Article ID: 272197 - View products that this article applies to.
This article was previously published under Q272197
This article has been archived. It is offered "as is" and will no longer be updated.
This article describes how to restrict Exchange 2000 Outlook Web Access (OWA) address view searches.
WARNING: If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Exchange 2000 Server, or both. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
If you access e-mail using Exchange 2000 OWA, you do not have the user rights for Active Directory that are applied to folder queries. This setting effectively enables you to see all users in the Active Directory directory service regardless of the Access Control Lists (ACLs) that have been assigned.
In an Exchange 2000 application service provider (ASP) environment, if you are an administrator, you can restrict users from viewing the address lists to their own organizational unit, but not the entire global address list. Use the msExchQueryBaseDN attribute on each user that uses Exchange 2000 OWA to control the scope of searches that OWA performs. This attribute is not exposed in Exchange Server Microsoft Management Console (MMC). To configure this attribute, use Adsiedit.exe, which is available on the Windows 2000 CD-ROM. To install Adsiedit.exe: