XADM: Restricting Permission to Address Book Views (248398)

MORE INFORMATION

When you apply this fix, a new heuristics bit is defined on the Address Book View container. Setting the heuristic bit to 1 blocks the inheritance of the permissions from the site container. After the change, which is replicated throughout the organization, only the permissions set explicitly on the Address Book View container are effective.

WARNING: The change in the permission model should not be implemented without proper planning and only after assigning permission Administrators explicitly on the Address Book View in every site.

To properly handle the explicit permission on the Address Book Views it is strongly recommended to use Admin Fix described in Microsoft Knowledge Base article 262773.

The fix described in this article ensures that:

• The graphical user interface reflects the effective permissions
• With the Admin Fix it is not possible to remove the "Modify Permission" right from the last and only Admin and thus loosing the ability to administer permissions of the Address Book Views within the site.
• A Warning is received when removing the permission Admin role from the account which is currently logged on.
• A Warning is received when removing the last Account and thus removing the security from the object allowing anybody to modify it.

To enable the new heuristics bit:

WARNING: If you use the raw mode of the Exchange Server Administrator program (admin /r) incorrectly, serious problems may occur that may require you to reinstall Microsoft Windows NT Server, Microsoft Exchange Server, or both. Microsoft cannot guarantee that problems that result from using raw mode incorrectly can be solved. Use raw mode at your own risk.

1. Start the Microsoft Exchange Server Administrator program in raw mode by typing the following at a command prompt:

   c:\exchsrvr\bin\admin /r

2. Click the Address Book container, and then click Raw Properties on the File menu.
3. In the List Attributes of Type list, click All.
4. Click Heuristics in the list of attributes.
5. In the Edit box, type 1, click Set, and then click OK.

IMPORTANT: Although the heuristics flag replicates between sites, you must add a Microsoft Windows NT account to the Permissions tab of the Address Book view properties for the Address Book view for each site because the Windows NT account does not replicate between sites.

For additional information about the issue described in this article, click the article numbers below to view the articles in the Microsoft Knowledge Base: