Public Folder Permissions

[ianG]

Hi folks,

Have a good few concerns about public folders, and how they are archived that I hope people can help me with

Just say our users use a public folder as a work area and regularly move mails between subfolders (with varying permissions) of that PF as work progresses. If we archive the entire PF at the root, with just one archive point, what are the implications on subsequent moves of archived mails (ie drag 'n drop of shortcuts)?

For example;

1. a mail in a subfolder that only Ben has access to get archived, and moved into a new subfolder that he dont have access too. I presume, even though he wont be able to navigate to the shortcut and use it to recall (due to exchange permissions), he'd be able to search and recall the mail via archive explorer (due to EV archive permissions)? Or are the permissions more granular then that?
2. as the mail was archived in a subfolder that only Ben had access to, will Charlie have access to it in the new location? Or will the be able to see the shortcut (exchange permissions), but not be able to recall it back (due to Ev permissions)?

[Mohawk_Marvin]

1. EV permissions on the item should cover this and as if you use permissions browser you can see the granular level permissions EV applies. This should carry through

2. Depends on version, prior to v8 EV does not keep track of shortcuts so if version 7.5 or lower they might see the stub but cannot do anything with it. However v8 tracks the shortcut.

Best thing to do is fire up a lab and give it a whirl to make sure it works the way you want/need it to

[Nick_White]

The Archive's permissions match the Public Folder permissions at each folder, so our granularity is basically the same as that of the source. Items that are archived from Public folders are not updated when the shortcut is moved around so someone could drag a shortcut into a folder and people with access to the folder may not have access to the archive that the shortcut is pointing to

[ianG]

Thanks for the replies guys, they're certainly reassuring

Sorry Nick, can you confirm Marvins comment regarding shortcut tracking? (we're on ev8 sp3)

Can I ask when the permissions get updated? I see the mailbox tasks have a synchronize 'subtask', but dont see anything similar for PF's

[Nick_White]

No problem!

Shortcut tracking is currently for mailboxes only, so it won't happen in Public Folders

Permissions are updated automatically whenever the Public Folder archiving task is processing the folder structure. There isn't a synchronize now option as Public Folder permissions generally are fairly static when compared to mailbox permissions

[ianG]

Ah, thats unfortunate

we're getting a good few migrating shortcuts unfortunately (we're a large organisation, and hard to get everyone to adopt to the need to recall before moves), so we're not quite static..! Hope I'm not jumping to conclusions, but are you saying then that these drag n dropped shortcuts dont get 'synchronized' when the PF task runs so? Permissions wont get updated due to the lack of short cut tracking?

[JesusWept3]

Yes unfortunately that is the case, so if an item was archived in \folderA and moved to \FolderB, anyone who has access to \folderA would be able to view that item in FolderB. But they shouldn't be able to open it from the Public folders within outlook as their permissions to the PF should be such that they couldn't see the folder and thus the shortcut.

Simply though the best thing you can do is purely procedural and thats restore the item before moving the item as much as that sucks

[ianG]

Thanks

Yea, while exchange permissions would stop them navigating to the shortcut as normal, they'd be able to use archive explorer etc to search the archive and recall that way

In your scenario above, if I was to recall inbetween the move between \folderA & \folderB, when the item gets subsequently re-archived, it would inherit permissions from \folderB now?

[JesusWept3]

well actually Archive Explorer won't let you list anything in FolderB if you dont have permission to it as you wont have the list/view permissions however Search.asp may be another problem

[JesusWept3]

actually scratch that you're right, the items would be shown in their original location, FolderA

anywho, if you recall the item, you're going to have to delete it from the archive as well so it doesn't show in FolderA anymore
then when it gets re-archived in FolderB, it will have FolderB's permissions

Items themselves don't have permissions, its the folder they belong to that do

[ianG]

plot thickens slightly, as we're using a centera in compliance mode, so no deleting

hrm