Permissions on the Server Object and Its Children

Table B-12: Permissions Set on the Server Object

Account	Allow/Deny	Inherit	Right	Notes
During server installation, if the server is not part of a cluster
MACHINE$	Allow	Yes	Full Control	Server needs access to its own configuration information
During server installation, if the server is part of a cluster
Individual machine accounts for each cluster node	Allow	Yes	Full Control	Every node in a cluster that can own a virtual server needs to be able to manage the virtual server configuration
Exchange Domain Servers	Allow	Yes	Full Control	This covers the case where Setup cannot tell which specific server should be given permissions
During server installation
Authenticated Users	Allow	No	Read Properties
When EDSLock script is run
	Deny	Yes	Receive As	This ACE is removed by Exchange Server 2003 forestprep

Table B-13: Permissions Set on the Server-Specific Protocols Container

Account	Allow/Deny	Inherit	Right	Notes
During server installation
Everyone	Allow	Yes	List Contents
Everyone	Allow	Yes	List Metabase Properties

Table B-14: Permissions Set on the System Attendant Object

Account	Allow/ Deny	Inherit	Right	Notes
During server installation (set on attribute msExchMailboxSecurityDescriptor)
LocalSystem	Allow	Yes	Read PermissionsSend AsMailbox Owner
Exchange Domain Servers	Allow	Yes	Read PermissionsSend AsMailbox Owner
5.5 Service Account (if given)	Allow	Yes	Read PermissionsSend AsMailbox Owner

Table B-15: Permissions Set on the MTA Object

Account	Allow/Deny	Inherit	Right	Notes
During server installation
5.5 service account(if given)	Allow	Yes	Send As	Required to send and receive mail with Exchange 5.5 servers
5.5 service account (if given)	Allow	Yes	Receive As	Required to exchange mail with Exchange 5.5 servers