Permissions on the Server Object and Its Children

Table B-11: Permissions set on the Server object

Account	Allow	Deny	Inherit	Right	On Property
During server install, if the server is NOT a cluster VM
MACHINE$				DS_AM_FULL_CONTROL
During server install, if the server IS a cluster VM
Exchange Domain Servers				DS_AM_FULL_CONTROL

Table B-12: Permissions set on the server-specific Protocols container

Account	Allow	Deny	Inherit	Right	On Property
During server install
Everyone				ACTRL_DS_LIST
Everyone				ms-Exch-Read-Metabase- Properties

Table B-13: Permissions set on the System Attendant object

Account	Allow	Deny	Inherit	Right	On Property
During server install (set on attribute msExchMailboxSecurityDescriptor)
LocalSystem				READ_CONTROL | fsdspermUserSendAs | fsdspermUserMailboxOwner
Exchange Domain Servers				READ_CONTROL | fsdspermUserSendAs | fsdspermUserMailboxOwner
5.5 Service Account (if given)				READ_CONTROL | fsdspermUserSendAs | fsdspermUserMailboxOwner

Table B-14: Permissions set on the MTA object

Account	Allow	Deny	Inherit	Right	On Property
During server install
5.5 Service Account (if given)				Send-As
5.5 Service Account (if given)				Read-As