Table Of Contents

Permissions Set by the Cisco Unity Permissions Wizard

Permissions Set When Cisco Unity Subscribers Are Homed in Exchange 2003 and/or Exchange 2000 (With or Without Exchange 5.5)

Permissions Set for the Installation Account

User Rights

Group Membership

Active Directory Permissions

Permissions Set For the Directory Services Account

User Rights

Group Membership

Active Directory Permissions

Permissions Set For the Message Store Services Account

User Rights

Group Membership

Active Directory Permissions

Exchange Permissions

Permissions Set When Cisco Unity Subscribers Are Homed Only in Exchange 5.5

Permissions Set for the Installation Account

User Rights

Group Membership

Permissions Set for the Directory and Message Store Services Account

User Rights

Group Membership

Permissions Set by the Cisco Unity Permissions Wizard

---

This appendix enumerates the permissions set automatically by the Cisco Unity Permissions wizard. Some accounts also require that Exchange permissions be set manually. For more information, see the "Setting Exchange Permissions" section.

This appendix contains the following sections:

•Permissions Set When Cisco Unity Subscribers Are Homed in Exchange 2003 and/or Exchange 2000 (With or Without Exchange 5.5)

•Permissions Set When Cisco Unity Subscribers Are Homed Only in Exchange 5.5

For information about using the Permissions wizard, see the "Setting Rights and Permissions with the Cisco Unity Permissions Wizard" section.

Permissions Set When Cisco Unity Subscribers Are Homed in Exchange 2003 and/or Exchange 2000 (With or Without Exchange 5.5)

Permissions Set for the Installation Account

When you run the Permissions wizard, the following permissions are set for the installation account.

User Rights

The installation account is granted the following user rights:

•Log on as a service.

•Act as part of the operating system.

•Log on as a batch job.

Group Membership

The installation account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller.

•The Local Administrators group, when the Cisco Unity server is not a domain controller.

Active Directory Permissions

If Cisco Unity subscribers will be homed in Exchange 2003 and/or Exchange 2000 (regardless of whether any Cisco Unity subscribers will be homed in Exchange 5.5), the Cisco Unity Permissions wizard sets the permissions listed in Table D-1 for the installation account.

Table D-1 Active Directory Permissions Set by the Permissions Wizard for the Installation Account 

Container	Permission
Where new users are created	Applied onto this object only •Create User objects Applied onto User objects •Read properties •Write properties •List contents •Change password •Reset Password
Where new groups are created	Applied onto this object only •Create Group objects Applied onto Group objects •Read properties •Write properties •List contents
Where Cisco Unity location objects are created	Applied onto this object and all child objects •Create CiscoEcsbuUMLocation objects Applied onto CiscoEcsbuUMLocation objects •Full control

Permissions Set For the Directory Services Account

When you run the Permissions wizard, the following permissions are set for the directory services account.

User Rights

The directory services account is granted the following user rights:

•Log on as a service.

•Act as part of the operating system.

•Log on as a batch job.

Group Membership

The directory services account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller.

•The Local Administrators group, when the Cisco Unity server is not a domain controller.

Active Directory Permissions

If any Exchange 2003 and/or Exchange 2000 users will be Cisco Unity subscribers (regardless of whether any Exchange 5.5 users will also be Cisco Unity subscribers), the Cisco Unity Permissions wizard sets the permissions listed in Table D-2 for the service account.

Table D-2 Active Directory Permissions Set by the Permissions Wizard for the Directory Services Account 

