How to Deny access to all mailbox folders regardless of explicit permissions   

Hi,

I wonder if there is a way to deny access for a particular user/mailbox to 
all other mailboxes regardless of the Permissions being changed on a 
particular mailbox object by a particular user. That is,  I'd like the 
user/mailbox "NoAccessUser" to be unable to Open any folders in any other 
user's mailbox even if that other user has explictly granted the Permission 
in thier Calendar for Default to have Reviewer Role.

Is this possible?

As a test I did try changing the Mailbox Rights on an individual mailbox 
(say "TestUser") so that the permissions for "NoAccessUser" were set to Deny 
for all except "Associated external account" (this was left blank).  But, if 
that same "TestUser" modified the Permissions on thier Calendar so Default 
has the Role of Reviewer then the user "NoAccessUser" was able to Open the 
Calendar of "TestUser".

Thanks,

Walt Bell

date: Fri, 19 Sep 2008 19:22:40 -0700   author:   WaltB

Re: How to Deny access to all mailbox folders regardless of explicit permissions   

My lord, in my dozen or so years of doing this peer support thing I've seen 
a lot of strange requests, but this one has to be one of the most arcane.

The way I understand this to work, Mailbox Rights grant ownership rights to 
a mailbox, while folder-level rights are controlled by the folder rights. 
As far as I know, when you attempt to open a folder, mailbox rights aren't 
even checked.
-- 
Ed Crowley MVP
"There are seldom good technological solutions to behavioral problems."
.

"WaltB"  wrote in message 
news:3B357158-D71C-497C-92D9-940ACF2FF808@microsoft.com...
> Hi,
>
> I wonder if there is a way to deny access for a particular user/mailbox to 
> all other mailboxes regardless of the Permissions being changed on a 
> particular mailbox object by a particular user. That is,  I'd like the 
> user/mailbox "NoAccessUser" to be unable to Open any folders in any other 
> user's mailbox even if that other user has explictly granted the 
> Permission in thier Calendar for Default to have Reviewer Role.
>
> Is this possible?
>
> As a test I did try changing the Mailbox Rights on an individual mailbox 
> (say "TestUser") so that the permissions for "NoAccessUser" were set to 
> Deny for all except "Associated external account" (this was left blank). 
> But, if that same "TestUser" modified the Permissions on thier Calendar so 
> Default has the Role of Reviewer then the user "NoAccessUser" was able to 
> Open the Calendar of "TestUser".
>
> Thanks,
>
> Walt Bell
>
>

date: Fri, 19 Sep 2008 21:59:16 -0700   author:   Ed Crowley [MVP]

Re: How to Deny access to all mailbox folders regardless of explicit permissions   

What is it you are trying to do?

There are ways of doing this by working outside of the square.

e.g. Only access to this mailbox to non MAPI clients, then get the user 
working on POP3.

You solution depends upon what you're trying to do.  Ed is correct, using 
Outlook MAPI client the user will still be able to access folders.
-- 
Peter O'Dowd
Exchange Server MVP
http://www.blade.net.nz
"WaltB"  wrote in message 
news:3B357158-D71C-497C-92D9-940ACF2FF808@microsoft.com...
> Hi,
>
> I wonder if there is a way to deny access for a particular user/mailbox to 
> all other mailboxes regardless of the Permissions being changed on a 
> particular mailbox object by a particular user. That is,  I'd like the 
> user/mailbox "NoAccessUser" to be unable to Open any folders in any other 
> user's mailbox even if that other user has explictly granted the 
> Permission in thier Calendar for Default to have Reviewer Role.
>
> Is this possible?
>
> As a test I did try changing the Mailbox Rights on an individual mailbox 
> (say "TestUser") so that the permissions for "NoAccessUser" were set to 
> Deny for all except "Associated external account" (this was left blank). 
> But, if that same "TestUser" modified the Permissions on thier Calendar so 
> Default has the Role of Reviewer then the user "NoAccessUser" was able to 
> Open the Calendar of "TestUser".
>
> Thanks,
>
> Walt Bell
>
>

date: Mon, 22 Sep 2008 21:46:53 +1200   author:   Peter O'Dowd \(MVP\)