METADATA FRAMEWORK. On-Premises Exchange Permissions

Transcription

1 METADATA FRAMEWORK On-Premises Exchange Permissions

2 Publishing Information Software version Document version 4 Publication date May 22, 2017 Copyright Varonis Systems Inc. All rights reserved. This information shall only be used in conjunction with services contracted for with Varonis Systems, Inc. and shall not be used to the detriment of Varonis Systems, Inc. in any manner. User agrees not to copy, reproduce, sell, license, or transfer this information without prior written consent of Varonis Systems, Inc. Other brands and products are trademarks of their respective holders.

3 CONTENTS Chapter 1: Exchange Permissions Overview...1 Installation Requirements...1 Permanent File Server Account Requirements (for FileWalk)... 1 Commit Credentials...2 Permission Requirements for the Installation User...2 Permissions Required for the FileWalk...3 Permissions Required per Component...3 Probe...3 FileWalk... 3 Commit Engine...6 Chapter 2: Permissions and Settings for Exchange Servers...8 Assigning Administer Information Store Permissions...8 Assigning Exchange Full Administrator Role (Exchange 2003) METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS iii

4 1 EXCHANGE PERMISSIONS OVERVIEW This chapter summarizes the roles and required for adding an Exchange server to the Metadata Framework. Installation Requirements Installation requires: A user who is a member of: 2003: Exchange Full Administrator role 2007: Exchange Organization Administrators 2010: Exchange Organization Management role 2013: Exchange Organization Management role 2016: Exchange Organization Management role on all the servers on which auditing agents are installed: 2003: Mailbox servers (MBX) 2007: Mailbox servers 2010: Client Access Servers (CAS), mailbox servers (MBX) 2013: Mailbox servers (MBX), for both mailboxes and public folders 2016: Mailbox servers (MBX), for both mailboxes and public folders Permissions to Active Directory (2007/2010/2013, 2016 only) - Member of Account Operators or Domain Admins Note: For Exchange 2003, the installation user can be either an Exchange Full Administrator or a Domain Admin. For Exchange 2013 and 2013 SP1 - The Exchange 2013 server certificate must also be present on the Probe and Collector servers to enable connection. For Exchange The Exchange 2016 server certificate must also be present on the Probe and Collector servers to enable connection. Permanent File Server Account Requirements (for FileWalk) Permanent file server user (for FileWalk/Probe): Simple user (a new one can be created) Power users on each server on which the agent is installed: 2003: Mailbox servers (MBX) 2007: Mailbox servers 2010: Client Access Servers (CAS), mailbox servers (MBX) 2013: Mailbox servers (MBX), for both mailboxes and public folders 2016: Mailbox servers (MBX), for both mailboxes and public folders METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 1

5 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW A separate user for installation can be defined in the Agent Deployment dialog box. The Enterprise Installer gives the user account the following on the Exchange Server: List contents Active Directory on and under the CN=<organization name> node Administer Information Store for the MAPI FileWalk user on each monitored mailbox database (can be assigned for the CN=<organizationname> node). Note: The user should not be defined as an Exchange Administrator or a Domain Admin. Commit Credentials Commit credentials For changing mailbox : 2003: N/A 2007: Exchange Organization Administrator role 2010: Exchange Organization Management role 2013: Exchange Organization Management role For changing sharing : 2003: N/A 2007: Exchange Recipient Administrator role, Owner permission level on the folder or Full Access on the mailbox. 2010: Exchange Recipient Administrator role, Owner permission level on the folder or Full Access on the mailbox. 2013: Exchange Recipient Administrator role, Owner permission level on the folder or Full Access on the mailbox. on the CAS on which the Commit agent will be run To enable running the commit process on public folders for specific users, the users must added to Exchange Admin Center > Public Folders > Folder Permissions > Manage. Permission Requirements for the Installation User List contents AD on and under the CN=Configuration, CN=Exchange node List contents AD on the user Owner and modify owner rights for CN=<organization name> Read and modify security descriptors for server CNs (CN=Configuration, CN=Services, CN=Microsoft Exchange, CN=<organization name>, CN= Administrative Groups, CN=Servers, CN=<server name>) Account Operator or Domain Admin In a clustered Exchange environment, local administrator on all physical machines in the cluster on the installation server on the client access server (CAS) and mailbox (MBX) servers you want to audit METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 2

