SendAs/ReceiveAs permissions

I'm running a Windows 2003 AD forest with Exchange 2003. Is there a way to
prevent Domain Admins from being able to send mail as other people, i.e.
remove the SendAs permission for the Domain Admins group from all user and
group objects in the domain? I don't want to set an explicit deny, because
some members of Domain Admins require this ability, but in general, the group
does not.

Thanks,

Don

Joe
Tue Aug 02 20:38:07 CDT 2005

As a general rule, domain admin IDs shouldn't be mailbox enabled. Domain admins
should have two IDs, one for domain admin work and one for normal work.

But no, you can't effectively block a domain admins from doing anything. If they
want the access, they can always get it. This is why you should have very very
few domain admins. I ran a Fortune 5 company with 2 other DAs. At most there
should have been maybe 4-5 for that size or even bigger company (250,000 users).



--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Don wrote:
> I'm running a Windows 2003 AD forest with Exchange 2003. Is there a way to
> prevent Domain Admins from being able to send mail as other people, i.e.
> remove the SendAs permission for the Domain Admins group from all user and
> group objects in the domain? I don't want to set an explicit deny, because
> some members of Domain Admins require this ability, but in general, the group
> does not.
>
> Thanks,
>
> Don
>