Journal Permissions

[David_Evestaff]

Hi,

We are having a rather large problem with the permissions on our journal account.

we are currently running v5 SP6.

The problem is that any user can search through our journal account (which contains every email).

By looking at the permissions on the admin console i can see that the 'everyone' group has full access - which explain it nicely.
I cannot remove the everyone group as its under the 'set automaticly' header.
These i understand are pulled from active directory.

This is all good and well, as the journal user account does indeed have the everyone group in the mailbox rights, however it only has the 'red' permissions, it does not have permsions to open the mailboxs etc. i cannot remove it from here from what i understand for two reasons, 1 because its needed for exchange and 2, it wont let me as it inheited from somwhere and we cant find out where.

the srange bit it is that all users in AD have the 'everyone' group on there mailbox rights and looking at the permissions in the admin console on the vault, the everyone group does not appear. The mailbox;s shown on the console all show the correct permissions and it works fine. its just this everyone group which shows on the journal account.

anyone have any idea? or any thoughts why the everyone gets pulled from AD on the journal account but not on the other users and there mailboxs in the vault?

Thanks v much for your time,

David.

[TonySterling]

If you manually deny the permissions for the everyone group on the archive it will overrule the automatically set. You should be okay as long as the permissions for the journal account are still set ok.

The best thing would be to sortout the pemissions on the journal mailbox itself.

Do you have the HKEY_LOCAL_MACHINE\Software\KVS\Enterprise Vault\Agents\IncludeInheritedRights registry key set? If so what is it?

[David_Evestaff]

hiya,

thanks for your reply! :)

i did think of simply setting the everyone group to deny, however when i do this the mangers cannot search the jounal vault. also is seems to throw archive errors in the event log, as the everyone deny would deny every acount as the deny overrules the grants. What i have done instead as a temp solution is to create a group in AD, move every user who we do not want to have access and set this group as deny. but clearly not the best fix.

the reg key you refered to does not exisit on the server :(

I agree that sorting the permissions on the maibox sounds correct, however its casuing problems as i cannot seem to remove the 'everyone' group from any users mailbox rights. I am wondering why the 'everyone' group does not show on the mailbox vaults in the admin console, yet it does on the journal even tho 'everyone' is present on both.

Thanks for any help you can give :)

David.

[TonySterling]

Sorry about that, I could not remember if the everyone deny would override the explit allow for the user in the archive permission. :)


Have you checked in AD for the journal account to see if the permission are added there?

What is the version of exchange and version of windows for the evserver? There is a difference on how it gathers the permissions based on OS.

[Jason_Szeto]

By default, EV should not sync inherited permissions from the mailbox. I'm guessing the journal mailbox has the everyone group explicitly added to it and every other mailbox the everyone group is inherited. That would explain why the everyone group appears in the journal archive and not in everyone else's archive.

I would check the Journal Mailbox permission and remove the everyone group if it is explicitly granted.

[Michael_Bilsbor]

Hi,

whilst you are trying to sort out the 'right' solution a quick fix would be to manually add everyone as a deny on the journal archive.

[Micah_Wyenn_2]

Would that break CA or DA searches that are scheduled? I thought implicit deny's always won over implicit approvals.

But I'm the first to admit that my permissions understanding is confuzzled at best. Somebody toss me clue one.

micah

[Michael_Bilsbor]

Hi,

Yes, deny's will override approvals.

I don't know if it will break CA or DA but between that and having end users having access to the journal I know that I'd be worrying about first...

[Micah_Wyenn_2]

Perhaps this is then a good reason to have a journal vault be set aside seperately, as a best practice. I know you'd loose SIS, but keeping the journal and the mailbox archives in a single vault seems to open you up to these sorts of problems.

micah

[TonySterling]

From reading the post the mailboxes and journal are in seperate vaults, do you mean vault stores? In any case, what is happening here would not matter what vault store it is in, as the permissions from AD are being applied to the archive allowing users to access it.

[David_Evestaff]

Thanks for the replys and help with this everyone!

Tony Sterling:
not a problem, dont worry :) the vault is running on windows 2003 SP1. We have exchange 2003 SP1 running on windows 2003 SP1. thanks again for any help :D

Jason Szteto:
ah that explains why some permissions get copyied and some do not thanks. I have indeed checked the permissions on the journal mailbox, the everyone group is not explicty granted, its being inheited from somwhere. I can tell this for two reasons, 1) if i attempt to remove the 'everyone' it throws a error that its inheited and must stop this to remove. 2) by clicking advanced it shows the everyone group as inheited from parent.

I cant seem to remove the everyone group in AD, its on all mailboxs with the 'read' permission as it should be i belive. i am looking into this however i dont feel this is the correct soluition :s

You speak of inherited permissions dont get pulled from AD by default, is there a way to manual set all the permissions on the jounal account in the vault. I.e. stop the journal account pulling permissions from AD. Or check that this setting is correct, Or maybe getting it to look again at the settings in the hope it removes the inheited everyone?

Thanks again for everyones help :)

David.

[C_H]

Have you actually checked to see if users can view/retrieve items in the vault? It may be that they can only search against items, rather than access them (which isn't ideal either i know...).

At this point in time you can go through the advanced policy in the vault admin console, turn inherited permissions off, and remove the Everyone group from the Security tab in the Active Directory Users and Computers mmc, this will leave exchange permissions there still (which are set through the Exchange Advanced\Mailbox Rights tab).

[David_Evestaff]

got it solved, thanks for everyones help.

C H: i did check that, and users could get the email

C H: i couldnt remove the everyone group from AD as it was being inheited here also from somewhere.

combined the two helpful posts above, that reg key was not present and the mailbox vaults seemed to be reading it as 0 and not pulling permissions that were inheited from elsewhere in AD. the jornual account seemed to be pulling the inhieted everyone group.

I added the key to '0' re-synced the journal account and restarted the services.

the everyone group was removed and its all working well.

Thanks again folks

David.

[Michael_Bilsbor]

Hi,

Don't forget I presume that originally you set the inherit permissions registry key for a reason. So whatever problem you think you fixed by setting that has now re-appeared now you've set it to 0.