Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Once i've logged into my work OWA, i've found i can access any other staff members mailbox simply by changing my username to theirs in the web address box! How do i turn off this scary 'feature'???

And can someone with someone add the 'outlook-web-access' tag please

Cheers

share|improve this question
    
Will "owa" do..? –  RainyRat Oct 30 '09 at 10:19
    
It will indeed. Thanks Rat –  RKid Oct 30 '09 at 10:42
    
Try doing this on a non-administrator account –  sparks Oct 30 '09 at 12:20
    
Tried it, still have access to all users mailboxes. –  RKid Oct 30 '09 at 12:57
1  
Sounds like you have permissions issues on your mailboxes. I would start looking there before blaming OWA. –  Adam Oct 30 '09 at 13:08

3 Answers 3

up vote 1 down vote accepted

Are you an exchange / domain admin by any chance?

share|improve this answer
    
Yes but i've set up another standard user test account and i can do it from this account too. –  RKid Oct 30 '09 at 12:55
    
Something is wrong with your Exchange security settings then. My guess is if you take that same test user you can open up anyones inbox via Outlook. –  ITGuy24 Oct 30 '09 at 13:07

this can happen due to different reasons,

First -> a device that is caching Users credentials can allow person A to gain access to person B's mailbox.

Second -> http://support.microsoft.com/kb/173658"

Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters

Add DWORD Value, and add the following: Value Name: UserTokenTTL
Data Type: REG_DWORD
Data: (Number of seconds for token to be cached - 30 second min)

Regards, Vivek.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.