It appears that the Besadmin account has access to all mailboxes.

Is it possible to remove the Besadmin account from having rights to these? If I did this, what would happen?

Also, when installing updates/upgrades on the BES do I have to be logged into the server as Besadmin or can I just be logged on as Administrator?

I know these may seem like a strange questions buy my IT Security Manager requested that I check this out.

Thanks!
Wanabe

If you remove the BESAdmin account's Exchange permissions then the BES server will not be able to access the hidden folder/files created in each BlackBerry user's mailbox and the BES system will not work. A read-only copy of each user's encryption key, for example, are stored in the Exchange mailboxes.

When you are installing service packs and hotfixes you should be logged using the BESAdmin account.

Thanks for your response crowdienz.

I guess the main issue was whether you absolutly had to be logged in as BESAdmin when performing upgrades/updates. It sounds like this is a must if I'm hearing you correctly.

The reason I ask is because we are trying to research if it's possible to have an off-site high level official be the only one with access to the BESAdmin account while still being able to perform day to day routine maint. on the server with only the Administrator account.

What do you think?

Thanks!
Wanabe

The BES 4.1 solution will support multiple levels of administration, which sounds like what you need.