Permissions on Other Objects in the Configuration Tree

Permissions listed in this section are set on objects in various locations, as indicated in the title of each table.

Table B-15: Permissions set on the Deleted Items container (cn=Deleted Items, cn=Configuration, dc=domain)

Account	Allow	Deny	Inherit	Right	On Property
During ForestPrep phase
Designated admin account				STANDARD_RIGHTS_READ | ACTRL_DS_LIST | ACTRL_DS_READ_PROP | ACTRL_DS_LIST_OBJECT | WRITE_OWNER | WRITE_DAC
During server install
Exchange Domain Servers				ACTRL_DS_LIST

Table B-16: Permissions set on the Active Directory Connector object (cn=Active Directory Connector, cn=Exchange Settings, cn=server, cn=Servers, cn=site, cn=sites, cn=Configuration,…)

Account	Allow	Deny	Inherit	Right	On Property
During ADC setup
Exchange Services				DS_AM_FULL_CONTROL
Authenticated Users				STANDARD_RIGHTS_READ | ACTRL_DS_READ_PROP | ACTRL_DS_LIST