Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a new Exchange admin, and I would like the ability to mount folders in my Outlook so I can check into a user's email box if needed. I added access to another user's email mailbox in my outlook, but when I try to expand their folder, I get "Cannot display the folder. Microsoft Office Outlook cannot access the specified folder location."

I assume I need to give myself permissions to all email boxes on the server, but not sure how to go about doing this!

share|improve this question
2  
This is regarded as pretty unethical behaviour, and possibly illegal depending on your location. If you need to check the email of an absent member of staff, why not reset their password and log in using OWA? –  RobM Feb 9 '11 at 17:53
    
If the member of staff were absent or terminated, that would be a possibility. In this case, it is for active user training or issues with troubleshooting our spam filter. How is it unethical to look at another user's email that belongs to the company? –  muncherelli Feb 9 '11 at 18:01
    
I'd regard it as unethical to look without their knowledge or permission unless I was investigating a complaint about them. Where I live (UK), it would also be illegal as well as unethical, so I was serious about that - you should check the legal implications for your locale. –  RobM Feb 9 '11 at 18:22
add comment

2 Answers

up vote 1 down vote accepted

Navigate to the properties of the user account in question on Exchange 2003 server, open it's properties and at the "Exchange Advanced" Tab assign yourself full rights on the mailbox.

share|improve this answer
1  
If the user is a member of the Enterprise Admins or Domain Admins groups, this will not suffice due to the explicit denial assigned to those groups. –  Massimo Feb 9 '11 at 18:21
    
It just worked for my account which is both Enterprise Admin and Domain Admin. –  muncherelli Feb 9 '11 at 18:28
    
Well, it shouldn't have... maybe your organization uses non-standard permissions. –  Massimo Feb 9 '11 at 18:29
1  
@muncherelli - you might find that the permissions mysteriously disappear in a short while due to the adminSDHolder thread which runs every hour on the DC hosting the PDC Emulator FSMO role. –  Ben Pilbrow Feb 9 '11 at 19:03
    
Right, quite common, especially if you have BES in the network. –  Vick Vega Feb 9 '11 at 19:09
add comment

This has serious security and privacy implications, and is subjected to legal costraints in many countries; this is the reason this is not doable by default: even the most high-privileged administrator can't by default access other people's mailboxes.

Now, if you really need to do this, and if you are authorized by your company, let's go to the technical side of it.

Exchange-related informations are stored in Active Directory objects, which come with built-in Access Control Lists (ACLs) like everything else in AD; at the root of Exchange-related object hierarchy is the Exchange Organization, which contains many things, amongst which are administrative groups, routing groups, servers and finally mailbox stores (databases); all of these objects inherits some ACLs from parent objects, and all of them inherits root-level ACLs from the Organization object. This is important for your question because this is where two very important permissions are set for the whole organization:

  • Full control over everything is given to Enterprise Admins and almost-full control is given to Domain Admins.
  • Access to other user's mailbox contents and permission to send messages as other users is explicitly denied to those two groups.

These two settings seem to contradict themselves, but if you look at them for a while, the logic becomes quite obvious: these two groups of users need elevated permissions in order to manage Exchange, but those permissions would give them access to other user's mailboxes; so this type of access is explicitly denied.

In order to allow what you want, you need to remove this explicit denial at the organization level; then, members of the Enterprise Admins or Domain Admins groups will be able to open other users' mailboxes.

This is made even more difficult by the fact that you can't by default directly edit the ACL of the Exchange Organization object (and of many other Exchange-related objects); there are however some ways to do this, but they involve using non-standard tools like ADSIEdit or the Services node in the Active Directory Sites and Services MMC (under which you can find the Exchange-related AD object tree).

The easiest solution is to allow editing of ACLs in the Exchange System Manager; in order to do this, you should modify a Registry key, as stated here: go to HKCU\Software\Microsoft\Exchange\ExAdmin, create a new DWORD value called ShowSecurityPage and set it to 1. Now launch the ESM, right-click on the top-level object (which has the name of your Exchange Organization), view its properties and you should be able to see and modify its ACLs. If you remove the explicit deny settings applied to Enterprise Admins and Domain Admins, you should be able to access everything when using an administrative account. You can also of course apply more refined settings, and also edit ACLs on lower-level objects (such as administrative groups, servers and databases) and assign permissions to specific users or groups; but you should study the existing ACLs very carefully before doing that, or you are at a serious risk of breaking something.


N.B. Things are somewhat different in Exchange 2007/2010, but the same basic concept remains: administrative users are by default denied access to other users' mailboxes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.