I configured a fax server in server 2k8 (32bit) following the guide found here: http://technet.microsoft.com/en-us/library/ff630162.aspx
so far everything appears to be working as designed, however there appears to be a bit of a permissions problem...
In active directory, I created two new security groups, "Fax users" and "Fax routing assistants", on the server I added Fax users to the local group "Fax Users" and the AD group "Fax routing assistants" to the local group "Fax Routing Assistants"
in the Fax properties\Security the local group "Fax Users" is added with permissions set to allow "Fax" and Deny "Manage Fax Configuration" and "Manage Fax Documents". The local group "Fax Routing Assistants" is also added, allowing "Fax" and "Manage Fax Documents" (no deny set). I now have several users I have added to the "Fax Users" group in AD, but I noticed that all users, are presently able to map the server\fax printer... I can deal with that, it's not important to me if they can print to fax or not. however, they also have the ability to see the fax Inbox... that is a problem.
essentially I am setting up a fax system with two pools, one secure, one public. NO ONE should be able to see the secure faxing docs except a select few users, this is handled by routing. Faxes received by one modem are saved to a folder with permissions set to only allow certain users read access. the faxes sent to another modem go to a public folder. this routing method negated the users from _ever_ needing to see the fax console much less the inbox. heck I don't even need routing assistants at this point.
where do I need to set permissions to successfully deny ALL users (with the obvious exception of the server administrator account) from seeing the Fax Inbox?