Hi,
We've set up Exchange 2000 and OWA is running nicely. The problem is that users can access anyones e-mail by simply changing the mail box name in the address bar.
How do I restrict access so that users can access only there own mailbox?
Cheers
CJ Windsor
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Outlook Web Access (OWA)
Have you read the Planning and Deploying Outlook Web Access 5.5 from Microsoft? try http://www.microsoft.com/e
http://support.microsoft.c
http://support.microsoft.c
http://www.swynk.com/frien
http://www.slipstick.com/e
of course you should consider installing Linux, sendmail, and neomail instead....
Ta for the advice.
However,
I've set the Exchange directory security to basic level authentication. This prompts for a log on, but once a user is logged on he/she can still access anyones mail box by just changing the URL.
For example...
-log on to "servername/Exchange", Enter name & password
-This gets them into there own inbox
-They can however just change the URL to "servername/Exchange/userx
How can I restrict this sort of access?
Ta for the advice.
However,
I've set the Exchange directory security to basic level authentication. This prompts for a log on, but once a user is logged on he/she can still access anyones mail box by just changing the URL.
For example...
-log on to "servername/Exchange", Enter name & password
-This gets them into there own inbox
-They can however just change the URL to "servername/Exchange/userx
How can I restrict this sort of access?
hehe....tell you users not to change the url to someone elses name....hehe. Being the open source fan of Sendmail and linux in general, it is kind of humerous to hear how to defeat a OWL server.....but i'm sure it was your higherups that decided on exchange server....
Are you running OWA on a seperate machine from the exchange server? Maybe you need to check both machines for permissions.
If you added a new user on just one machine does that automaticly give you access to the other? Don't add that user to any groups to start your test and find the minimum permissions to get just the mail.
Did you modify the OWA program? Did you mess up the global.asa in the process.
Did you pay for support from Microsoft when you went with Exchange?
Secure it up while you are at it
a) Upgrade each and every MS component
b) run https (not http) to url
c) install root CA certificate to browser
noting -
> -They can however just change the URL to "servername/Exchange/userx
If I am logged in to it, using my ID in place of userx yields the 404: "The page cannot be found"
user browse mode should be disabled
Business Accounts
Answer for Membership
by: samriPosted on 2002-03-24 at 04:46:19ID: 6892077
Im' not quite familiar with OWA. Perhaps there should be some kind of security option where each users must be authenticated before the can open a mailbox. Check the OWA (I hope OWA is some kind of web based email system), documentation on how to enable such authentication.
just a thought.