Hello!

I have the problem I could not explain and I affraid it is default HMC behaviour or I missed something during deployment.

Scenario:

1. User1 from the hosted organzation Company1 sends email message to the User2 from the hosted organization Company2 (both companies are from the same reseller).
2. User2 opens the message in Outlook client and double-clicks on sender. Outlook window opened he could see all contact info of User1 and either distribution lists User1 is included and so on.

When I've start checking the permissions on Hosting / Reseller / Customers OUs, I wondering that MPS documentation and MPS actual security do not match:

1. In "Delegated Administration" chapter of HMC 3.5 documentation there is contradiction in chapter "ACEs for the AllCustomers@reseller Group". The text tells us about "deny List Object permissions ... for the reseller OU", but table below tells us to "Allow".
2. Moreover, the table tells in "Apply to" column "This object only", but actual permissions on (newly created via MPS request) reseller are "This object and all child objects".

It looks like either "Allow + This object only" is better settings than MPS-performed "Allow + This object and all child objects".

Could someone check such scenario and its result? Or may be anybody had such issue before?

P.S. I use HMC3.5 FP1; Lising Object mode is On; all Deployment Tools steps are performed successfully.

P.P.S. (may be it is important) User1 is member of DistList1, User2 is member of DistList2.

vav,

Seems like these users and distribution lists were created outside HMC, i.e. without using createUser and createGroup procedures from Managed Active Directory namespace. These procedures perform RemoveAllAuthenticatedUsersACEs_ to remove permissions granted by default for "Authenticated Users" to newly created user and group.

Hello,

I can confirm "actual permissions on (newly created via MPS request) reseller are "This object and all child objects"." I will do more research today on this issue to see how serious it is.

Meanwhile, you should contact Microsoft PSS about this issue to get official Microsoft opinion and probably solution or workaround.

Greetings,

I did additional research on this issue and I would like to share what I found.

Two user from two different business organizations under same reseller can't read AD atributes of each other. Security group AllCustomers@reseller has effective permissions "List Contents" and "List Object" on any user object under any business organization. This permissions doesn't allow to read any properties (phone numbers, business info, etc) to users from different organizations. So, "List Object permissions" doesn't create described issue with security.