up vote 0 down vote favorite
1
share [g+] share [fb]

Once i've logged into my work OWA, i've found i can access any other staff members mailbox simply by changing my username to theirs in the web address box! How do i turn off this scary 'feature'???

And can someone with someone add the 'outlook-web-access' tag please

Cheers

link|improve this question
20% accept rate
Will "owa" do..? – RainyRat Oct 30 '09 at 10:19
It will indeed. Thanks Rat – RKid Oct 30 '09 at 10:42
Try doing this on a non-administrator account – sparks Oct 30 '09 at 12:20
Tried it, still have access to all users mailboxes. – RKid Oct 30 '09 at 12:57
1  
Sounds like you have permissions issues on your mailboxes. I would start looking there before blaming OWA. – Adam Oct 30 '09 at 13:08
show 1 more comment
feedback

3 Answers

up vote 1 down vote accepted

Are you an exchange / domain admin by any chance?

link|improve this answer
Yes but i've set up another standard user test account and i can do it from this account too. – RKid Oct 30 '09 at 12:55
Something is wrong with your Exchange security settings then. My guess is if you take that same test user you can open up anyones inbox via Outlook. – ITGuy24 Oct 30 '09 at 13:07
feedback
up vote 0 down vote

this can happen due to different reasons,

First -> a device that is caching Users credentials can allow person A to gain access to person B's mailbox.

Second -> http://support.microsoft.com/kb/173658"

Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters

Add DWORD Value, and add the following: Value Name: UserTokenTTL
Data Type: REG_DWORD
Data: (Number of seconds for token to be cached - 30 second min)

Regards, Vivek.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.