Permissions on Objects in the Domain Naming Context

Permissions listed in this section are applied to objects in the domain naming context.

Table B-20: Permissions set on the Domain container (dc=domain)

Account	Allow	Deny	Inherit	Right	On Property
During DomainPrep phase
Exchange Enterprise Servers				ACTRL_DS_WRITE_PROP	Public- Information (property set)
Exchange Enterprise Servers				ACTRL_DS_WRITE_PROP	Personal- Information (property set)
Exchange Enterprise Servers				ACTRL_DS_WRITE_PROP	groupType
Exchange Enterprise Servers				DS-Replication-Manage- Topology

Table B-21: Permissions set on the domain proxy container (cn=Microsoft Exchange System Objects, dc=domain)

Account	Allow	Deny	Inherit	Right	On Property
During DomainPrep phase
Exchange Enterprise Servers				DS_AM_FULL_CONTROL
Exchange Domain Servers				DS_AM_FULL_CONTROL

Table B-22: Permissions set on the Exchange Enterprise Servers group

Account	Allow	Deny	Inherit	Right	On Property
During DomainPrep phase
All org-level full Exchange admins				DS_AM_FULL_CONTROL
Exchange Enterprise Servers				DS_AM_FULL_CONTROL

Table B-23: Permissions set on the Exchange Domain Servers group

Account	Allow	Deny	Inherit	Right	On Property
During DomainPrep phase
All org-level full Exchange admins				DS_AM_FULL_CONTROL
Exchange Enterprise Servers				DS_AM_FULL_CONTROL