Thanks for the info, however this does not give the <service account> user the required permissions to create top level public folders. Any idea how to do that?

Thanks! however on my 32 bits test version of 2007 it refuses to do that with a { Failed to commit the change on object "\" because Access is denied. } message.

Thanks again, but that command does not change the status quo.

It finishes fine and grants the permission to the service account but the service account can not create a new top level public folder unless he is made member of the exchange organization administrators group in the AD.

I see the same behavior with the event sink that I am trying to install on this e2k7.

The eventsink script triggers ok on the onsave event of the service account's outlook calendar and passes the url over to the sink handler (com+) but when that tries to open a record to that user item it's also Access Denied. However, running the sink handler in debug mode, logged on as the service account works ok.

That's interesting! (can't say it's an improvement over 2003 though)

anyway

To find the PF DN there must me a smart way available which we can pipe into the command.

searching..

It accepts this command:

get-publicfolderdatabase | add-adpermission -user <service account> -ExtendedRights ms-exch-create-top-level-public-folder -AccessRights ReadProperty,GenericExecute

Tested that in the shell and it gives back that the service account has

those 3 permissions (without deny) on the database.

but sadly enough.. the serviceaccount STILL can't create top level public folders in outlook when I remove him from the {exchange organization admins} group.

So it is obviously not replicating the permissions down to the PF tree.  (I restarted the information store)

sadly enough

The command below works great but how do I have the permmision applied to all new users without running it again ?

Thanks.

Get-mailboxserver <servername> | add-adpermission –user <service account> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin

The command works great but how do I apply it to all new users without running it again ?  - Thanks

Get-mailboxserver <servername> | add-adpermission –user <service account> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin