User permissions for shared mailbox

In a big organization, we've multiple shared mailboxes. Each mailbox is being looked at by different employees. We want to provide folder level restrictions to the employees and have primarily 3 type of access at a folder and root level:
1) Owner access (Read, Create, Respond and Delete)
2) Employee access (Read, Create and Respond)
3) Read and View-only access
Idea is to have a controlled access environment in the company where we don't want any employee to delete any e-mails and they're held accountable for their work.
Million dollar question is - How do we achieve this in an Exchange Service 2010 Enterprise SP3 environment? Is it recommended to have such access levels? Can we've profile groups created to add users in future too with similar access restrictions?
Please provide step by step.
If this is not possible or advised, please suggest a better alternative with which we can track who deletes the e-mails and then change their behavior. May be some e-mail logs that help us determine this information? What is your suggestion?

Hi,
You can try Exfolders tool:
http://gallery.technet.microsoft.com/office/Exchange-2010-SP1-ExFolders-e6bfd405
How to use Exfolders:
http://mouzzamh.wordpress.com/2012/04/01/how-to-use-exfolder-tool-for-exchange-2010/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Thanks,
Simon Wu
TechNet Community Support

Similar Messages

OWA continuously prompts MailUser user when saving appointment for shared mailbox

We have a number of users of type 'mailuser' who are granted full permissions to shared mailboxes. If a user of mailuser usertype does the following, they are unable to save appointments to the shared mailbox's calendar. Outlook Web App will
continuously prompt the user to re-login. The functionality works in IE but *not* in FireFox (Update v28.0) and Chrome - I know probably beyond what can be fixed server-side but never hurts to ask.
Steps to reproduce:
1. Mailuser user is granted full access to a shared mailbox.
2. Mailuser accesses shared mailbox in OWA at https://mail.myorg.com/owa/[email protected]
3. User goes to the Calendar within OWA and double-clicks a timeslot to add an appointment. After appointment details have been entered, click "Save and Close"
4. Outlook Web App responds with a login prompt (same as initial prompt) and the user is unable to add the appointment - can't re-login via the prompt using the mailuser username and password.
Thanks.

Hi,
I have tested in my Exchange 2007 environment with IE. I can user mail user's credential to access shared mailbox can add appointments perfectly.
Please make sure the shared permission is set to Full Access instead of other mailbox permission. Also confirm the web browser for OWA access is a supported browser with OWA premium. If the issue persists, pleae remove the mailbox permission then re-add
it back to have a try.
Regards,
Winnie Liang
TechNet Community Support

How to use Search Folders in Outlook for shared mailboxes

Hello
We use Otlook 2010/2013 with MS Exchange 2010. In outlook there is "Serarch folder" with subfolders Large e-mail, Unreaded mails.... User can create own subfolders with rules.
Users have attahet to outlook shared mailboxex for example Import, Export....
For these mailboxes you cannot use "Search Folders" - outlook can use it only for your personal mailbox.
To use "Serach folders" for shared mailbox I have to create new e-mail profile in Windows. User has to run outlook using these new profile "import". Now he is directly connected with shared mailbox.
But users want to use "Search folders" when they are on own outlook profile with shared mailboxes attahecd to their profiles.
Is it posible to do it? Or use some third-party
product?
Thank you for help
Tomasz
Kind Regards Tomasz

Hi,
I suggest we ask this question on Outlook forum:
http://social.technet.microsoft.com/Forums/office/en-US/home?forum=outlook
Regards,
Simon Wu
TechNet Community Support

Best practices for sharing mailboxes

Hello,
To share mailboxes, I am not sure of the 'best practices'.
From my point of view, there are two scenarios :
classic mailbox : an user A wants to share his mailbox so it assigns rights on his mailbox for an userB via Outlook. The userB will add the userA's mailbox to his profile
shared mailbox : the rights are managed by the administrator
Is it correct to divide the management (i.e classic user manages his own mailbox and the administrator manages rights on shared mailbox) or is not ?
And the delegation functionnality in Outlook is not really what I want because the userB must have only access to the mailbox (+calendar+contacts) but he hasn't to manage the appointments, etc.
Thanks for your help

Unless there is some other reason, users should own the right to share their mailboxes - it shouldn't be something that demands administrator management (if only so that the administrators aren't swamped by user requests for sharing their mailboxes).
For true shared mailboxes, when the mailbox is created, full access is granted by an administrator.

Publish calendar for Shared Mailbox

Hi,
I have shared mailbox that I really need to have the calendar to be publish online (the ics link). I tried using the website and outlook 2013 client. Both of them saying that the "storeID provided isn't an ID of an item." Is there a way to be able
to publish the calendar?

Hi,
We can enable Internet Calendar Publishing
in exchange, then users can share calendar availability (free/busy) information with users in non-Exchange organizations and other individuals with Internet access.
Refer to this document.
https://technet.microsoft.com/en-us/library/ff607475%28v=exchg.141%29.aspx?f=255&MSPPError=-2147217396
After creating a new sharing policy, use the following command to set the sharing policy Internet for shared mailbox.
Set-Mailbox -Identity <shared mailbox> -SharingPolicy "new policy"
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support

NSAD user directory for shared services not working

Hi!
Im trying to configure a MSAD user directory for shared services in Essbase 11.1.2.1. I have done it correctly in Essbase 9.3.1.
Back then i had to import certificates to the cacerts java file. Is it still necesary? I dont see it mentioned anywhere in the v.11 docs, however, its not working using same parameters. I get an error saying i have specified "either host or port value incorrect".
Do i have to import certificates or am i missing anything else, can anybody help?
Thanks!!
Jorge

Certificates have nothing to do with MSAD.
when you reach to "MSAD user configuration" tab in Shared Services, try to see if you can auto configure user by inputting: sAMAccountNmae="some user ID", replace some user ID with your or admin ID, and verify if you can pull the users from the MSAD.

Folder permissions for sharing between users on the same machine

Hello,
I have several accounts on my MacBook and I want to keep some files private and some files shared with full permissions for everyone.
OS X standard behavior for the default Users/Shared folder is that everyone has read/write access to the folder, but if you create a new file there, then only the creating user has write access to that file.
I want to change that folder's behavior so that newly created files can be modified by everyone on default.
How would I do that?
Thanks.

Thanks, your answer helped me a lot. I found an even simpler method which doesn't require any extra applications.
Open console and navigate to the directory where your share directory is located, e.g. /Users/Share/
create the desired folder: mkdir public
set acl permissions for each user with: chmod +a "username1 allow flag1,flag2, ....." public/
check permissions with: ls -le
Example:
chmod +a "dev allow list, add_file, search, delete, add_subdirectory, delete_child, readattr, writeattr, readextattr, writeextattr, readsecurity, writesecurity, chown, file_inherit, directory_inherit" public/
This will give the user dev full access to that folder. Any file or directory created inside that folder by the user dev will also inherit the permissions of that folder.
Also, the advanced permissions override any other permissions. you can test that my making that folder inaccessible with chmod oga-rwx public/ and dev will still be able to access it because of the acl permissions.
exactly how i wanted it.

Message recall outlook 2010 greyed out for shared mailboxes

Hello,
Can anyone advise if it's possible to recall a message sent from a shared mailbox? The user has full access permissions to the shared mailbox but the 'recall this message' option is greyed out.
We have installed the hotfix below but it says the update is already installed on the system?
http://support.microsoft.com/kb/2475877/en-gb
This is using Windows 8, Outlook 2010 32bit and Exchange 2007 SP3.

Hi,
Recall message is an Outlook feature. Actually, we have a dedicated support team regarding the Microsoft Office Outlook. I recommend you ask your question on our Outlook forum which is staffed by more experts specializing in this kind of problems. Thanks
for your understanding.
For your convenience:
http://social.technet.microsoft.com/Forums/office/en-US/home?forum=outlook
Hope it helps.
If you have any problem with Exchange server, welcome to our Exchange forum.
Best regards,
Amy Wang
TechNet Community Support

Need insight for setting up permissions for sharing an external hd via OS X 10.6?

Hello intelligent lifeforms,
My supervisor and friend passed away a little over a year ago, and I am now trying to fill his shoes as the networking guru and could use some assistance. I'm trying to share an external hard drive that is connected to my Mac Pro OS X 10.6 workstation with a Mac Pro OS X 10.4 workstation user. I've tried setting up a Sharing Only account in my System Preferences-Accounts for the 10.4 user, and under System Preference-Sharing I turned File Sharing: On, added the Shared Folder, added the User and set priveleges as "Read Only." My intentions are for the 10.4 user to only be able to copy files from the external hard drive so as to protect the archived files being stored there from being tampered with. However, there is a User group listed as "Everyone" that I can't remove and believe it is taking precedence over the 10.4 account that I setup. I do not know where this Everyone group originated from but believe it to be some kind of default group and a major obstacle.
When the 10.4 user copies a folder from the external hd to his workstation and later copies it to a volume on our Xserve OS X 10.2 the folder shows that I do not have privileges to do anything to the folder (there is a red circle with a minus sign in it on the folder icon). Eventually, I am to backup these files to the external hd where lies my dilemma.
The volume on the Xserve being copied to is setup under Workgroup Manger-Sharing-Share Points-General: "Share this item and its contents" IS checked, Owner: admin-Read & Write, Group: staff-Read & Write (where said user has been added to the staff group), Everyone: none (I do not think the Everyone group listed on the server has anything to do with the Everyone group on my machine?), Enable disk quotas on this volume is NOT checked.
My tests show that the permissions are being carried over from the external hd Everyone group (Read Only) because even when the 10.4 user's permissions are set to Read & Write in System Preferences-Sharing-File Sharing-Users the folder still shows to be Read Only when it's copied. I've even tried setting his Desktop privileges to Read & Write hoping that when he copies the folder the permissions would be overwritten. Unfortunately, the only way to give me priveleges is for the 10.4 user to change them manually through Get Info from his workstation. This is counterproductive to the workflow I'm trying to establish. I've tried wrapping my brain around the flowchart of coordinating permissions/privileges between the different machines but to no success.
Also, a note to add is I've observed a User: Firebird Database that is listed under System Preferences-Sharing on both of our workstations. It cannot be removed either and I do not know where it is originating from.
Is there anyone out there that has any insight to this situation?
Perplexed,
carl_prepress

"Everyone" is not a Group.
Every file has underlying Access settings for System, Owner, Group, and World.
Access settings for Everyone mean everyone-else that is not explicitly mentioned in the other settings. It is the same as the Unix "World".
If you set the Priviledges for a file to Everyone=Read, then any user with any credentials can read it.
The User Categories Owner, Group, and Everyone
You can assign standard POSIX access permissions separately to three categories of users:
Owner—A user who creates a new item (file or folder) on the file server is its owner and automatically has Read & Write permissions for that folder. By default, the owner of an item and the server administrator are the only users who can change its access privileges (allow a group or everyone to use the item). The administrator can also transfer ownership of the shared item to another user.
Note: When you copy an item to a drop box on an Apple file server, ownership of the item doesn’t change, but only the owner of the drop box or root has access to its contents.
Group—You can put users who need the same access to files and folders into group accounts. Only one group can be assigned access permissions to a shared item. For more information on creating groups, see the user management guide.
Everyone—Everyone is any user who can log in to the file server: registered users and guests. Hierarchy of Permissions
If a user is included in more than one category of users, each of which has different permissions, these rules apply:
• GrouppermissionsoverrideEveryonepermissions.
• OwnerpermissionsoverrideGrouppermissions.
For example, when a user is both the owner of a shared item and a member of the group assigned to it, the user has the permissions assigned to the owner.

Unable to manage SendAs permissions on shared mailbox

This morning when we came in all of the sendas permissions for our helpdesk mailbox were missing. When I try to add them with the Exchange console I get a message that says the user does not have sufficient permissions.
We are Exchange 2010 running on 2008R2, Active Directory is 2008 native.
I added the sendas permission for the users from Powershell and they now show up in the console but they still cannot sendas the user. I read another post that says we need to wait for replication and I will wait.
My question is what is causing the permissions error? We also get it when we try to remove an error.

Hi,
From your description, I recommend you follow the steps below to ensure that this send as permission is granted successfully.
Open ADUC -> View -> Advanced Features -> right click user1 -> Properties -> Security -> make sure user2 is listed in the "Group or user names" and allow "Send as" permission.
If no, please add user2 to it and select "Send as" Allow to check the result.
Note: Please change user1 and user2 to the users you need.
Hope this can be helpful.
Best regards,
Amy Wang
TechNet Community Support

AD custom6 attribute and group memberships for shared mailboxes

I have 900 shared mailboxes that are in Exchange 2007. These mailboxes have no owners and are provided access to the users threw AD groups. I need a script that will produce Each users custom6 attribute (SID is there) along with the shared mailboxes they
have rights to (Full. send As etc...)
This is a migration from 2007 to 2010 in different domains.
[email protected]
2142285476
Charles B. Giles

