Velocity Technical Archive
Installing BES Express for Exchange 2003
Published 2009-07-28 • Blog, Exchange
Archived Reference: This is a historical technical article preserved from the Velocity Technologies knowledge base. For current Phoenix and East Valley managed IT services, explore our managed IT services or cybersecurity solutions.
Installing BES for Microsoft Exchange\n
http://na.blackberry.com/eng/support/preinstallation/exchange.jsp#tab_tab_step1\n \nCreate a new user in AD name the user BESAdmin\nAdd the user to the administrators group\nGo to
Start >
Administrative Tools >
Local Security Policy\nor
Start > Administrative Tools > Domain Controller Security Policy if you're installing on a DC\nGo to Security Settings>Local Policies>User Rights Assignment - Find "Allow log on locally" Add your user to this account. Do not forget <domainNameusername> format\nNext find log on as a service and add the account here as well.\nOpen Exchange System Manager\nYou must right click on the top level in ESM and go to properties and check the 2 boxes that say "Display routing groups" and "Display administrative groups". Once you do exit ESM and re-open it.\nNow go to administrativfe groups>first administrative group> right click and go to delegate control.\nClick next then click add find your BESAdmin account. Keep the Exchange view only administrator selected. click next click finish\nIn Exchange 2007 you can just run the following in Exchange Management Shell\n
add-exchangeadministrator BESAdmin -role ViewOnlyAdmin\n
Run get-exchangeadministrator | Format-List to verify BESAdmin is a member of the exchange read only administrators.\n
Open ESM again in Exchange 2003\ngo to administrative groups>first administrative groups>servers>right click on your exchange server and go to properties. Go to the security tab. Select the bes Service account add the following permissions to the existing Administer information store, send as, recieve as. click advanced verify the "SELECT the allow inheritable permissions from parent to propogate to this object and all child objects" is selected click ok. do the same for all exchange servers.\nIn Exchange 2007 run the following cmd from EMS\n
get-mailboxserver <Exchange2007> | add-adpermission -user <BESAdmin> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin\n
Where < Exchange2007> is the name of the Microsoft Exchange 2007 Server and < BESAdmin> is the name of the BlackBerry Enterprise Server service account.\nIf inheritiance to the individual mail stores is not enabled, to set the
Send As, Receive As, and
Administer information store permissions at the store level, complete the following steps from the Exchanage management shell:\n
get-mailboxdatabase <Exchange2007><dbname> | add-adpermission -user <BESAdmin> -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin
\nWhere <
dbname> = 'First storage groupMail box database'\nTo verify the
Send As,
Receive As, and
Administer Information Store permissions, complete the following steps:\n
\n\t- Click Start > Programs > Microsoft Exchange Server 2007 > Exchange Management Shell.
\n\t- In the command prompt window, type the following line and press Enter.
\n
\n
get-mailboxserver <Exchange2007> | get-ADpermission -user <BESAdmin> | Format-List
\nTo verify the Send As, Receive As, and Administer Information Store permissions at the mailbox store level, complete the following steps:\n
\n\t- Click Start > Programs > Microsoft Exchange Server 2007 > Exchange Management Shell.
\n\t- In the command prompt window, type the following and press Enter.
\n
\n
get-mailboxdatabase <Exchange2007><dbname> | get-ADpermission -user <BESAdmin> | Format-List\nNext open active directory users and computers\ngo to view> advanced features\nright click on your domain name and go to properties. Click the security tab>click advanced. click the add button and add the besadmin account. On the window that pops up there is an apply onto section select "user objects" in this field. Then scroll to the bottom and select send as grand the "allow" checkbox. click ok.
