On Exchange 2007, is it possible to grant the ms-Exch-EPI-May-Impersonate extended right to an active directory security group such that our service account can Exchange impersonate any of the user accounts that belong to the the security group? The following link has documentation on how to "configure Exchange Impersonation for a user on an account", but I'd prefer to be able to add or remove users from an Active Directory security group using "Active Directory Users and Computers" rather than having to manually add/remove users via the Add-ADPermission and Remove-ADPermission Exchange Management Shell commands. http://msdn.microsoft.com/en-us/library/bb204095(EXCHG.80).aspx Thanks, Greg

What is the end goal you are trying to achieve? You want Exchange to be able to do what as the user that needs the impersonation right?