Methods for Creating a Super User Account

Using an Existing Account

If you do decide to use an existing account, we recommend that you:

• Change the password for the existing account.
• Set the password to never expire.

Using a New Account

If you are using a new account, do the following:

• Using the tool appropriate for your platform, create a new account to run Microsoft Outlook to InterAction Sync. Specify that the account’s password never expires and that the user cannot change the password.

  This account is granted access to all Exchange mailboxes in your Exchange organization. Be cautious with the password for this user.

• Once you have the Windows account set up properly, grant permissions to the Exchange Message Store. You can select to grant this account permission to the entire Exchange organization (if you are harvesting data for all employees) or just to specific users’ mailboxes.

Using the Exchange 2007/2010 Management Shell to Create a New Super User Account

1. Open the Exchange Management Shell.

2. Execute the following command to be prompted for a Super User password.

   $password = Read-Host "Enter password" -AsSecureString

3. Set the Super User password after receiving the “Enter password” prompt.

4. Enter the following command (replacing the text in <> with your Super User information) to create the Super User mailbox account.

   New-mailbox -UserPrincipalName <String> -alias <String> -database 
   "<DatabaseIdParameter>" -Name <String> -OrganizationalUnit
   <OrganizationalUnitIdParameter> -password <SecureString> -FirstName
   <String> -LastName <String> -DisplayName "<String>" - 
   ResetPasswordOnNextLogon $false

5. Set the Super User account permission on an individual Mailbox database:

   Get-MailboxDatabase -identity "ServerName\First Storage Group\Mailbox 
   Database" | Add-ADPermission -user "DomainName\UserName" -ExtendedRights 
   Receive-As, Send-As

6. Verify the rights for the super user on the mail database by entering the following command (replacing the text in <> with your super user information):

   Get-MailboxDatabase | get-adpermission -user "<String>"

Example: Sample Command for Creating a Super User Mailbox Account

New-mailbox -UserPrincipalName [e-mail] -alias iasync -database "Mailbox 
Database" -Name IASYNC -OrganizationalUnit Users -password $password -FirstName InterAction - 
LastName ExchangeSync -DisplayName "InterAction Exchange Sync" -ResetPasswordOnNextLogon $false

Example: Sample Command for Setting the Super User Account Permission on an Individual Mailbox Database

Get-MailboxDatabase -identity "Chicago\First Storage Group\Exchange Mailbox Database" | Add- 
ADPermission -user "legal\emroberts" -ExtendedRights Receive-As, Send-As

Example: Sample Command for Verifying the Rights for the Super User on the Mail Database

Get-MailboxDatabase | get-adpermission -user "iasync"

Note: What are the Minimum Required Settings for the Super User Account?

For security reasons, many organizations want to assign only the minimum security settings that are required for the Super User account. The Super User account only requires the Receive As, Send As and Create named properties in the information store security permissions on the server object or any administrative mailbox grouping in the Microsoft Exchange System Manager. These settings are sufficient for the Outlook to InterAction Synchronization process.

1. In the Microsoft Exchange System Manager, right-click the server name or mailbox storage group and then choose Properties.
2. Choose the Security tab.
3. Choose Add to add a new account for the super user.
4. Enter the account information and then choose OK.

5. In the Permissions area of the Properties dialog box, scroll down until you reach the Create named properties in the information store, Receive As, and Send As permissions. For each of these permissions, place a check mark in the Allow check box.

   

6. Choose OK to close the Properties dialog box.