Software

Ask something
Question Locked

Users able to view other Inboxes without delegate permissions

0 helpful
3 replies

by rarosko

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I just started this job about 2 weeks ago and I'm coming across some strange things. Here's the one that is troubling me the most at the moment.

Small office setting, running Exchange 6.5 and Outlook 2003 and everyone was setup to be delegates for calendar/contact sharing, but a few people could view other user's inboxes. So I removed delegates from permission lists and that seemed to clear things up for everyone except one individual has no one entered in the delegates permission list but everyone can view her inbox.

Really strange stuff...Are there any policies I can change to affect these permissions rather than going to every desktop to verify. And how can I cease all users from having viewing rights to a non-shared inbox?

Thanks in advance

3 replies

by Member 30634329

Check your permissions at the Exchange level. Start by right-clicking your Exchange org and choose Delegate Control. The wizard will show you what accounts have Exchange admin rights.
But this delegation of control shouldn't allow the viewing of other mailboxes. Next, investigate permissions from the Mailbox Store level and work your way up.
By default, full mailbox Access, Administer Mailbox, Receive As, and Send As rights are denied unless someone has unchecked "Inherit rights from parent" and applied them manually.
This may have been done at the Mailbox Store, at the Server, or at the Administrative Group level.

by rarosko

Thanks for the run down Bill,
Just an update...
I've taken a look at the permissions from every level and the "Inherits rights" box is not checked at the very top level of Exchange. I'm hesitant to make that change and push these permissions down, especially during business hours because it seems they've been managing Exchange by making many manual changes(exceptions) to permissions instead of inherited rights.

Looking at individual permissions it appears that a number of groups, such as, Domain Admins, Exchange Services and SERVER01$ have "Allow All" without Deny to Full Mailbox access. I do plan to take away all Full mailbox access from groups and just give to one Admin acct.

Also, half the users accts are included in the permissions in the "SELF" group, but the other half appear as their user acct "user@domain". Is that only a logging issue?

I don't actually understand why they have been managing Exchange this way. I'm tempted to just start from scratch...

This discussion is closed to new replies.