Setting Folder Permissions in Outlook - what really happens?

re: Setting Folder Permissions in Outlook - what really happens?

Kn00p — Mon, 01 May 2006 20:25:02 GMT

There is a way users can access other folders then the default ones.

It works like this. Grant a user list and read permisions on the top level (Mailbox - Name). Then grant permissions to the folders you wish (Like Sent Items or some other custom folder).

Now the other user can add the mailbox in the Advanced setting of the e-mail profile. In the folder view the mailbox will show up.

re: Setting Folder Permissions in Outlook - what really happens?

Indy — Mon, 01 May 2006 21:43:54 GMT

And all sorts of fun things happen when you remove a delegated user from AD. NDR's on appointments sent to the Manager's mailbox. Fun stuff.

re: Setting Folder Permissions in Outlook - what really happens?

Marc C — Mon, 01 May 2006 22:32:37 GMT

Users have a tendency to do anything they can to make sure a single person has permissions to their mailbox. We need to audit the permissions on all mailboxes (about 40,000) we are particularly interested to find Inboxes or Calendars that have default or anonymous permissions set. I did this back in the 5.5 days using MBinfo.exe, but it won't run against Exchange 2003. Any advice? I would really like to be able to script it but I can't find a method.

re: Setting Folder Permissions in Outlook - what really happens?

Exchange — Mon, 01 May 2006 23:03:16 GMT

Marc,

There are two things that you can do to get this information:

1. Use MBINFO. I know you mention that "it does not work" but - we have used MBINFO against an Exchange 2003 server in Support, this should work. You do need to make sure that you have permissions, like when you are running Exmerge, however it should work.

2. Use the PFDAVAMIN tool. When connecting, use the "Connect to mailboxes" option. If you have permissions, connect to "all mailboxes" and then go to Tools > Export Permissions. (logging will need to be turned on under Tools > Options). You can grab PFDAVADMIN here:

http://www.microsoft.com/downloads/details.aspx?FamilyId=635BE792-D8AD-49E3-ADA4-E2422C0AB424&displaylang=en

re: Setting Folder Permissions in Outlook - what really happens?

James Fields — Tue, 02 May 2006 09:16:56 GMT

So what is the difference betwenn adding "Send-on-Behalf-of" privileges for the user account which is stored in the "publicDelegates" property on user object in the Active Directory and granted "Send As" permission on "Security" Tab in AD?

What Really Happens when you set Folder Permissions

Ted's Blog — Tue, 02 May 2006 21:17:42 GMT

I ran across a very interesting blog entry from the Microsoft Exchange group explaining exactly what...

Henrik Walther Blog » Blog Archive » Setting Folder Permissions in Outlook - what really happens?

Wed, 03 May 2006 23:56:06 GMT

PingBack from http://blogs.msexchange.org/walther/2006/05/03/setting-folder-permissions-in-outlook-what-really-happens/

re: Setting Folder Permissions in Outlook - what really happens?

Steve — Thu, 04 May 2006 00:44:49 GMT

So how does this relate to Outlook's Share My Calendar feature?

I have a client that wants calendars shared but with different access for different users. I have set all the permissions the way that seems to be correct (default and anonymous are None, specific users have Publishing Editor, others have read-only). I also set specific permissions on the calendar folder. Despite those permissions every user has full access to the calendar. Even worse is that they can all modify the permissions on the calendar.

re: Setting Folder Permissions in Outlook - what really happens?

joe — Thu, 04 May 2006 07:02:29 GMT

James: Send on behalf permission allows you to send an email that says it is from you and sent on behalf of the mailbox owner. Send As allows you to send a message that says it is from the mailbox owner.

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Thu, 04 May 2006 20:27:57 GMT

[Response to James Fields]

In addition to Joe's response, another difference is who can grant which permission.

Both the mailbox owner and Administrator can grant another acocunt "Send on Behalf" permission to another account/mailbox.

However, only the Administrator can grant the "Send As" permission.

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Thu, 04 May 2006 20:34:37 GMT

[Response to Steve]

Steve-

Have the users in question been given Full Mailbox Access? If so, then the permissions are meaningless because once you log into a mailbox with an account that has Full Mailbox Access, the permissions are not checked. One thing you might want to check is to make sure that these users cannot access any other folder in the mailbox other then the Calendar folder. If they can, then something is up.

Another thing that could cause a problem is if the Security Descriptor on the Calendar folder is no longer MAPI Canonical. You can use the PFDAVADMIN tool mentioned in a previous comment to check to make sure that the Security Descritor is properly ordered.

--Chris

Weekend reading

subject: exchange — Fri, 05 May 2006 20:02:34 GMT

Since there was no "weekend reading" last week, today's list is abnormally long. If you don't have the...

password protect a message?

jhanjon — Sat, 06 May 2006 18:02:32 GMT

I have a situation whereby a user has assistants operate their outlook to respond to general emails, however, that user also needs to receive private messages. Is there a way whereby a portion of the message can be password locked persistently, meaning each time it is opened?

re: Setting Folder Permissions in Outlook - what really happens?

Kees-Jan — Sun, 07 May 2006 22:42:16 GMT

Ok, how about this one:
we have a number of groups of users, for example: Service Desk or Service Management, who are using a "resource mailbox". When we create the mailbox we add modify permissons(via AD) to the requestor (for the system managers this is what we call the "owner" of the mailbox). Then the (so called) owner can modify permissions via Outlook to grant rights to other users. All that users add the mailbox via advanced settings to the Outlook view, so all of them see when new messages arrive in the mailbox. When they send messages, it's going to be the "send on behalf of" way. But what if those users need to use the "send as" way? Do I (as Administrator) have to grant them "send as" permissions? And what if those users use their "send as" permissions to send mails as the CEO of the company? Or do I miss something here? Is something, someone, some... prohibiting them from doing this?
...

re: Setting Folder Permissions in Outlook - what really happens?

Chris Ahlers — Mon, 08 May 2006 22:14:42 GMT

Kees-Jan --

"Send As" permission is a permission granted to a user or group on a specific user account. If I wanted to give UserA the ability to "Send As" UserB, an administrator would have to go to UserB's user object and add an ACE for UserA that grants the "Send As" permission. I cannot go to UserA's account and give UserA "Send As" permission for UserB.

Therefore, if you don't want someone to "Send As" the CEO, then don't give that user account the "Send As" permission on the CEO's mailbox/account.

If I did not completely address your scenario, please let me know, I may not have understood it correctly.

Here are some additional blogs about "Send As"
http://blogs.technet.com/exchange/archive/2005/01/07/348596.aspx
http://blogs.technet.com/exchange/archive/2006/01/13/417440.aspx
http://blogs.technet.com/exchange/archive/2006/04/28/426707.aspx