Users can see multiple users vaults!

[Chris_Horswill]

Hi,

Can anyone think of a reason why most of our staff are able to see other users vaults when going to their browse vaults page.

In the drop down list I can browse the vaults of two other staff for instance.

The only thing we share in Outlook 2003 is the calander which I think is normal practice. We have the IT Director able to browse a secretaries vault in a different office....Security Risk.com !!


Regards,

Chris

[TonySterling]

What version are you running?

[Michael_Bilsbor]

Hi,

If you have any access to their mailbox then you will see their archive in your search list (which makes sense as you have a right to search it ) but you'll only be able to access data archived from that folder.

[Chris_Horswill]

Hi, thanks


KVS 6.0 SP1

Have checked the permissions in AD users and computers and on the properties of the archive and I am unable to see any reason why.

We only share access to the calenders.

Regards,

Chris

[TonySterling]

Have you looked on the properties of the Outlook folders to make sure there isn't anything in there? Do the users that show up show for everybody? IE secretary A shows in everybody elses search or is a showing for b and c showing for d, etc...

[Micah_Wyenn_2]

Hey,
I know this is dumb, but you might want to double check the permissions on the mailbox archive itself to ensure that you're getting the right permissions on the archive.

Micah

[Chris_Horswill]

Hi,

Nah it's totaly random. Sec A shows in the IT directors vault drop down list despite her not working for him and even being in a different office.

Ive checked the permissions on the archive for their mailboxes.

I'm wondering if this is a hang up from when we used to use GroupWise....

Chris

[Tremaine]

Have you prehaps set your Mailbox policy to 'Include Default / Anonymous permissions'? Have you set the IncludeInherited Rights to 'On'?

You might want to have a look at exactly what folders the secretary has access through something like Archive explorer. That you you should be able to isolate whether she has access to the entire mailbox or just specific folders. If it is just specific folders then get the Mailbox owner to review the client permissions on those folders. They might have given an entire group/DL access...

If she has complete access then it might be either inherited in AD or mbx owner in AD.

Cheers

[Chris_Horswill]

Hi there, thanks for the reply....

Trouble is this seems totaly random. We have peeps being able to browse the vault of someone in a totaly different office.

Symantec have suggested that we go to the mailbox of the user I can browse in Vault manager and add myself to their permissions and set deny. This did actually remove her from my list of vaults I could browse and stayed when i removed my deny permissions.

Hasn't worked for the other 2 people in my Vault explorer list though...

Chris

[Tremaine]

There is a tool that you can get from Symantec Support called 'Permission Browser'. You can use this to view the permissions at a per folder level on each archive. It might give you a clue as to what is going on there.

Cheers

[David_Messeng1]

Chris,

are you absolutely, 100% sure that you have checked every single folder in the mailbox (that has it's archive being shared) for Outlook Delegations?

Have you checked delegations in Tools -- Options -- Delegates ?


David

[Chris_Horswill]

Hi all,

This call is now resolved!!

We had 2 issues. One being an account should have been disabled in AD users and computers but kinda wasnt....just enabled and disabled and these rights went.,

the rest are permissions that have been passed over to Outlook from Wingra when we imported the Grouwise archives.

Cheers,

Chris