BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 07-21-2010, 04:40 AM   #1 (permalink)
New Member
 
Join Date: Jul 2010
Model: 9500
PIN: N/A
Carrier: Vodafone
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default BesAdmin domain admin

Please Login to Remove!

Hi Folks,
BES 4.1.6.9 Server 2003, Exchange 2003.
I'm running BesAdmin on lowest priveledges as recommended.
Would anything break if I added BesAdmin to Domain Admins?

Thanks in advance,
Offline  
Old 07-21-2010, 04:46 AM   #2 (permalink)
BBF War Game Mod
 
Jadey's Avatar
 
Join Date: Oct 2006
Location: Denver CO
Model: Z10
OS: 10010614
PIN: SEEKRIT innit
Carrier: AT&T
Posts: 4,294
Post Thanks: 9
Thanked 29 Times in 23 Posts
Default

If everything is currently working on your BES, why would you want to do this?
__________________
Jadey : Groupware Infrastructure Architect, Denver CO
If I'm not here, I'm playing World's End on FaceBook. Mob/Mafia Wars are SOO last year
Offline  
Old 07-21-2010, 04:49 AM   #3 (permalink)
BBF War Game Mod
 
Jadey's Avatar
 
Join Date: Oct 2006
Location: Denver CO
Model: Z10
OS: 10010614
PIN: SEEKRIT innit
Carrier: AT&T
Posts: 4,294
Post Thanks: 9
Thanked 29 Times in 23 Posts
Default

Off the top of my head, Exchange denies send as/receive as to domain admins on 2k3. I admin an Exchange 2k7 BES, but my history is in Domino, so I am not 100% on this, but I think you are heading into stormy waters trying to run a 2k3 Exch/4.1.x BES as a Domain Admin account...
__________________
Jadey : Groupware Infrastructure Architect, Denver CO
If I'm not here, I'm playing World's End on FaceBook. Mob/Mafia Wars are SOO last year
Offline  
Old 07-21-2010, 04:51 AM   #4 (permalink)
BBF War Game Mod
 
Jadey's Avatar
 
Join Date: Oct 2006
Location: Denver CO
Model: Z10
OS: 10010614
PIN: SEEKRIT innit
Carrier: AT&T
Posts: 4,294
Post Thanks: 9
Thanked 29 Times in 23 Posts
Default

In fact, here you go

Domain Admin, Send As, and Red X issue
__________________
Jadey : Groupware Infrastructure Architect, Denver CO
If I'm not here, I'm playing World's End on FaceBook. Mob/Mafia Wars are SOO last year
Offline  
Old 07-21-2010, 05:05 AM   #5 (permalink)
New Member
 
Join Date: Jul 2010
Model: 9500
PIN: N/A
Carrier: Vodafone
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Hi, thanks for the replies.
As a very busy domain admin, having a second "normal" AD credential just isn't practical. All my 110 users are fine, just my account fails on address lookup occasionally, and I have sync issues.

Have installed and configured bog standard, permissioning is correct.
Offline  
Old 07-21-2010, 05:12 AM   #6 (permalink)
BBF War Game Mod
 
Jadey's Avatar
 
Join Date: Oct 2006
Location: Denver CO
Model: Z10
OS: 10010614
PIN: SEEKRIT innit
Carrier: AT&T
Posts: 4,294
Post Thanks: 9
Thanked 29 Times in 23 Posts
Default

Not sure I am understanding the issues here TBH.

If you are the only user having address lookup issues and sync issues, how would making the BESAdmin account a Domain Admin help with that?

TBH, RIM says do NOT put BES Admin as Domain Admin, it will cause problems.

So if you're having a side issue that you thought this might fix, please feel free to post the full issue and we will see if we can work it out. Either way, a good fix is not BESAdmin=Domain Admin
__________________
Jadey : Groupware Infrastructure Architect, Denver CO
If I'm not here, I'm playing World's End on FaceBook. Mob/Mafia Wars are SOO last year
Offline  
Old 07-21-2010, 10:24 AM   #7 (permalink)
BlackBerry Elite
 
knottyrope's Avatar
 
Join Date: Jan 2008
Location: Massachusetts
Model: Z30
OS: 10.2.1
PIN: t of blood has been taken
Carrier: AT&T-US with I dee ten tee errors
Posts: 6,721
Post Thanks: 272
Thanked 289 Times in 273 Posts
Default

Dont do it, BESAdmin as a domain admin will break BES and cause you hours of fixing it.
__________________
irony : many old timer posters have de-evolved into the trolls they once fought
I am on http://supportforums.blackberry.com
BES 10 running sweet for my Z30, Z10 and Q10
Offline  
Old 07-21-2010, 10:55 AM   #8 (permalink)
CrackBerry Addict
 
Join Date: Jan 2008
Model: 9700
PIN: N/A
Carrier: Rogers
Posts: 709
Post Thanks: 0
Thanked 8 Times in 8 Posts
Default

Please tell me you're not using your own account for the BESAdmin account...

We're all busy people but I've found that if I'm going to log into a server to do something anyway, I might as well use admin credentials then and only then.
Offline  
Old 07-21-2010, 11:23 AM   #9 (permalink)
BlackBerry Elite
 
knottyrope's Avatar
 
Join Date: Jan 2008
Location: Massachusetts
Model: Z30
OS: 10.2.1
PIN: t of blood has been taken
Carrier: AT&T-US with I dee ten tee errors
Posts: 6,721
Post Thanks: 272
Thanked 289 Times in 273 Posts
Default

Quote:
Originally Posted by Dare View Post
Hi, thanks for the replies.
As a very busy domain admin, having a second "normal" AD credential just isn't practical. All my 110 users are fine, just my account fails on address lookup occasionally, and I have sync issues.

Have installed and configured bog standard, permissioning is correct.

If you want your BES and handhelds to work correctly for everyone, all of the time, then you need to follow RIM's guidelines and best practices.

It's called the Principle of Least Privilege... and you're not following it.

Principle of least privilege - Wikipedia, the free encyclopedia
Principle of least privilege - Wikipedia, the free encyclopedia

Make yourselves normal users, and then create a secondary login with Domain Admin privileges. Only use that secondary login when necessary.
__________________
irony : many old timer posters have de-evolved into the trolls they once fought
I am on http://supportforums.blackberry.com
BES 10 running sweet for my Z30, Z10 and Q10
Offline  
Old 07-21-2010, 01:45 PM   #10 (permalink)
BlackBerry God
 
penguin3107's Avatar
 
Join Date: Jan 2005
Model: iOS 5
Carrier: VZW
Posts: 11,701
Post Thanks: 1
Thanked 237 Times in 219 Posts
Default

Quote:
Originally Posted by knottyrope View Post
It's called the Principle of Least Privilege... and you're not following it.

Principle of least privilege - Wikipedia, the free encyclopedia
Principle of least privilege - Wikipedia, the free encyclopedia

Make yourselves normal users, and then create a secondary login with Domain Admin privileges. Only use that secondary login when necessary.
Hey... at least give me some credit here. I knew that blurb sounded familiar.
Domain Admin, Send As, and Red X issue
__________________
BCSA
BES 5.0.3 MR4 :-: Exchange 2007 SP3 RU3
http://port3101.org

Last edited by penguin3107 : 07-21-2010 at 01:47 PM.
Offline  
Old 07-21-2010, 01:56 PM   #11 (permalink)
BlackBerry Elite
 
knottyrope's Avatar
 
Join Date: Jan 2008
Location: Massachusetts
Model: Z30
OS: 10.2.1
PIN: t of blood has been taken
Carrier: AT&T-US with I dee ten tee errors
Posts: 6,721
Post Thanks: 272
Thanked 289 Times in 273 Posts
Default

about time you picked up on it

I really liked the way you worded it that time.
__________________
irony : many old timer posters have de-evolved into the trolls they once fought
I am on http://supportforums.blackberry.com
BES 10 running sweet for my Z30, Z10 and Q10
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright 2004-2014 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.