Solved

Exchange Server Security

Posted on 2009-04-13
5
245 Views
Last Modified: 2012-05-06
Windows 2003 Server with Exchange 2003.
All mail boxes have been migrated from an old server same OS.
Exchange SP2
Some users mail boxes are available to everyone. They simply have to go to File-Open-Other users folder- Browse to username and it opens.
Not every mail box will open, but there is not a difference in the permissions on the users account or mail file on those that will open and those that won't.

We already edited the registry to show all security on the Exchange System manager, and the permissions are the same as a correctly operating Exchange Server that we compared.


0
Comment
Question by:DrPing
  • 3
  • 2
5 Comments
 
LVL 65

Expert Comment

by:Mestha
ID: 24134011
There are only two sets of permissions that grant that access - full mailbox and Send As/Receive As. You need to look at what groups and users have those permissions, possibly inherited, to see how the permission is being set. Then look at the membership of the group.

Do not make the mistake of thinking that "Full Control" is the permission you need to change, it is not. That is full control over the object (ie the user account in AD) not the content (the mailbox in Exchange).

Simon.
0
 

Author Comment

by:DrPing
ID: 24135898
Just so I understand correctly...
There are two sets of permissions. One is applied to the mailbox in System Manager, and has inherited permission all the way down from the Exchange group. (Store-Server-Administrative Group- Exchange Group) All of the permissions set here will be global for everyone in the store.

The other is set in Active Directory under the individual user account, and this controls permission on an individual level? (who else can access a mailbox, send on behalf etc)

If I understand correctly, them my problem has to be in the Active Directory Permissions.... because only 2 users are affected. (anyone can open their Inbox)

However the permissions listed for the problem users, exactly match the permissions on the other users mail boxes. Have compared the users listed. (administrator- domain administrator-Exchange administrator- Self etc)... and have even compared the effective permissions to be the same.

0
 

Author Comment

by:DrPing
ID: 24135911
Additionally, I have created a new user by copying the problem users account. The new user is a member of the same groups etc.

However the newly created users mailbox works correctly.
0
 

Author Comment

by:DrPing
ID: 24136089
Another bit of info I just found out....

Even if I set the Active Directory permissions on the problem mailbox to Deny-Everyone....

The permissions are ignored and anyone can open the users folders.

All DC's show to replicate OK..

Thinking about just deleting and recreating the users account.
0
 
LVL 65

Accepted Solution

by:
Mestha earned 500 total points
ID: 24137283
What permissions are you changing? It isn't clear.
The only two permissions on accounts that give access to the mailbox are the ones that I have outlined above. You need to see what groups and accounts have those permissions.

Furthermore, due to the way that Exchange caches permissions, a change in permissions can take two hours to take effect. Do not expect a permission to be live immediately.

Simon.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question