message tracking in exchange 2007: access is denied

References start here.

You can enable or disable message tracking by using the Exchange Management Console only in Exchange 2007 SP1

Like public folders, Microsoft chose to just leave message tracking out of the GUI.

By default, message tracking is enabled on all Exchange 2007 computers that have the Hub Transport, Mailbox, or Edge Transport server roles installed.

While using the Exchange Troubleshooting Assistant, which I found through the EMC to try to do Message Tracking (damn wizards) I keep getting “The error message is:Access is denied”.

I didn’t set up this Exchange 2007 install, so it’s been fun poking around it. As it turns out, the default permissions groups were redesigned since 2003. Check out this, part 1 and part 2. “Exchange Organization Administrators” is Exchange Root now or ‘Exchange Full Administrator’ if you prefer actually terms. Through some twist of fate (group stacking a few deep) I was in ‘Exchange View-Only Administrators’. You’d think searching the message tracking logs would fall under ‘view-only’. I guess not.

I went and added ‘Domain Admins’ to ‘Exchange Organization Administrators’. Some day when we have a full time exchange dude… hehe, I’ll change this I guess. Logged out and logged back in and the message tracking works now for me.

It’s interesting to note that it seems like the back end is much better. You don’t have to select a server or anything and there are many more new search options, so kudos to the search options.

I also spent a while searching trying to remember how to do the equivalent of ‘gpresult’ to see what groups I was in. Lots of info out there with old NT commands to distract but I guessed at ‘whoami’ and found that ‘whoami /groups’ will tell you what groups you’re in. This was useful, no doubt.

1 thought on “message tracking in exchange 2007: access is denied

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload the CAPTCHA.