6 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW on the CAS on which you want to run the Commit agent One of the following: 2003: Exchange View Only Administrator role 2007: Exchange Recipient Administrator role 2010: Exchange Recipient Management role 2013: Exchange Recipient Management role Permissions Required for the FileWalk List contents AD on and under the CN=<organization name> node Administer Information Store for the MAPI FileWalk user on each monitored mailbox database (can be assigned for the CN=<organization name> node). Permissions Required per Component The following tables list what are required for each component: Probe Component Action Purpose Minimum needed Probe Start the CIFS Queue service Connects the auditing agents and the Probe FileWalk Component Action Purpose Minimum needed ADWalk Step Read user ADsecurity-descriptor (for all users with mailboxes) Read send as List contents on user objects (same requirements as regular ADWalk) ADWalk Step Read exchangesecurity-descriptor (for all users with mailboxes) Read full access List contents on user objects (same requirements as regular ADWalk) METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 3

7 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW Component Action Purpose Minimum needed ADWalk Step Read delegates AD property (for all users with mailboxes) Read send on behalf List contents on user objects (same requirements as regular ADWalk) ADWalk Step Read mailboxdatabase securitydescriptor (for all mailbox databases in monitored MBXs) Read the inherited full access List contents AD on and under the CN=<organization name> node MAPI Step Access all mailboxes (in monitored MBXs) Read mailbox folders hierarchy and sharing Administer information store for the MAPI FileWalk user on each monitored mailbox database (can be assigned on the CN=<organization name> node) MAPI Step List Exchange servers Allows the user to pick servers from a list List contents AD on and under the CN=Configuration, CN=Exchange node. MAPI Step Get cluster nodes using WMI Deploy agent on physical cluster nodes on the monitored cluster MAPI Step Check for FileWalk user mailbox existence N/A List contents AD on the folder containing the user MAPI Step Install remote execution service on 2007/2010/2013 CAS/MBX (for uninstall as well). Run the PowerShell scripts on the installation server METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 4

8 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW Component Action Purpose Minimum needed MAPI Step Run PowerShell with Exchange snap-in Configure Exchange settings (see PowerShell script action). on the installation server VB Script (2003 only) Create mailbox for FileWalk user N/A Permissions to create a user object in AD (Domain Admin, Account Operator) and Exchange view only administrator role PowerShell Script (2007, 2010 and 2013 only) Create or enable mailbox for the FileWalk user FileWalk user must have a mailbox in order to access public folders and member of one of the following groups: Recipient Management Exchange Recipient Administrator Exchange Recipient Administrator PowerShell Script (2007, 2010 and 2013 only) Remove previous Varonis journaling mailboxes Remove traces of previous installations (for upgrades from x/5.6.x) and member of one of the following groups: Recipient Management Exchange Recipient Administrator Exchange Recipient Administrator PowerShell Script (2007, 2010 and 2013 only) Install the commit agent on CAS N/A on the CAS METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 5

9 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW Component Action Purpose Minimum needed PowerShell Script (2007, 2010 and 2013 only) Assign list contents AD on the CN=Configuration, CN=Exchange node, for the ADWalk user Allows ADWalk step to read inherited full access from the mailbox database CNs. Owner and modify owner rights on the organization CN, usually a domain admin PowerShell Script (2007, 2010 and 2013 only) MAPI only: Assign administer information store for MAPI FileWalk user N/A Domain admin PowerShell Script (2007, 2010 and 2013 only) Setting registry values on CAS/MBX Set the RPC disconnection method on the CAS/MBX (only on the MBX in 2013) PowerShell Script (2007, 2010 and 2013 only) Install auditing agents on CAS/MBX Run the auditing agents MSI on the CAS/MBX (only on the MBX in 2013) Commit Engine Component Action Minimum needed Commit Changing mailbox : Full access, send as and member of the following group: 2007: Exchange Recipient Administrator 2010: Recipient Management 2013: Recipient Management Commit Changing mailbox : Delegates (send on behalf) Full access on the mailbox METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 6

