Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of our contractors said that by default, it was possible for anyone to connect to the powershell instance of a CAS server and do an Export-mailbox (or similar command)

Can anyone tell me if this is correct, how it's accomplished, and how I can disable this functionality?

More information:

Several users on a multi tenant system will be leaving our company. A contractor has been hired to facilitate the migration.

It's OK that people have access to OSTs and regular email but I don't want the contractor doing a bulk export of data without our coordination. I overheard them discussing how they will need each user's password to accomplish the export. I'm concerned if they proceed a bulk export will occur, causing contention on internet circuits and disk IO.

share|improve this question
1  
If they want user's passwords, they aren't planning on using powershell - they're planning on using the outlook client (or program that connects as a client) to export it all to a PST file. –  Grant Sep 18 '13 at 14:13
    
I agree Grant. They probably have some 3rd party software that connects to multiple mailboxes non-cached and does the PST export using the user's credentials. Clunky mail admin path though...if your an Exchange consultant wanting to export mailboxes for a migration/archival then using the actual export request in the shell would be the way to go. –  TheCleaner Sep 18 '13 at 15:13
add comment

1 Answer

up vote 1 down vote accepted

They can export their mail locally to a PST file, but I don't see how they could gain access to a CAS server's Powershell session to Export the mailbox.

In Exchange 2010 everyone (including admins) has to be explicitly given the right to import/export.

The specific role is the "Mailbox Import Export".

Such as:

New-ManagementRoleAssignment –Role "Mailbox Import Export" –User BobSmith

So unless you've already granted that Role to all users there wouldn't be a way for a user, even if they had access to the Exchange shell on the CAS server, to run the Export request cmdlet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.