Deny Access Templates for object class creation

Active Roles already splits the object creation permissions for these mailboxe types out into constructed attributes.

If you don't want someone to create a Room Mailbox, for example, don't grant them access to the "edsva-MsExch-CreateRoomMailbox" attribute.

Active Roles already splits the object creation permissions for these mailboxe types out into constructed attributes.

If you don't want someone to create a Room Mailbox, for example, don't grant them access to the "edsva-MsExch-CreateRoomMailbox" attribute.

heya! thanks for the replies! i will try it and get back, apologize for the reply delay as i never got notification of replies! Terrance, just to push my luck, is the converse also possible someway like above? As in just show group mailboxes but not user? or do i need to try to figure it out the way JohnnyQuest mentioned. thanks again and will update!

Active Roles has constructed attributes which you can delegate access to for object creation, but there is nothing like that for viewing objects out of the box. If you want to do that, you could create a Managed Unit which queried the mailbox types that you desired and set a view Access Template permission onto it.

thanks for the quick reply! maybe i was unclear and i apologize. was just wondering if there was a way to just show group mailboxes on the new object creation but not user on the specific ou we designated as above. your previous solution should allow me to just show user as opposed to showing all 4 or 5 (i forget). again if you did answer me and i misunderstood i apologize =)