John Policelli's Blog

Covering Identity and Access Solutions, Unified Communications, Collaboration, and Infrastructure

Exchange 2007 WILL BE Supported on Windows Server 2008 R2

It’s official, Kevin Allison (GM Exchange Customer Experience) published a post on the Microsoft Exchange Team Blog stating that Exchange 2007 will support Windows Server 2008 R2. The catch, it’s not here yet :) . There is no specific date provided in his post, but he does state “In the coming calendar year we will issue an update for Exchange 2007 enabling full support of Windows Server 2008 R2.”

Exchange 2010 and Resolution of the AdminSDHolder Elevation Issue

Since the release of Exchange Server 2010 RC1, there’s been a lot of debate over some ACEs that are added to the AdminSDHolder object by /PrepareDomain in Exchange 2010 RC1. For more information on this, see Exchange 2010 Modification of AdminSDHolder ACL Can Result in Elevation of Privilege and Exchange 2010 RC1 and AdminSDHolder.

A post was added to the Microsoft Exchange Team Blog this morning that confirms that this has been resolved in the RTM version of Exchange Server 2010. More specifically:

  • /PrepareDomain no longer applies ACEs granted to Exchange Windows Permissions USG on the AdminSDHolder container.  If /PrepareDomain detects the ACEs granted to Exchange Windows Permissions USG on the AdminSDHolder container, /PrepareDomain will remove them.
  • /PrepareDomain no longer applies the extended right ACE User-Change-Password to the Exchange Servers USG on the AdminSDHolder container.  If /PrepareDomain detects this ACE granted to Exchange Servers USG on the AdminSDHolder container, /PrepareDomain will remove it.
  • /PrepareDomain no longer applies the extended right ACE User-Change-Password to the Exchange Servers USG on the domain partition.  If /PrepareDomain detects this ACE granted to Exchange Servers USG on the domain partition, /PrepareDomain will remove it.
  • /PrepareDomain no longer applies an unscoped DeleteTree and WriteDACL ACEs on the domain partition.  Instead, these ACEs are replaced by scoping them specifically to user and inetOrgPerson class objects.

Exchange 2010 RC1 Modification of AdminSDHolder ACL Can Result in Elevation of Privilege

UPDATE: This has been resolved in the RTM version of Exchange Server 2010. Please see Exchange 2010 and Resolution of the AdminSDHolder Elevation Issue for more details.

The PrepareDomain setup phase of Exchange 2010 RC1 adds several Access Control Entries (ACEs) to the Access Control List (ACL) of the AdminSDHolder object. One of these ACEs, Write Property for member, can be used to elevate privileges from Exchange Organization Administrator to Enterprise Admins.

Continue reading