Managing Resource Mailboxes in Exchange Server 2007 (Part 3)
July 8, 2011 Leave a comment
In the previous article we saw how to manage the resource mailboxes settings and one those settings was Scheduling Permissions. In this article we are going to play with this feature in order to lock down and restrict a resource mailbox to fit the organization security requirements.
The best way to understand the resource mailbox permission is through testing. This article will not be any different, so we are going to validate the booking permission feature using these scenarios:
- Demonstrate the default settings that we set up in the last article,
- Configure a resource delegate for a resource mailbox,
- Configure the resource mailbox to manually approve the meeting requests,
- Configure the resource mailbox to deal with important users (Presidents, CEO, Managers and etc…),
- Monitor the resource mailboxes through Performance Monitor.
Request meeting with default configuration
Here are the basics steps required to create and configure a resource mailbox:
- Create a resource mailbox.
- Assign a mailbox user to have full mailbox permissions on the resource mailbox.
- Log in to the Resource Mailbox through OWA and check the option Automatically process meeting requests and cancellations under Resource Setting through OWA.
Okay, we have gone through these steps in the previous article, now let’s schedule a meeting. The user Anderson Patricio will send a meeting request and he will use the resource mailbox called Meeting Room – Toronto, as shown in Figure 01.
The user Anderson Patricio will automatically receive an Accepted message from the Resource mailbox as shown in Figure 02. We can also see the response message text defined in the Resource Mailbox in the body of the received message.
This was easy because the resource mailbox was available and we are not placing any restrictions; now let’s try to schedule a meeting at the same time as an existing appointment, as shown in Figure 03.
The result will be a declined meeting request in the requested user mailbox, as shown in Figure 04. In the received message we can see the reason for the refusal.
Configuring a Delegated account
In order to manually approve a meeting request a delegated account must be associated with the resource mailbox. We can create this in two different ways: using the Exchange Management Shell or Microsoft Outlook.
Using Outlook we need to configure a profile for the Resource Mailbox and open it. Then, we have to click on Tools / Options and click on the Delegates tab, as shown in Figure 05.
The second and easier way to do this is using the Exchange Management Shell. In an Exchange Management Shell session we can use the Set-MailboxCalendarSettings cmdlet to add a Resource Delegate using the following syntax:
Set-MailboxCalendarSettings <Resource Mailbox Name> -ResourceDelegates: <Mailbox>
Meeting request with manual approval
Now, that we have delegated the user we can configure our resource mailbox to use manual approval. Let us start by setting the Resource Mailbox to use Everyone in the item “These users can submit a request for manual approval if the resource is available” which corresponds to Request In Policy. We will also select the option Users and Groups in the item “These users can schedule automatically if the resource is available” which corresponds to Book In Policy. The result will be that all the new request messages must be approved manually instead of automatically. Figure 06.
To test the manual approval the user Anderson Patricio will send a Meeting Request to the Resource Mailbox, the result will be a Tentative message informing him that the request is pending approval (Figure 07).
The mailbox that was defined as Resource Delegate in the resource mailbox will receive the request for approval (Figure 08). At the top of the received message there are some possible actions that can be chosen, such as Accept, Tentative, Decline and Propose New Time. We are able to work on the approval process only using Microsoft Outlook; this process cannot be done using OWA.
To accept the request, click on Accept and a message box will appear; select Send the response now and click on OK. The result can be seen on the requested user mailbox which will receive a message informing them that the request was approved, as shown in Figure 09.
Using manual approval (Request in Policy) we are able to create restrictive meeting rooms and resources. We can set up all users to be approved manually and another user or group to be approved automatically. This might be useful when you have an important meeting room/equipment where a set of users must be authorized and another set of users do not need this manual approval.
For example, in Figure 10 all users that belong to the group zz_Group1 will automatically schedule the resource mailbox however all other users will wait for approval.
Configuring the Resource mailbox to not decline requests from special users
In some circumstances a user should not receive a Decline answer from his request, especially when this user is the CEO, your manager, etc. To avoid this situation with these special users, we can configure the third option under Resource Scheduling permissions (Request out of Policy) to define which users will not be declined automatically even though they are out of policy.
In the Options page, on the Resource Settings we need to define which users can request a meeting and it will be accepted automatically if available, if it is not available a manual approval is required, but the users specified in that option will never receive a decline automatically. In Figure 11 we are using the ceo’s mailbox.
In Figure 12, the CEO is trying to schedule a meeting during the same period of a previous appointment.
The CEO belongs to the Request out of the Policy group of the Resource mailbox because they will receive a message informing them that the request was received and is pending approval (Figure 13). This approval must be made manually by the account configured as Resource Delegate in the resource mailbox.
Monitoring resource mailboxes
We can monitor resource mailbox activity through the Exchange Performance Monitor, the counters are self-explanatory and these are the current counters available:
- Average Calendar Attendant Processing Time
- Last Calendar Attendant Processing Time
- Lost Races
- Meeting Cancellations
- Meeting Messages Deleted
- Meeting Messages Processed
- Meeting Requests
- Meeting Responses
- Requests Failed
To monitor these counters, open the Exchange Management Console, click on Toolbox, and then double click on Performance Monitor. Click on the add button, on Performance Object select MSExchange Calendar Attendant and pick the necessary counters up. A sample of these monitors in action can be seen in Figure 14. We can also use MOM to create reports of this information. To learn how to monitor and generate reports using Microsoft Operations Manager 2005 you can read the article series, Monitoring Exchange Server 2007 using MOM 2005.
In this article we used resource scheduling permissions in order to lock down and restrict a resource mailbox to fit in with the organization security requirements. We also learnt how get activity statistics of the resource mailboxes through the Exchange Server Performance Monitor.