DL permissions issues with "associated external account"

DL permissions issues with "associated external account"

We have started implementing mailboxes with the "associated external account" 
account in a trusted domain. We are Exchange Server 2003 SP2, Active 
Directory in 2003 Native mode, forest trust with the external forest.

The issue is that no matter how I grant the "manager" permission, the user 
cannot modify the distribution lists that I've made him an owner of - the 
user account that he uses is in the trusted domain.

I've looked online and the only thing I can find is to either set up the DL 
in the trusted domain itself, or to set up the AutoDL utility.

My questions are:
1. Do you know of any other way to get around this issue?
2. How does the DL show up in the GAL if it's in the trusted domain instead 
of the domain where the GAL is generated?
3. Does anyone have good instructions for setting up AutoDL - I couldn't get 
it set up with what I found online?

TIA

date: Tue, 29 Apr 2008 09:16:00 -0700 author: Erpara

Re: DL permissions issues with "associated external account"

In order to modify a DL though outlook, the outlook user must point to a GC 
with a writable partition (in the same domain as the object to be edited).


"Erpara"  wrote in message 
news:0F24F5AA-1909-4CD5-A9CB-E2D9AA01B53E@microsoft.com...
> We have started implementing mailboxes with the "associated external 
> account"
> account in a trusted domain. We are Exchange Server 2003 SP2, Active
> Directory in 2003 Native mode, forest trust with the external forest.
>
> The issue is that no matter how I grant the "manager" permission, the user
> cannot modify the distribution lists that I've made him an owner of - the
> user account that he uses is in the trusted domain.
>
> I've looked online and the only thing I can find is to either set up the 
> DL
> in the trusted domain itself, or to set up the AutoDL utility.
>
> My questions are:
> 1. Do you know of any other way to get around this issue?
> 2. How does the DL show up in the GAL if it's in the trusted domain 
> instead
> of the domain where the GAL is generated?
> 3. Does anyone have good instructions for setting up AutoDL - I couldn't 
> get
> it set up with what I found online?
>
> TIA

date: Tue, 29 Apr 2008 11:44:38 -0700 author: John Fullbright fjohn@donotspamnetappdotcom

Re: DL permissions issues with "associated external account"

Thanks John - so if the user is in a trusted forest, then he will not be able 
to write to our GC in our domain (I have verified that Outlook is connecting 
to our GC via Connection Status). So how do I grant this user access to write 
to our GC, or what is your suggestion in this situation?

TIA

"John Fullbright" wrote:

> In order to modify a DL though outlook, the outlook user must point to a GC 
> with a writable partition (in the same domain as the object to be edited).
> 
> 
> "Erpara"  wrote in message 
> news:0F24F5AA-1909-4CD5-A9CB-E2D9AA01B53E@microsoft.com...
> > We have started implementing mailboxes with the "associated external 
> > account"
> > account in a trusted domain. We are Exchange Server 2003 SP2, Active
> > Directory in 2003 Native mode, forest trust with the external forest.
> >
> > The issue is that no matter how I grant the "manager" permission, the user
> > cannot modify the distribution lists that I've made him an owner of - the
> > user account that he uses is in the trusted domain.
> >
> > I've looked online and the only thing I can find is to either set up the 
> > DL
> > in the trusted domain itself, or to set up the AutoDL utility.
> >
> > My questions are:
> > 1. Do you know of any other way to get around this issue?
> > 2. How does the DL show up in the GAL if it's in the trusted domain 
> > instead
> > of the domain where the GAL is generated?
> > 3. Does anyone have good instructions for setting up AutoDL - I couldn't 
> > get
> > it set up with what I found online?
> >
> > TIA 
> 
> 
>

date: Wed, 30 Apr 2008 08:59:01 -0700 author: Erpara

Re: DL permissions issues with "associated external account"

The user's outlook client would have to connect to the GC in the resource 
forest (the one containing exchange) or the DG would have to exist in the 
user forest (the one containing the user account).  Either way, outlook 
needs to connect to a gc in the same domain that contains the DG.