10 Chapter 1 EXCHANGE PERMISSIONS OVERVIEW Component Action Minimum needed Commit Changing sharing One of the following: Folder owner flag Full access on the mailbox and member of one of the following groups: Exchange Recipient Administrator Recipient Management 2013: Recipient Management METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 7

11 2 PERMISSIONS AND SETTINGS FOR EXCHANGE SERVERS This chapter describes how to set the required and settings for the Exchange server. Assigning Administer Information Store Permissions This task describes how to assign administer information store, which are required by the FileWalk user. 1. Open the ADSI Edit application (Start > Run)and then type adsiedit.msc. The ADSI Edit window opens. 2. Right click ADSI Edit and select Connect to. The Connection Settings window is displayed. METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 8

12 Chapter 2 PERMISSIONS AND SETTINGS FOR EXCHANGE SERVERS 3. Do the following: a. From the Select a well known Naming Context drop-down list, select Configuration. b. Click OK. The Connection Settings window closes and the Configuration option is displayed in the ADSI Edit window. 4. Do the following: a. Browse toconfiguration > CN=Configuration > CN=Services > CN=Microsoft Exchange > CN=<organization name>,where <organization name> is the name of your organization as defined in the Active Directory. b. Right click CN=<organization name> and select Properties. The Properties window is displayed. 5. Select the Security tab, and then click Advanced. The Advanced Security Settings window is displayed. 6. Do the following: a. Click Add. The Select User window is displayed. METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 9

13 Chapter 2 PERMISSIONS AND SETTINGS FOR EXCHANGE SERVERS b. In the Enter the object name text box, type the name and domain of the FileWalk user (<user>@<domain> syntax). c. To verify the FileWalk user exists in the Active Directory, click Check Names. d. Click OK. The Permission Entry window is displayed. 7. In the Permissions area, scroll down to Administer information store, and then select Allow. Important: If one of the nodes between CN=<organization name> and CN=Mailbox Database is protected, the Administer information store might not be inherited by CN=Mailbox Database. In this case, the Administer information store must be assigned directly to one of the following nodes: CN=Administrative Groups CN=Exchange Administrative Group CN=Mailbox Database METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 10

14 Chapter 2 PERMISSIONS AND SETTINGS FOR EXCHANGE SERVERS The following notes cannot be assigned Administer information store (as they are not available): CN=Microsoft Exchange CN=Databases Legend Red: Nodes on which Administer information store cannot be assigned Green: Nodes on which Administer information store can be assigned 8. Click OK. The Permission Entry window closes and the user is assigned administer information store. Note: For 2007, 2010 and 2013 Exchange servers, this task can be carried out by typing the following in the PowerShell command line: Get-OrganizationConfig Add-ADPermission -User <User> - ExtendedRights ms-exch-store-admin -InheritanceType All Where <user> is the FileWalk user. Assigning Exchange Full Administrator Role (Exchange 2003) To assign a full administrator role: Note: This task is only relevant for Exchange Open the Exchange System Manager application. 2. Right click the first item (usually the name of your organization), and then select Delegate control. The Exchange Administration Delegation Wizard window is displayed. METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 11

15 Chapter 2 PERMISSIONS AND SETTINGS FOR EXCHANGE SERVERS 3. Click Add. 4. Add the user installing the Exchange server, and select the Exchange Full Administrator option. 5. Click Next, and then click OK. The wizard closes and the selected user is assigned the role of Exchange full administrator. METADATA FRAMEWORK ON-PREMISES EXCHANGE PERMISSIONS 12