In Microsoft Exchange 2000 Server or Microsoft Exchange 
Server 2003, when you create new mailbox-enabled accounts 
in Active Directory, they do not have inherited mailbox 
rights. The only object that is granted permission is Self, 
which is granted full mailbox access and read rights. 

To view mailbox rights, follow these steps:

In Active Directory Users and Computers, click Advanced 
Features on the View menu. 
Note: This is not necessary on Exchange Server 2003 because 
of the fact that the Exchange Advanced tab is exposed by 
default.

Under Active Directory Users and Computers, click the 
account, click the Exchange Advanced tab, and then click 
Mailbox Rights. 
The rights are displayed in the Permissions for account 
name dialog box. 
 
= Bad!

This behavior occurs because the mailbox security 
descriptor is not read from the Active Directory account 
object until the user logs on or gets mail. The Recipient 
Update Service (RUS) does not stamp the inherited 
permissions when the mailbox is created. After the mailbox 
is created in the store, the store calculates inherited 
mailbox rights. 

To resolve this behavior perform one of the following 
actions:

Log on to the mailbox you've created. You can do so by 
opening an Outlook profile for the new user and running 
Outlook, or by opening a OWA session the the destination 
mailbox by typing http://servername/exchange/username in 
the address bar of your browser. 
Note: Opening Outlook requires you to be logged on as the 
destination user, while OWA does not require you to be 
logged on as the user. However, both methods require that 
you know the destination user's password.

Send a message to the mailbox. 
Note: The second method is quicker and easier to perform, 
that's why you'll need to know how to Send Mail from Script 
and to Test SMTP Service in IIS and Exchange.

When the mailbox is created in the store, the store itself 
calculates the inherited permissions and stamps them on the 
store's copy of the mailbox security descriptor. 

 = Good