?
Solved

Exchange Server Security

Posted on 2009-04-13
5
Medium Priority
?
270 Views
Last Modified: 2012-05-06
Windows 2003 Server with Exchange 2003.
All mail boxes have been migrated from an old server same OS.
Exchange SP2
Some users mail boxes are available to everyone. They simply have to go to File-Open-Other users folder- Browse to username and it opens.
Not every mail box will open, but there is not a difference in the permissions on the users account or mail file on those that will open and those that won't.

We already edited the registry to show all security on the Exchange System manager, and the permissions are the same as a correctly operating Exchange Server that we compared.


0
Comment
Question by:DrPing
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 65

Expert Comment

by:Mestha
ID: 24134011
There are only two sets of permissions that grant that access - full mailbox and Send As/Receive As. You need to look at what groups and users have those permissions, possibly inherited, to see how the permission is being set. Then look at the membership of the group.

Do not make the mistake of thinking that "Full Control" is the permission you need to change, it is not. That is full control over the object (ie the user account in AD) not the content (the mailbox in Exchange).

Simon.
0
 

Author Comment

by:DrPing
ID: 24135898
Just so I understand correctly...
There are two sets of permissions. One is applied to the mailbox in System Manager, and has inherited permission all the way down from the Exchange group. (Store-Server-Administrative Group- Exchange Group) All of the permissions set here will be global for everyone in the store.

The other is set in Active Directory under the individual user account, and this controls permission on an individual level? (who else can access a mailbox, send on behalf etc)

If I understand correctly, them my problem has to be in the Active Directory Permissions.... because only 2 users are affected. (anyone can open their Inbox)

However the permissions listed for the problem users, exactly match the permissions on the other users mail boxes. Have compared the users listed. (administrator- domain administrator-Exchange administrator- Self etc)... and have even compared the effective permissions to be the same.

0
 

Author Comment

by:DrPing
ID: 24135911
Additionally, I have created a new user by copying the problem users account. The new user is a member of the same groups etc.

However the newly created users mailbox works correctly.
0
 

Author Comment

by:DrPing
ID: 24136089
Another bit of info I just found out....

Even if I set the Active Directory permissions on the problem mailbox to Deny-Everyone....

The permissions are ignored and anyone can open the users folders.

All DC's show to replicate OK..

Thinking about just deleting and recreating the users account.
0
 
LVL 65

Accepted Solution

by:
Mestha earned 1500 total points
ID: 24137283
What permissions are you changing? It isn't clear.
The only two permissions on accounts that give access to the mailbox are the ones that I have outlined above. You need to see what groups and accounts have those permissions.

Furthermore, due to the way that Exchange caches permissions, a change in permissions can take two hours to take effect. Do not expect a permission to be live immediately.

Simon.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to install and use the NTBackup utility that comes with Windows Server.
A couple of months ago we ran into an issue that necessitated re-creating our Edge Subscriptions. However, when we attempted to execute the command: New-EdgeSubscription -filename C:\NewEdgeSub_01.xml we received an error indicating that the LDAP se…
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question