In this article, you will learn how to control object visibility, including servers, routing groups, admin groups, etc, i.e make objects disappear for certain users within Exchange System Manager.

The scenario that I’m working under is that I have a semi-trusted user who needs access to Exchange System Manager (ESM), either 2000 or 2003 versions. I have run the Delegate Control Wizard and made this person an Exchange View Only Administrator or an Exchange Administrator.

I would like to manipulate permissions to deny rights at a very detailed level, and I know that I am able to view permissions on more objects than usual by enabling the HKEY_CURRENT_USER\Software\Microsoft\Exchange\ExAdmin\ShowSecurityPage registry key; however I am still denied a greater level of granularity in the Exchange System Manager MMC. 

For Example: I’d like to hide the Global Settings Tab from my Helpdesk user or group. However Right Clicking on the Global Settings object in ESM does not display object properties, including the security tab. Some other things I’d like to hide are Routing Groups and the Public Folder container – called Folders in ESM – from the helpdesk ESM view. For this level of rights management I can use a third party application, or I can get one for free – ADSIEDIT. Bear in mind that you get what you pay for. ADSIEDIT will do the job, but it doesn’t offer any of the features of a commercial tool, such as auditing, reporting and most importantly rollback to name a few.

If you don’t have ADSIEDIT install a copy by running setup in the Support Tools Directory on your Server 2000 or 2003 installation CD. I’m going to be using ADSIEDIT from Server 2003 Support Tools.