Setting Folder Permissions in Outlook - what really happens?

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Wed, 21 Jun 2006 22:40:09 GMT

Robbie--

Looking at the policy template files in the Office 2003 Resource Kit (http://office.microsoft.com/en-us/assistance/HA011513601033.aspx), I do not see anything that allows for permissions or delegates to be specified.

I also looked into the capabilities of the Outlook Security Features (http://office.microsoft.com/en-us/assistance/HA011402911033.aspx) that ships with the Office 2003 Resource Kit and I didn't see anything there as well.

If all you wanted to do was modify folder permissions and not do anything with delegates, then you might be able to use the PFDAVAdmin tool (http://www.microsoft.com/downloads/details.aspx?FamilyId=635BE792-D8AD-49E3-ADA4-E2422C0AB424&displaylang=en) to set the appropriate permissions across multiple mailboxes. Of course this is not automatically done like GPO is, but it might work for what is needed.

I did try looking through some of the Outlook Newsgroups about this, but did not find anything more. I don't know of any Outlook specific Blogs, so I did not check there.

--Chris

re: Setting Folder Permissions in Outlook - what really happens?

Robbie — Wed, 21 Jun 2006 18:58:29 GMT

Chris--

In your answer to Nick you didn't respond to his 3rd point about providing predefined delegation and permission at the AD level. I would love to find some way to set some basic permisions on Outlook folders through GPO's or AD.

Thanks

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Tue, 13 Jun 2006 20:33:44 GMT

Akessler--

I believe that the behavior you are seeing is caused by Outlook. When you assign a task to another user, the creator of the task losses the ability to modify the task and only the person the task was assigned to has the ability to modify the task. I am not sure if this segregation is done with permissions or logic within Outlook.

Here is a website I found about Assigning Tasks, but it does not have specific details.
http://www.microsoft.com/singapore/sme/english/themes/organise-your-work/tip-Outlook-to-Assign-Tasks.mspx).

--Chris

re: Setting Folder Permissions in Outlook - what really happens?

Akessler — Tue, 13 Jun 2006 01:08:27 GMT

I have an interesting problem. A user has shared thier tasks and given permissins to all her co-workers as publishing authors. Whenever a new task is created, as soon as it is assigned to a user all ability to modify the task is lost, even for the task originator and the assigned user? If the task is created but not assigned, it remians editable. Does anyone have any idea what is happening here? Thanks.

re: Setting Folder Permissions in Outlook - what really happens?

jhanjon — Thu, 01 Jun 2006 06:10:04 GMT

Thanks Buddah and Chris - The advice helps, though I've thought about the encryption option which requires a security cert o be installed per user. The private option may work, though one thing is not solved which is an assistant sitting in front of someone's computer. I know with Word, it's possible to put a password for a file, likewise for Zips or I believe PDFs so why not a particular email? Also, I noticed that Word files sent as attachments can be passworded, but not Word when used as an 'editor' for Outlook which makes it cumbersome to always attach a file.

re: Setting Folder Permissions in Outlook - what really happens?

Buddha — Wed, 24 May 2006 00:02:17 GMT

jhanjon

I forgot to mention that in the delegates there is a check box for delgate can see private items. Which IS NOT checked by default. So they shouldnt be able to see anyting marked as private. If permissions are set up with delegate rights.

re: Setting Folder Permissions in Outlook - what really happens?

Buddha — Tue, 23 May 2006 23:58:53 GMT

jhanjon,

You can always set a rule that takes any message marked with sensitivity of "Private" or "Personal" to a folder that the Delegate dosent have rights to.

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Tue, 16 May 2006 20:36:41 GMT

Nick--

In reference to your first point, I am always a proponent for starting from a clean slate as you never really know what you are working with you are trying to clean up someone else's mess. Using ESM, you can remove Delegates and those accounts with "Full Mailbox Access" and/or "Send As" permission. However, this will not clean up the folder permissions as this is done by Outlook when Delegates are removed.

If you are having some serious issues with Calendaring in Exchange, I would strongly suggest that you contact Microsoft PSS. They are going to be your greatest resource for trying to sort out your Calendaring issues.

If you would like to do some initial investigation into the "health" of your Exchange Organization, you should download and run Exchange Best Practices Analyzer (ExBPA): http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/analyzers/default.mspx

--Chris

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Tue, 16 May 2006 20:24:23 GMT

Jhanjon--

One way to submit a Private Message would be to have the sender of the Private Message use S/MIME and encrypt the message. Of course this works as long as the private key to decrypt the message is only available to the mailbox owner.

--Chris

re: Setting Folder Permissions in Outlook - what really happens?

Nick — Tue, 16 May 2006 12:28:41 GMT

Hi Chris,

We have about 150 Executives in our Organisation, many of which have authorised over 20 EAs delegation to their mailboxes, as well as numerous levels of permissions across all of their folders. It is an absolute mess and appears to be affecting Calendaring operation across the enterprise.

Most of the Calendaring problems are to do with updates to both single and reocurring meetings. Both with those sending and those receiving.

Frequency and the type of occurrance is not constant. Unfortunately, Calendaring for EAs is one of their primary functions and it is currently very, very painfull.

What we are thinking of doing is:
1. Clean up delegations and permissions for all Executives and EAs.
2. Establish best practice training and re-enforcement of that training over time.
3. Where possible and appropriate, impliment constraints in Exchange/Outlook which mitigates the damage that users can do regarding assigning incorrect delegation and permission levels.

The 1st point is something that some in our company would like to do at a server level for selected groups staggered over time, as we will need to be available to provide help and training to reconfigure delegation and access using best practice. However, others are concerned with the impact on users. Yet, the clean-slate approach sounds appealing. What do you think? How hard is it to remove delegations and access from Exchange?

The 3rd point is a big if. The basic thought is to provide a certain level of predefined delegation and access for EAs to their Executive mailboxes based on AD group membership. This is a pretty basic model of being able to use the infrastructure to simplify a process that is performed on the client and which generally becomes very messy over time. If anyone can provide more advanced/sophisticated means of managing delegation and access using the infrastructure, I would be gratefull.

We are using Exchange 2003 SP2 and the Outlook 2002 SP3 client. We will soon be going to Outlook 2003 SP(latest).

As it stands, Exchange looks very unreliable for Calendaring. Is it reasonable to expect Exchange to be able to perform like a workhorse, without problem? Is it likely that we are not implimenting it properly? We serve about 2500 users.