you have created the user with the permissions specified above, you must ensure that the user has:

Adding WMI permissions

If you do not want to make the Archive Service user a domain administrator or a local administrator, add permissions to execute WMI calls on Exchange Server:

  1. Navigate to WMI Control.

    To launch this from a command line, run wmimgmt.msc

  2. Right-click WMI Control and select Properties.
  3. In WMI Control Properties, select the Security tab.
  4. Under Root, expand CIMV2, and then click Security.
  5. Click Advanced.
  6. Click Add, type the name of the user, and click OK.
  7. In Permission Entry for CIMV2, ensure This namespace and subnamespaces is selected in Apply to, and then select the Allow check box for:
    • Execute Methods
    • Enable Account
    • Remote Enable
  8. Click OK three times to return to the Security tab.
  9. For Exchange Server 2003 only:
    1. Under Root, expand MicrosoftExchangeV2, and then click Security.
    2. Click Advanced.
    3. Click Add, type the name of the user, and click OK.
    4. In Permission Entry for MicrosoftExchangeV2, ensure This namespace and subnamespaces is selected in Apply to, and then select the Allow check box for:
    • Execute Methods
    • Enable Account
    • Remote Enable
  10. Click OK on all the WMI Control Properties dialog boxes, and close the WMI Control.
  11. In Administrative Tools, open Component Services.
  12. Expand Component Services, expand Computers, right-click My Computer, and then click Properties.
  13. Select the COM Security tab.
  14. Under Launch and Activation Permissions, click Edit Limits.
  15. Add the Archive Service user name.
  16. If the Archive Service will run locally, select the Allow check box for Local Launch and Local Activation; if it will run remotely, select Remote Launch and Remote Activation.
  17. Click OK on all the My Computer Properties dialog boxes.
  18. For Exchange Server 2007 only: navigate to the folder on disk for each storage group, and grant the Archive Service user permissions to read the folder and its contents.

    For example, for a new, default installation, the storage group is in:

    C:\Program Files\Microsoft\Exchange Server\Mailbox\First Storage Group

Adding Exchange Server configuration subtree permissions

If you do not want to make the Archive Service user a domain administrator, you must add permissions to read the Exchange Server configuration subtree:

  1. If necessary, install ADSI Edit by following the instructions on Windows Server TechCenter.
  2. Run adsiedit.msc to open ADSI Edit.
  3. Under Configuration, expand Services, right-click Microsoft Exchange, and then click Properties.
  4. In the Microsoft Exchange Properties dialog box, select the Security tab.
  5. Click Add, type the name of the Archive Service user, and click OK.
  6. Click Advanced, select the Archive Service user, and click Edit.
  7. In the Apply to box, select This object and all child objects and select the Allow check box for:
    • List Contents
    • Read All Properties
    • Read Permissions
  8. Click OK on all the Microsoft Exchange Properties dialog boxes.
  9. Under Domain, right-click Microsoft Exchange System Objects and click Properties.
  10. In the Microsoft Exchange System Objects Properties dialog box, select the Security tab.
  11. Click Add, type the name of the Archive Service user, and click OK.
  12. Click Advanced, select the Archive Service user, and click Edit.
  13. In the Apply to box, select This object and all child objects and select the Allow check box for:
    • List Contents
    • Read All Properties
    • Read Permissions
  14. Click OK on all the Microsoft Exchange System Object Properties dialog boxes.
  15. Close ADSI Edit.

Adding full permissions to modify the contents of mailboxes in Exchange Server

The Configuration wizard can add these permissions for you when you install the Exchange Server Archiver components and services. However, if you prefer you can add the permissions manually prior to installation.

In Exchange Server 2003

By default, the System Manager in Exchange Server 2003 does not display the Security tab when you select an Exchange Server Organization object, so you cannot modify the permissions. Therefore, to change user permissions, you must enable the ShowSecurityPage registry setting:

  1. Go to the following Exchange Server branch in the registry editor:

    HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exadmin

  2. Create a new dword called ShowSecurityPage.
  3. Change the value of the dword to 1.

    This displays the Security tab when you select an object.

  4. Close and re-open the Exchange Server System Manager.

You can now change the permissions on the servers to grant full access to the user.

  1. For each Exchange server you will archive, navigate to the server object that has the Administrative group containing the user.
  2. Right-click the server object, and click Properties.
  3. In the Properties window, click the Security tab.
  4. Click Add, specify the user or group for which you want to change permissions, and then click OK.
  5. Ensure that the user or group is selected in the Group of user names list, and then under Permissions for..., click Allow Full Control.
  6. Click OK.

In Exchange Server 2007

In Exchange Server 2007, you use a Powershell command to change the user permissions. The following command gives the user UserName rights on all storage groups within any Exchange Server 2007 server on the domain DomainName.com:

foreach ($sg in Get-StorageGroup) { if ((Get-ExchangeServer
    $sg.Server).Domain.Equals("DomainName.com")) { get-mailboxdatabase
    -storagegroup $sg.Identity | add-adpermission -user UserName
    -accessrights GenericAll; } }

The command must be run on an Exchange Server 2007 server in each domain.

See also

Prerequisites

Installing the services and components

Was this article helpful?

Search support
Forums
Visit the Exchange Server Archiver forum.
Learning Exchange Server Archiver
Knowledge base

Exchange Server Archiver

all products

Notes & articles

Exchange Server Archiver

all products

Demos & walkthroughs

Exchange Server Archiver