XADM: Using Local Groups to Assign Permissions in Exchange

SUMMARY

Windows NT local groups should not be used for purposes of permission assignment to Microsoft Exchange Site objects unless all Microsoft Exchange Servers within the Microsoft Exchange Site are on domain controllers (DC's) within the same domain.

MORE INFORMATION

The Microsoft Exchange Server Administrator program allows you to assign permissions on Microsoft Exchange objects to Windows NT local groups defined on the DC of the domain to which the Microsoft Exchange Server belongs. The use of local groups can be a handy way of simplifying permissions assignment in certain cases. However, local groups must not be used to assign permissions in Microsoft Exchange unless all of the Microsoft Exchange Servers within the Microsoft Exchange Site are DC's within the same Windows NT domain.

The reason why local groups will not work when any Microsoft Exchange Server is not on a DC is straightforward: Local groups under Windows NT are valid for permissions assignment only for the computers upon which the groups were defined. In the case of a DC, local groups defined on one DC are valid for permissions assignment on all DC's in the domain (because all DC's in a given domain share the same security database). However, local groups defined on a member server are valid only for use upon the server itself because the security database of a member server is unique to that computer. As a result of this, if local groups defined on a DC are used to assign permissions on a member server, the permissions thus defined cannot be validated on that member server because it does not have full access to the security database of the DC. The local groups are recognized, but permissions assigned to them will not work.

In cases where local groups may be safely used, Microsoft Exchange enumerates local groups on the DC of the Microsoft Exchange Server domain in the permissions dialog box. However, you should take care not to use local groups for permissions assignment if all of the Microsoft Exchange Servers in your site are not on DC's within the same domain.

For maximum compatibility with any future changes you may make to your Microsoft Exchange Site configuration, you should avoid the use of local groups for permissions assignments entirely.