For each Exchange Server in the organization that functions as a Client Access Server (CAS), you must provide the ms-Exch-EPI-Impersonation Active Directory extended permission to the service account on the Server object of Exchange Server in Active Directory.
You must provide the ms-Exch-EPI-May-Impersonate extended permission to the Exchange store objects hosting Messaging users.
Note The service account that you use must not be a member of any Administrative Group, for example, Domain Admins, because the system explicitly denies these permissions for these groups.
Usually, you must provide the permission using the Add-ADPermission cmdlet on Exchange Management Shell, although you can also use Active Directory Sites and Services or Active Directory Users and Computers.
Note To complete the permission assignments, use an account with Domain Administrator credentials as well as administrative credentials for the computers on which you have installed the Exchange 2007 Client Access Server roles.
Procedure
- Open Exchange Management Shell.
- Use the Add-ADPermission cmdlet to assign ms-Exch-EPI-Impersonation permission for user accounts. The following cmdlet syntax grants the service account permission to impersonate all accounts for each Client Access Server. Replace AuraMsgSvcAcctSiteA in the following cmdlet with your Messaging Service Account: Get-ExchangeServer | where {$_.IsClientAccessServer -eq $TRUE} | ForEach-Object {Add-ADPermission -Identity $_.distinguishedname -User (Get-User -Identity AuraMsgSvcAcctSiteA | select-object).identity -extendedRight ms-Exch-EPI-Impersonation}
- Use the Add-ADPermission cmdlet to assign the ms-Exch-EPI-May-Impersonate permission for Exchange Store objects on each Exchange Server hosting Avaya users. Replace AuraMsgSvcAcctSiteA in the following cmdlet with your Messaging Service Account: Get-MailboxDatabase | ForEach-Object {Add-ADPermission -Identity $_.DistinguishedName -User AuraMsgSvcAcctSiteA -ExtendedRights ms-Exch-EPI-May-Impersonate}
Important You must run the above command again after creating new mailbox databases that will host Avaya users.
For more information, see the Microsoft Exchange Server website.