"Erpara"  wrote in message 
news:A6A0E579-D7E8-4BC4-83FE-E2C47136974A@microsoft.com...
> Thanks John - so if the user is in a trusted forest, then he will not be 
> able
> to write to our GC in our domain (I have verified that Outlook is 
> connecting
> to our GC via Connection Status). So how do I grant this user access to 
> write
> to our GC, or what is your suggestion in this situation?
>
> TIA
>
> "John Fullbright" wrote:
>
>> In order to modify a DL though outlook, the outlook user must point to a 
>> GC
>> with a writable partition (in the same domain as the object to be 
>> edited).
>>
>>
>> "Erpara"  wrote in message
>> news:0F24F5AA-1909-4CD5-A9CB-E2D9AA01B53E@microsoft.com...
>> > We have started implementing mailboxes with the "associated external
>> > account"
>> > account in a trusted domain. We are Exchange Server 2003 SP2, Active
>> > Directory in 2003 Native mode, forest trust with the external forest.
>> >
>> > The issue is that no matter how I grant the "manager" permission, the 
>> > user
>> > cannot modify the distribution lists that I've made him an owner of - 
>> > the
>> > user account that he uses is in the trusted domain.
>> >
>> > I've looked online and the only thing I can find is to either set up 
>> > the
>> > DL
>> > in the trusted domain itself, or to set up the AutoDL utility.
>> >
>> > My questions are:
>> > 1. Do you know of any other way to get around this issue?
>> > 2. How does the DL show up in the GAL if it's in the trusted domain
>> > instead
>> > of the domain where the GAL is generated?
>> > 3. Does anyone have good instructions for setting up AutoDL - I 
>> > couldn't
>> > get
>> > it set up with what I found online?
>> >
>> > TIA
>>
>>
>>

date: Wed, 30 Apr 2008 18:01:37 -0700 author: John Fullbright fjohn@donotspamnetappdotcom

Re: DL permissions issues with "associated external account"

In case anyone comes across this, I resolved the issue by adding an 
additional permission on the DL - grant the users account from their own 
domain "write members" permission on the DL

"John Fullbright" wrote:

> The user's outlook client would have to connect to the GC in the resource 
> forest (the one containing exchange) or the DG would have to exist in the 
> user forest (the one containing the user account).  Either way, outlook 
> needs to connect to a gc in the same domain that contains the DG.
> 
> 
> "Erpara"  wrote in message 
> news:A6A0E579-D7E8-4BC4-83FE-E2C47136974A@microsoft.com...
> > Thanks John - so if the user is in a trusted forest, then he will not be 
> > able
> > to write to our GC in our domain (I have verified that Outlook is 
> > connecting
> > to our GC via Connection Status). So how do I grant this user access to 
> > write
> > to our GC, or what is your suggestion in this situation?
> >
> > TIA
> >
> > "John Fullbright" wrote:
> >
> >> In order to modify a DL though outlook, the outlook user must point to a 
> >> GC
> >> with a writable partition (in the same domain as the object to be 
> >> edited).
> >>
> >>
> >> "Erpara"  wrote in message
> >> news:0F24F5AA-1909-4CD5-A9CB-E2D9AA01B53E@microsoft.com...
> >> > We have started implementing mailboxes with the "associated external
> >> > account"
> >> > account in a trusted domain. We are Exchange Server 2003 SP2, Active
> >> > Directory in 2003 Native mode, forest trust with the external forest.
> >> >
> >> > The issue is that no matter how I grant the "manager" permission, the 
> >> > user
> >> > cannot modify the distribution lists that I've made him an owner of - 
> >> > the
> >> > user account that he uses is in the trusted domain.
> >> >
> >> > I've looked online and the only thing I can find is to either set up 
> >> > the
> >> > DL
> >> > in the trusted domain itself, or to set up the AutoDL utility.
> >> >
> >> > My questions are:
> >> > 1. Do you know of any other way to get around this issue?
> >> > 2. How does the DL show up in the GAL if it's in the trusted domain
> >> > instead
> >> > of the domain where the GAL is generated?
> >> > 3. Does anyone have good instructions for setting up AutoDL - I 
> >> > couldn't
> >> > get
> >> > it set up with what I found online?
> >> >
> >> > TIA
> >>
> >>
> >> 
> 
> 
>

date: Thu, 1 May 2008 11:18:20 -0700 author: Erpara