Software

Ask something
Discussion Locked

OWA admin account ~vulnerability

0 helpful
5 replies

by willijb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Simply by putting it through its paces we discovered that when logged on to
the OWA machine as Administrator, _all_ mailboxes are accessible.
Credentialing occurs twice [once upon hitting the OWA logon ASP, and once
after submitting the mailbox UserID], but never for the mailbox being
submitted.

Surely we won't have to disable the Admin account...?

Any guidance, or even a point in the right direction, is appreciated.

Specs: mail machine: NT4, SP4, Exchange 5.5 on one leg [separate NT
domain] of our enclave implementation

OWA machine: NT4, SP4, IIS4 on another leg [separate NT domain] of our
enclave

5 replies

by xaeryth

Two questions to your one. What service pack are you running on Exchange (3?) and is your Administrator account set up as an alternate recipient to everyone's mail box? If the first is not SP3 than I would suggest upgrading to it as it update key components of Exchange (including OWA) and if the second is true than removing it will stop your issue. Something else to look at is there is a setting in Proxy that allows Administrators full access to everything in your exchange folder in Inetpub. Ifthis is enabled, disabling it will also offer the restriction you are looking for. Hope this gives you some ideas. -Corey Hitchcock -IT Manager -Interdev Technologies Inc.

by james_randy

If you are still tackling this problem, perhaps you should consider calling your local super-hero.

This discussion is closed to new replies.