• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 274
  • Last Modified:

Exchange Server Security

Windows 2003 Server with Exchange 2003.
All mail boxes have been migrated from an old server same OS.
Exchange SP2
Some users mail boxes are available to everyone. They simply have to go to File-Open-Other users folder- Browse to username and it opens.
Not every mail box will open, but there is not a difference in the permissions on the users account or mail file on those that will open and those that won't.

We already edited the registry to show all security on the Exchange System manager, and the permissions are the same as a correctly operating Exchange Server that we compared.


0
DrPing
Asked:
DrPing
  • 3
  • 2
1 Solution
 
MesthaCommented:
There are only two sets of permissions that grant that access - full mailbox and Send As/Receive As. You need to look at what groups and users have those permissions, possibly inherited, to see how the permission is being set. Then look at the membership of the group.

Do not make the mistake of thinking that "Full Control" is the permission you need to change, it is not. That is full control over the object (ie the user account in AD) not the content (the mailbox in Exchange).

Simon.
0
 
DrPingAuthor Commented:
Just so I understand correctly...
There are two sets of permissions. One is applied to the mailbox in System Manager, and has inherited permission all the way down from the Exchange group. (Store-Server-Administrative Group- Exchange Group) All of the permissions set here will be global for everyone in the store.

The other is set in Active Directory under the individual user account, and this controls permission on an individual level? (who else can access a mailbox, send on behalf etc)

If I understand correctly, them my problem has to be in the Active Directory Permissions.... because only 2 users are affected. (anyone can open their Inbox)

However the permissions listed for the problem users, exactly match the permissions on the other users mail boxes. Have compared the users listed. (administrator- domain administrator-Exchange administrator- Self etc)... and have even compared the effective permissions to be the same.

0
 
DrPingAuthor Commented:
Additionally, I have created a new user by copying the problem users account. The new user is a member of the same groups etc.

However the newly created users mailbox works correctly.
0
 
DrPingAuthor Commented:
Another bit of info I just found out....

Even if I set the Active Directory permissions on the problem mailbox to Deny-Everyone....

The permissions are ignored and anyone can open the users folders.

All DC's show to replicate OK..

Thinking about just deleting and recreating the users account.
0
 
MesthaCommented:
What permissions are you changing? It isn't clear.
The only two permissions on accounts that give access to the mailbox are the ones that I have outlined above. You need to see what groups and accounts have those permissions.

Furthermore, due to the way that Exchange caches permissions, a change in permissions can take two hours to take effect. Do not expect a permission to be live immediately.

Simon.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now