Container	Permission
Where new users are created	Applied onto this object only. Set only if creating users via Cisco Unity Administrator is allowed. •Create User objects •Delete User objects Applied onto this object only. Set only if creating contacts via Cisco Unity Administrator is allowed. •Create Contact objects •Delete Contact objects Applied onto User objects •Read properties •Write properties •List contents •Change password •Reset Password Applied onto Contact objects •Read properties •Write properties •List contents
Where new groups are created	Applied onto this object only. Set only if creating groups via Cisco Unity Administrator is allowed. •Create Group objects •Delete Group objects Applied onto Group objects •Read properties •Write properties •List contents
Where Cisco Unity location objects are created	Applied onto this object and all child objects •Create CiscoEcsbuUMLocation objects Applied onto CiscoEcsbuUMLocation objects •Full control
Where imported objects are imported from	Applied onto User objects •Read properties •Write properties •List contents Applied onto Group objects •Read properties •Write properties •List contents Applied onto Contact objects •Read properties •Write properties •List contents
Deleted Objects	Applied onto child objects in every domain that contains Cisco Unity subscribers or groups •Read properties •List contents
System\AdminSDHolder object	Applied onto "This object only" in every domain that contains Cisco Unity subscribers •Read properties •Write properties •List contents

Permissions Set For the Message Store Services Account

When you run the Permissions wizard, the following permissions are set for the message store services account.

User Rights

The message store services account is granted the following user rights:

•Log on as a service.

•Act as part of the operating system.

•Log on as a batch job.

Group Membership

The message store services account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller.

•The Local Administrators group, when the Cisco Unity server is not a domain controller.

Active Directory Permissions

Table D-3 Active Directory Permissions Set by the Permissions Wizard for the Message Store Services Account 

Container	Permission
Where new users are created	Applied onto User objects •Send-As
Where imported objects are imported from	Applied onto User objects •Send-As

Exchange Permissions

The message store services account is granted the following permissions on the Exchange 2003 or Exchange 2000 mailstore that are selected in Permissions wizard:

•Send-As

•Receive-As

•Administer Information Store

Permissions Set When Cisco Unity Subscribers Are Homed Only in Exchange 5.5

Permissions Set for the Installation Account

When you run the Permissions wizard, the following permissions are set for the installation account.

User Rights

The installation account is granted the following user rights:

•Log on as a service.

•Act as part of the operating system.

•Log on as a batch job.

When the Cisco Unity server is a Windows 2000 Server domain controller, or is a member of a Windows 2000 Server or Windows Server 2003 domain, the installation account is granted the following permissions:

Table D-4 Active Directory Permissions Set by the Permissions Wizard for the Installation Account 

Container	Permission
Users	Applied onto this object only. Set only if creating users via Cisco Unity Administrator is allowed. •Create User objects Applied onto User objects •Read properties •Write properties •List contents •Change Password (Set only if creating users via Cisco Unity Administrator is allowed) •Reset Password (Set only if creating users via Cisco Unity Administrator is allowed)

Group Membership

The installation account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller in a Windows 2000 Server domain.

•The Local Administrators group, when the Cisco Unity server is a member server in a Windows 2000 Server or Windows Server 2003 domain.

•The Domain Admins group, when the Cisco Unity server is not a Windows 2000 Server domain controller, and is not a member of either a Windows 2000 Server or Windows Server 2003 domain.

Permissions Set for the Directory and Message Store Services Account

When you run the Permissions wizard, the following permissions are set for the directory and message store services account.

User Rights

The directory and message store services account is granted the following user rights:

•Log on as a service.

•Act as part of the operating system.

•Log on as a batch job.

When the Cisco Unity server is a Windows 2000 Server domain controller, or is a member of a Windows 2000 Server or Windows Server 2003 domain, the directory and message store services account is granted the following rights:

Table D-5 Active Directory Permissions Set by the Permissions Wizard for the Directory and Message Store Services Account 

Container	Permission
Users	Applied onto this object only •Create User objects •Delete User objects Applied onto User objects •Read properties •Write properties •List contents •Change Password •Reset Password

When the Cisco Unity server is not a Windows 2000 Server domain controller, and is not a member of either a Windows 2000 Server or Windows Server 2003 domain, the directory and message store services account is added to the Domain Admins group.

Group Membership

The directory and message store services account is added to one of the following groups:

•The Administrators group, when the Cisco Unity server is a domain controller.

•The Local Administrators group, when the Cisco Unity server is not a domain controller.