2

At our organisation the DOMAIN\Administrator account can access all mailboxes i.e. log in to Outlook Web Access as DOMAIN\Administrator and then open another mailbox and that users mailbox appears.

I have no idea why this was done, I'm suspicious but that's not my problem, I don't want to be responsible for such so want to remove this permission.

Is it possible to search through all mailboxes and remove any access that DOMAIN\Administrator has (whether that be Full Access, Send As or Send on Behalf)?

We're running 4 Windows Server 2012 servers with Microsoft Exchange 2013.

5
  • 1
    What are you trying to hide from the administrator? They are likely responsible for managing all emails in your organisation and for you to be so desperate to hide your correspondence from him or her is highly suspicious. Use your own personal email if you want private communication. Dec 11 '14 at 1:41
  • 2
    Be careful though, as your company's administrator, your ISP's administrator may also be able to read your email. Some Google engineers may also have access to read everything on your Gmail account too... and so on. If you really need such a level of "privacy", you may be better setting up your own MTA (SMTP server). Then again, if your mom is on the sudoers list, she may also be able to read your email.
    – Simón
    Dec 11 '14 at 3:48
  • Protecting against Rogue Administrators From <blogs.technet.com/b/exchange/archive/2014/09/12/…>
    – user303474
    Aug 6 '15 at 8:36
  • what about adding administrator in the security settings in outlook and disable everything?
    – vartaxe
    Nov 26 '15 at 11:11
17

This is probably a result of DOMAIN\Administrator being a member of the Organization Management group. From the description of that group:

Members of this management role group have permissions to manage Exchange objects and their properties in the Exchange organization. Members can also delegate role groups and management roles in the organization. This role group shouldn't be deleted.

Or from Technet:

Administrators who are members of the Organization Management role group have administrative access to the entire Exchange 2013 organization and can perform almost any task against any Exchange 2013 object, with some exceptions. By default, members of this role group can't perform mailbox searches and management of unscoped top-level management roles.

This is basically the group in Exchange that is like the Domain Admins group in Active Directory - members have administrative privileges in Exchange, which includes the ability to log into any mailbox (by default). You could, of course, remove DOMAIN\Administrator from that group, but anyone with modify privileges on that group (like domain admins) can trivially add that user, or any other, back into it.

In the unlikely event that the DOMAIN\Administrator user is explicitly defined as having permissions to each mailbox, you could use a PowerShell script to remove it, but you'd have the same problem - that user, and anyone with modify privileges on the Organization Management group can trivially add that user, or any other, back into it.

Bottom line, administrators have (or can easily give themselves) permissions to do whatever they want. It's the nature of an administrative account, and there's really no getting around it.

15
  • 1
    Yep. Note that even if you remove all permissions, the admin could just pull the drive out of the server and access the mailboxes that way. Or, if your servers are hosted off-site (or in the cloud), then an admin that you don't even know could do the same. Or the cleaning lady. Some people you just have to trust. If your admins are criminals, you need to fix your hiring process, not your mailbox permissions. Dec 10 '14 at 20:58
  • 2
    +1 In general, this answer is absolutely correct. However, there is one possible way to prevent administrators from reading the e-mail inboxes of other users: encrypt the contents of the inboxes. The problem of administrators being able to send mail as a given user can also be solved by digitally signing e-mails. These are the solutions that are used pretty much universally in organizations where this level of security is needed.
    – reirab
    Dec 10 '14 at 21:17
  • 1
    Proper use of cryptography is the only answer that will actually prevent people with administrative rights on or physical access to the server (or simply a packet sniffer) from reading your e-mail inbox. Furthermore, anyone can spoof a sender address on any e-mail if digital signatures are not relied upon. SMTP and POP3 themselves provide almost no security whatsoever.
    – reirab
    Dec 10 '14 at 21:20
  • @reirab Not that encryption is a panacea, either. A domain admin (or someone with physical access) is going to have the acess needed to dump any crypto key from memory, even if it requires knowledge and effort. Dec 10 '14 at 21:28
  • 1
    The Evil Sysadmin threat is one that's extremely hard to mitigate. You've a bunch of guys with the skills and roles necessary to subvert almost any countermeasures... because they're probably the person who put them in the first place. The answer is generally to ensure that you've got decent sysadmins that you trust first and foremost. If you don't, then you have serious problems regardless of what extra layers you slap in.
    – Sobrique
    Dec 10 '14 at 21:53
4

Organization Management does not actually give permission to access mailboxes using OWA. In fact, by default, this group is explicly denied access to all mailboxes, for the same reasons that you want to do so. I suspect that the account was granted rights to every single mailbox individually.

You can check for it using a command such as:

Get-Mailbox | Get-MailboxPermission -User DOMAIN\Administrator | where {-not $.IsInherited} Get-Mailbox | Get-ADPermission | where {-not $.IsInherited}

To remove them, you would just add Remove-MailboxPermission or Remove-ADPermission to the end. (Do this at your own risk ... This is all off the top of my head, which is why I am not including the full commands. There are probably some mailboxes you would want to exclude, such as the Administrator's own mailbox.)

This is why service accounts for Blackberry Enterprise Servers must not be put into Organization Management. Instead, they have specific instructions to grant access to all mailboxes.

I haven't looked into this specifically for Exchange 2013, but none of the other answers claim to be new for Exchange 2013, so I suspect they are just mistaken.

1
  • Actually, these Exchange "defaults" vary quite a bit depending on things like whether Exchange is a brand-new install, or migrated from a previous version (and what settings any previous versions had). Dec 11 '14 at 13:29
2

It appears from your message that you may be an administrator. If so, you have the rights because at times you will need them. Accept, but don't abuse the privilege granted you. A trustworthy administrator will only use the rights when required to do your duties. Those duties may include scanning emails for specific content, tracing email sources, and other activities which require access to other user's email.

If you are making someone an administrator, consider the following.

Anyone with administrative rights more or less has the keys to the kingdom. If you can't trust them, don't make them administrators. They should be in a position to undo pretty well anything you do to remove access.

I would expect that most solutions would be best implemented by the administrator. The mail server would need to be able to decrypt the mailboxes. This would give the administrator access to the mailboxes.

Encrypting the mail messages at both ends could be done. However, this would severely limit who you can exchange email with. It is likely that you would want the administrator to be able to install and debug the encryption software.

The administrator is likely to be in a position to access the mail by packet capture as well. This is more difficult, but not extremely difficult.

A trustworthy administrator will not abuse their authority. Where they do need to access mail folders, they will limit their access as much as possible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.