Microsoft Exchange Server default permissions

I have few doubts regarding the default permissions configured in Exchange server. I think all permissions are configured in pagefile.sys file.

Does anyone know how the owner here?

I mean who has the ability to change or modify the permissions?

Is it the Trusted Installer or Administrator?

How permissions are sets for access and for the registry roots HKCR, HKCU, HKLM, HKU, HKCC?

Which are the keys not accessible to Administrator?

Is there any good document available to refer the default permissions in Microsoft Exchange server?

In Exchange Server 2010, complete all tasks on the Exchange Management Console, the Exchange Management Shell or the Exchange Web management interface. These management tools use the role-based access control (Role Based Access Control RBAC) for authorization. In RBAC management role to play groups, the most important role. RBAC can lead to an action, exchange activities in the context of the trusted subsystem Exchange (Exchange Trusted Subsystem) and not in the context of the user through. The Exchange Trusted Subsystem is universal security group permissions, read and write access to all Exchange-related objects in the Exchange organization has. It also belongs to the local Administrators security group and the group Exchange- Windows -Permissions that Exchange to create and manage Active Directory allows objects. Management role groups are universal security groups (universal security group, USG). Role groups to define key administrative tasks and allow the members of various rights. On the Edge Transport server administrators to manage local settings. Here you control the authorization of the membership of the local Administrators group. Add a mailbox to a role as a group member who has the Exchange mailbox all provided by the administrative role permissions.

A permission relates to the Exchange server itself, because Exchange 2000 only on a server running a Windows 2000, anyone who is administrator of the server itself, stop and start services, change registry values, file sharing, etc. An administrator on the server itself is not an administrator on the Exchange service and its configuration. This is a permission that is anchored in the Active Directory. But because of the damage potential, it is important to consider what position the Exchange server takes over the network. As a member server, it is particularly well protected. By providing a domain administrator can be locked and vice versa, a local administrator is not automatically a domain administrator. It is a peculiarity in the use of OWA, because on a domain controller cannot log in "normal users" generally allowed. But then does not even OWA. Unless I give the users the right to "log on locally". Then the user could yourself but "on the server" log on interactively (Terminal Services or on the console) and deal with share-level permissions.

In my case, there is no way I can able to open and read the permissions or security on pagefile.sys. Whenever I try to read, it shows only one message on the tab which is something like unable to display security. I have been trying to get access and ownership of that file because the pagefile.sys should be owned by Administrators. I am not sure what kind of problem. It is an OEM version and I am sure that it is clean. Also I cannot able to list the pagefile.sys but the pagefile.sys is visible in explorer window logged on as standard user.

With Exchange Server 2010, Microsoft has significantly revised the authorization model. The following article deals with administrative roles and explains step by step how to deal with the role-based permissions. The management of permissions in Exchange Server 2010 can be performed only by default in the Exchange Management Shell. The role-based permissions can be customized with Service Pack 1 for Exchange Server 2010 to manage in the Exchange Control Panel. In addition to numerous improvements integrated with the Microsoft Service Pack 1 even more options in the Exchange Management Console. In particular, the Exchange Control, which can be accessed via the address https:// servername / ecp, receives more features. After installing Service Pack 1 can be created in the Exchange Control Panel Transport and journal rules. The role-based authorization (RBAC) can now be adjusted in the Control of Exchange.

By this method you will see the list of all default permissions on the Exchange Organization which are present on the root of ESM. You need some permission in order to perform exchange correctly. If you don’t set the correct permissions, it can cause Recipient Update Service not running, unauthorized access to users and security vulnerabilities to mailboxes

• Open ESM, right click on Exchange Org name and choose properties. Choose the security tab. If you are not able to get the Security tab, then close ESM and go to Start, Run, type Regedit. Navigate to: HKEY_Current_User\Software\Microsoft\Exchange\Exadmin.
• Create a new DWORD with a name like: ShowSecurityPage and value: 1 (Decimal). Close Registry.
• Now you should see the Security Tab is ESM. In that you will see the list of Exchange Domain Servers for each domain that you host. This contains each domain regarding the respective Exchange servers and has the access to Exchange Configuration container in AD.
• Authenticated Users gets special permissions (Read Properties as well as List Object)