Local administrator rights along with Account Operator membership and delegation of Exchange Administrator rights at the Administrative Group level for the management account works under normal circumstances, but if changes are made to the access rights, then this may no longer suffice to manage mailboxes. Please visit the ERM Support Forum for a more detailed discussion if you are still experiencing problems managing mailboxes.

Exchange Resource Manager requires that the ERM Service Account have Local Administrator rights on the server running ERM. Without these rights, ERM will not respond to meeting requests and the ERM Mailbox Browser will generate errors when attempting to manage mailboxes.

Account	Access Rights
ERM Management Account (account used to logon to Windows when managing/configuring resources)	Account Operator Local Administrator (Builtin Administrator on DC) Delegation of Exchange Administrator rights (full or normal)
ERM Service Account	Local Administrator (Builtin Administrator on DC) Domain Users
Resources	“Send As” rights granted to ERM Service Account (done automatically as part of ERM-manage process)

When a resource is ERM-managed, if permissions are not already set for read access to all domain users, then users will be unable to gain additional information from the resource for potential resource availability (only free/busy information is available). To resolve this, manually set ERM-managed resources to the read permissions appropriate for the organization an Outlook client.

Users do not require any rights to the resource mailbox. The ERM Service Account is the security context in which the events are processed. The Service Account is granted owner rights to the resource mailboxes as part of the "Manage" process.

ERM does not require or affect any specific resource mailbox permissions. Those should be set according to your business requirements. The Manage process adds full access rights to the mailbox for the ERM Service Account. These rights should not be removed.