如何在创建Exchange邮箱时配置权限(3)

Dim objContainerDim objUserDim objMailboxDim oSecurityDescriptorDim daclDim ace' ********************************************************************' You must change this variable according to your environment'sContainerADsPath = "LDAP://domain.com/cn=Users,DC=domain,DC=com"sUserLoginName = "testUser"sUserFirstName = "Test"sUserLastName = "User"sMBXStoreDN = "CN=Mailbox Store (ExServer),CN=First Storage Group," & _   "CN=InformationStore,CN=ExServer,CN=Servers,CN=AdminGP," & _   "CN=Administrative Groups,CN=Microsoft,CN=Microsoft Exchange," & _   "CN=Services,CN=Configuration,DC=domain,DC=com"sTrustee = "domainName\userName"' ********************************************************************' Get directory container object objectSet objContainer = GetObject(sContainerADsPath)' Create the user object in the target container in Active DirectorySet objUser = objContainer.Create("User", "CN=" & sUserFirstName & " " & _              sUserLastName)objUser.Put "samAccountName", sUserLoginNameobjUser.Put "givenName", sUserFirstNameobjUser.Put "sn", sUserLastNameobjUser.SetInfoobjUser.SetPassword "password"objUser.SetInfo' Mailbox enable the user object by using the CDOEXM::IMailboxStore' interface' This also sets the msExchMailboxSecurityDescriptor appropriatelySet objMailbox = objUserobjMailbox.CreateMailbox sMBXStoreDNobjUser.SetInfo'**************************************************************************'  The msExchMailboxSecurityDescriptor attribute is a backlink attribute'   from the Exchange Mailbox in the Web Store to the directory. What this'   implies is that the mailbox rights are stored on the actual mailbox in'   the Web store and this directory attribute reflects these mailbox'   rights.'  By default, changing this attribute does not affect the mailbox rights'   in the store. This attribute can only be modified before the actual'   mailbox in the store is created. If it is set before the mailbox in'   the Web store is created, Exchange will use the DACL set on this'   attribute as the DACL for mailbox rights on the mailbox in the store.'   Therefore, it can only be set before the mailbox creation time.'  On installing Exchange 2000 SP2 on the Exchange Server where this code'   is being run, that would enable modifying the actual mailbox rights'   even after mailbox creation.'**************************************************************************' Get the copy Mailbox Security Descriptor (SD) stored on the' msExchMailboxSecurityDescriptor attributeobjUser.GetInfoEx Array("msExchMailboxSecurityDescriptor"), 0Set oSecurityDescriptor = objUser.Get("msExchMailboxSecurityDescriptor")' Extract the Discretionary Access Control List (ACL) using the' IADsSecurityDescriptor interfaceSet dacl = oSecurityDescriptor.DiscretionaryAcl''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''  The following block of code demonstrates reading all the ACEs on a'  DACL for the Exchange 2000 mailbox.'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''Wscript.echo "Here are the existing ACEs the mailbox's DACL - "' Enumerate all the access control entries (ACEs) in the ACL using' the IADsAccessControlList interface, thus displaying the current' mailbox rightsWscript.echo "Trustee, AccessMask, ACEType, ACEFlags, Flags, ObjectType, InheritedObjectType"Wscript.echo "-------  ----------  -------  --------  -----  ----------" & _            " -------------------"Wscript.echoFor Each ace In dacl' Display all the ACEs' properties using the IADsAccessControlEntry' interface    Wscript.echo ace.Trustee & ", " & ace.AccessMask & ", " & _      ace.AceType & ", " & ace.AceFlags & ", " & ace.Flags & ", " & _      ace.ObjectType & ", " & ace.InheritedObjectTypeNext''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''  The following block of code demonstrates adding a new ACE to the DACL'  for the Exchange 2000 mailbox with the Trustee specified in sTrustee,'  giving allow "Full Control" over this mailbox.'  This is the same task that is performed by ADUnC when selecting Add,'  specifying the Trustee, and checking the "Full Mailbox Access" Rights'  checkbox under the Mailbox Rights in the Exchange Advanced tab on the'  properties of a user.'  Similarly, you could remove ACEs from this ACL as well using the'  IADsAccessControlEntry interfaces.'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Template: AddAce(TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)' Setting the Access Mask to 131075 enables "full mailbox access" and' "read" priviledgesAddAce dacl, sTrustee, 131075, _       ADS_ACETYPE_ACCESS_ALLOWED, ADS_ACEFLAG_INHERIT_ACE, 0, 0, 0' Add the modified DACL back onto the Security DescriptoroSecurityDescriptor.DiscretionaryAcl = dacl' Save New SD onto the userobjUser.Put "msExchMailboxSecurityDescriptor", oSecurityDescriptor' Commit changes from the property cache to the information storeobjUser.SetInfoMsgBox "Done viewing and modifying the copy of the Mailbox Security Descriptor"'********************************************************************'*'* Function AddAce(dacl, TrusteeName, gAccessMask, gAceType,'*            gAceFlags, gFlags, gObjectType, gInheritedObjectType)'*'* Purpose: Adds an ACE to a DACL'* Input:       dacl            Object's Discretionary Access Control List'*              TrusteeName     SID or Name of the trustee user account'*              gAccessMask     Access Permissions'*              gAceType        ACE Types'*              gAceFlags       Inherit ACEs from the owner of the ACL'*              gFlags          ACE has an object type or inherited object type'*              gObjectType     Used for Extended Rights'*              gInheritedObjectType'*'* Output:  Object - New DACL with the ACE added'*'********************************************************************Function AddAce(dacl, TrusteeName, gAccessMask, gAceType, gAceFlags, gFlags, gObjectType, gInheritedObjectType)    Dim Ace1    ' Create a new ACE object    Set Ace1 = CreateObject("AccessControlEntry")    Ace1.AccessMask = gAccessMask    Ace1.AceType = gAceType    Ace1.AceFlags = gAceFlags    Ace1.Flags = gFlags    Ace1.Trustee = TrusteeName    'Check to see if ObjectType needs to be set    If CStr(gObjectType) <> "0" Then       Ace1.ObjectType = gObjectType    End If    'Check to see if InheritedObjectType needs to be set    If CStr(gInheritedObjectType) <> "0" Then        Ace1.InheritedObjectType = gInheritedObjectType    End If    dacl.AddAce Ace1    ' Destroy objects    Set Ace1 = NothingEnd Function				 
			   
			   

                       标签：
                   
                   
版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com

特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有