asked on

I cannot stop unwanted inbox sharing

I have a customer with a SBS2003 system hosting their own mail on Exchange. Recently we have found that we cannot turn off the sharing of their inbox. The default permissions in Outlook 2003 is set to none and I believe everything is setup properly under the Exchange Advanced tab. I have deny read permissions set for all users but only a handful of users are non-accessable. All users are members of the same groups and nothing special. If I deny full mailbox access to the everyone group, no one is able to log into the domain and I'm just not knowledgeable of all of the "rights". Can someone please get me out of this? I am afraid I am going to lose this customer.

sysreq2000

I believe you should have a user called "Self". Give "full mailbox access" only to Self and Admins if desired.

The --should-- be all you need to do as far as I know.

sysreq2000

Sorry, that --should-- be all you need to do as far as I know.

debuggerau

Goto Active Directory Users and Computers -> Select the user in question and open their properties. Select the Exchange Advanced tab and ensure the group SELF has read permissions AND Full Mailbox Access. This should get their own access working, but prevent others (unless they have administrator equivilance)
Hope that helps.

thedrizel

ASKER

Thank you all but unfortunately that is not yet the answer. I have 15 users on this network and all users access to self have full mailbox access but the problem still exists. Only myself and the owner of the company have Administrator rights and I know he doesn't know anything about this. I am their IT guy and I seem to be failing on this one pretty badly.

thedrizel

ASKER

I've even added each user indivdually full mailbox rights hoping that would help with this issue.

dekkar

could it be a policy setting??

try moving 2 users out of the OU into a complete different (new) one... and see if the policy's are affecting the outlook security...

When you create a new user, is this still the case?

thedrizel

ASKER

Yes, it still seems to be the case as far as I can remember. I will be on site tomorrow morning to verify. I've never seen anything like this and cannot find an answer with over a week of researching. I'm sure it is something simple but very frustrating. This is a law firm and security is very important.

This is a small network and only an SBS2003 server with no special policies.

dekkar

How are they able to view each others email? Open --> other users folder??

debuggerau

There are a lot of security settings there by default, how about listing all of them here in a table so we can see the effects. It may not be individual permissions that are the cause, it may be a combined effect of many rights...
For instance, if everyone has full access, no security exists...
Self permissions is the default, you should be included.

thedrizel

ASKER

I wouldn't know how to list the security settings. That would be helpful if I did know. I have the "everyone" group set to deny read permissions.

debuggerau

http://briandesmond.com/blog/archive/2006/09/04/Script-to-Dump-Exchange-Mailbox-Info-to-Spreadsheet-_2800_CSV_2900_.aspx

debuggerau

Actually found a much better solution
ADModifycmd
ttp://msexchangeteam.com/archive/2004/08/04/208045.aspx

thedrizel

ASKER

Man, I feel like such a dummy. I can't even get the ADmodify to install. It tells me I need a different version of .NET Framework and to contact the publisher. Arrggggg

thedrizel

ASKER

Here is a DUMP. Can anyone help?

MailboxRights>
- <user UserDN="LDAP://CN=Brian ,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=WalshBailey,DC=local">
- <Inherited>
<Entry Trustee="WALSHBAILEY\Domain Users" Mask="ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
<Entry Trustee="WALSHBAILEY\Domain Users" Mask="ACE_MB_FULL_ACCESS|Allowed" />
<Entry Trustee="NT AUTHORITY\ANONYMOUS LOGON" Mask="ACE_MB_FULL_ACCESS|Denied ACE_MB_DELETE_MB_STORAGE|Denied ACE_MB_READ_PERMISSIONS|Denied ACE_MB_CHANGE_PERMISSION|Denied ACE_MB_TAKE_OWNERSHIP|Denied" />
<Entry Trustee="WALSHBAILEY\WALSHSERVER$" Mask="ACE_MB_FULL_ACCESS|Allowed ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
<Entry Trustee="WALSHBAILEY\Exchange Domain Servers" Mask="ACE_MB_FULL_ACCESS|Denied" />
<Entry Trustee="WALSHBAILEY\Domain Admins" Mask="ACE_MB_FULL_ACCESS|Denied" />
<Entry Trustee="WALSHBAILEY\Enterprise Admins" Mask="ACE_MB_FULL_ACCESS|Denied" />
<Entry Trustee="WALSHBAILEY\Administrator" Mask="ACE_MB_FULL_ACCESS|Denied" />
<Entry Trustee="WALSHBAILEY\Exchange Domain Servers" Mask="ACE_MB_FULL_ACCESS|Allowed" />
<Entry Trustee="Everyone" Mask="ACE_MB_READ_PERMISSIONS|Allowed" />
<Entry Trustee="NT AUTHORITY\ANONYMOUS LOGON" Mask="ACE_MB_READ_PERMISSIONS|Allowed" />
<Entry Trustee="WALSHBAILEY\Exchange Domain Servers" Mask="ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
<Entry Trustee="WALSHBAILEY\Administrator" Mask="ACE_MB_FULL_ACCESS|Allowed ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
<Entry Trustee="WALSHBAILEY\SBS Mail Operators" Mask="ACE_MB_READ_PERMISSIONS|Allowed" />
<Entry Trustee="WALSHBAILEY\Enterprise Admins" Mask="ACE_MB_FULL_ACCESS|Allowed ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
<Entry Trustee="WALSHBAILEY\Domain Admins" Mask="ACE_MB_FULL_ACCESS|Allowed ACE_MB_DELETE_MB_STORAGE|Allowed ACE_MB_READ_PERMISSIONS|Allowed ACE_MB_CHANGE_PERMISSION|Allowed ACE_MB_TAKE_OWNERSHIP|Allowed" />
</Inherited>
- <NotInherited>
<Entry Trustee="Everyone" Mask="ACE_MB_READ_PERMISSIONS|Denied" />
<Entry Trustee="NT AUTHORITY\SELF" Mask="ACE_MB_FULL_ACCESS|Allowed ACE_MB_READ_PERMISSIONS|Allowed" />
</NotInherited>
</user>
</MailboxRights>

ASKER CERTIFIED SOLUTION

thedrizel

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial