We are running a test install of Exchange 2010 with two CAS servers and two mailbox servers. One mailbox server has employee account and the other one has student accounts. I have created two ABPs - one for employee and one for students. When I log into a test account via OWA and access the address book, I can see only the accounts for each policy in the GAL and room address books. However when I click on show other address list, I see the contacts and users address lists. I can see the accounts for both students and employees. However if I am logged in as a student and click on an employee account, I get the following message when I click on one of the addresses.
"Access is denied.
The active directory resource couldn't be accessed. This may be because the active directory object doesn't exist or the object has become corrupted or because you don't have the correct permissions."
The same thing happens if I am logged in as an employee and click on a student account. Is this how the ABP policies is supposed to work for the contacts and users address books\lists?