In this article, you will learn how to control object visibility…. Sound familiar? Yes, but with a twist. My previous article focused on limiting visibility of Exchange objects within Exchange System Manager only. This time objects visibility is influenced for the sake of data entry, i.e. limiting your choices in AD Users and Computers, or any other AD integrated administration tool.

 How is this possible? When a user is mail or mailbox enabled, ADUC (AD Users and Computers) presents a number of options, such as the default mail store or Administration Group. However, what if users mailboxes should not be put into certain stores, such as VIP mailbox stores, or the mailbox store choice doesn’t suit the geography. Example – A Dallas user can be mailbox enabled using only the Mailbox Store on the Dallas Exchange server by the local administrator, whilst Los Angeles and New York aren’t listed as options. In larger organizations choices may be restricted by region, department or even politically, so that the VIP Storage Groups are invisible to normal users. In this article we’re going to look at limiting those choices by hiding mailbox stores from view.

To demonstrate this I have created two extra databases as shown. Note the VIP Mailbox Store.

Further to this I have assigned an extra ACE (access control entry) against the helpdesk on the VIP Mailbox Store as follows:

 Helpdesk                      DENY                                     Read

Here’s how to do this. Right click on the mailbox store you wish to hide, click on Properties, Security,

Advanced, Click Add, find and add the users or groups desired. Then chose to Deny Read.

Clicking OK closes the view and displays the new ACE we just added.

.