Unity Exchange Permissions: Any Problem giving more rights than needed?

[srichardson]

I have a client who wants to put the installation, directory service, and message store service account into an "Exchange Gods" security group, giving the highest rights to these accounts. I seem to remember a TAC case where I was told that one particular account should NOT be added to a domain admins group.

Does anyone have a solid answer to this? Can my client safely give more permissions than needed?

Thanks

[jasyoung · Accepted solution]

The Domain Admins group is explicitly prohibited by the default Exchange ACLs from accessing user mailboxes. Therefore, the Unity message store account must not be a member of the Domain Admins group or it will be unable to login to retrieve messages or monitor mailboxes for changes, which is needed for message notification and MWI purposes.

The Unity Permissions Wizard does a good job of laying out the right permissions (and no more) and hopefully your client can be persuaded to just stick with that.

[jones_amy]

Does the Dir svc account need to be a pard of the domain admin group? I have it setup so that the msg store and the dir svc use the same account. But when I run the permission wizard It failes with 2 failures..I dont see any major issues with unity but I am currently setting up a failover server for this customer and I have the install account in the domain admins group and the msgstore and dir svc account in the domain admin groups...could this be why it is failing...It is saying that the msg store account needs to have rights..

[Hin Lee]

Permissions Set For the Directory Services Account

Group Membership

The directory services account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller.

•The Local Administrators group, when the Cisco Unity server is not a domain controller.