Deployment and upgrade questions should be asked in the forum for the product as there are tools available to automate 2007 to 2010 migrations.
See:
http://technet.microsoft.com/en-us/library/ee681665(v=exchg.141).aspx
See:
http://blogs.technet.com/b/exchange/archive/2012/05/23/exchange-server-deployment-assistant-update-for-exchange-2010-hybrid-deployments-with-office-365.aspx
See:
http://social.technet.microsoft.com/Forums/exchange/en-US/home?forum=exchange2010
¯\_(ツ)_/¯

Tracking logs for shared mailbox

Is it possible with 2010 exchange tracking logs to prove the following
We have a mailbox which has been made accesible in terms of permissions so a number of users havve access and control over the mailbox. We need to prove which of those users with access to that mailbox has sent/forwarded information from that mailbox elsewhere
(i.e. external mailbox recipient). Can the logs prove who did these actions? Or will they just show the mailbox itself sent/forwarded them on?

Hi,
One more thing, mailbox Audit Logging feature can track mailbox owner, delegate, and administrator logons to a mailbox, as well as what actions are taken while the user is logged on.
Document for reference
Mailbox Audit Logging for a Mailbox
https://technet.microsoft.com/en-us/library/ff461937(v=exchg.141).aspx
And when you use Search-MailboxAuditLog cmdlet to search mailbox audit log entries, remember to add -ShowDetails parameter to see who did actions in that
mailbox.
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support

Display name for shared mailbox

Hi, by our customer I just installed new exchange 2013 server. I have created severalls shared mailboxes. And now, the customer want, that when somebody from the company send, or answer to an email, the recipient can see how has send the email. For example,
the shared mailbox has display name "Service", user who has full access to this shared mailbox has display name "John", is there any way to merge these display names, so the recipient can see for expample "Service - John" as sender
of the email?
Thanks

Hi,
From your description, you want to set the displayname of the shared mailbox. I have a test in my lab, you can run the following cmdlet to achieve it.
Set-User -Identity xxx -DisplayName "xxx"
About the Identity parameter, you can use alias of the shared mailbox.
Hope it helps.
Best regards,
Amy
Amy Wang
TechNet Community Support

Online Archive for Shared Mailbox Shows Main Mailbox SMTP Address, Not Shared Mailbox

First off, we are running Exchange 2010 with Outlook 2010. Exchange is running SP3UR5 and is stable. Outlook has the latest updates.
We have archive mailboxes on all our production mailboxes. We automatically archive items older than two years into these. We have several colleagues who have access to one or more shared mailboxes, who had no issues when they were using a Windows
XP workstation. However, when they were moved to our Windows 7 systems, their archive folders all show their primary mailbox SMTP address. If you click on a folder in the archive mailbox, the search bar shows the correct mailbox name. And to confuse
things just a little bit more, the primary mailbox for these shared mailboxes shows the correct name. Has anyone else seen this, and, more importantly, does anyone know of a solution? TIA ...

Hello Willard,
As Andy mentioned, this issue is a known issue which resolved in Exchange 2010 SP3 RU2. I know we are currently running Exchange 2010 SP3 RU5, however to resolve
the issue, we need to install hotfix for Outlook clients as well. Please refer to the following hotfixes for Outlook 2010 and 2013:
Note: Exchange 2010 SP3 Ru2 or later will update the “OwnerSmtpAddress”
for all alternate mailbox. And before applying the following Outlook hotfix, we should have RU2 installed first.
Outlook 2010 hotfix:
Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): August 13, 2013
http://support.microsoft.com/KB/2817574
Issue description: You connect to Microsoft Exchange Server 2010 mailbox
by using Microsoft Outlook 2010. When you enable the feature that lets you view the online archive of a manager in Outlook 2010, two online archives that have the same name are displayed. To resolve this issue, you must also have Exchange Server 2010 Service
Pack 3 (SP3) Update Rollup 2 installed
Outlook 2013 hotfix:
Description of the Outlook 2013 hotfix package (Outlook-x-none.msp): August 13, 2013
http://support.microsoft.com/kb/2817503
Issue description: When you enable the feature to see the online archive
of the manager in Outlook 2010, two online archives that have the same name are displayed.
After apply both update for Exchange server and Outlook client, the issue will be resolved accordingly. And I recommend to install the latest updates for Outlook
clients:
Title: How to install the latest applicable updates for Microsoft Outlook (US English only)
Link:
http://support.microsoft.com/kb/2625547
Moreover, the issue will affect the “auto-mapping” archive mailboxes, since the issue only affect few users, please check the differences on the Outlook client side,
and make sure the version and patches/updates are the same. If needed, we can first remove the auto-mapping full access permission, then re-add non-auto-mapping full access permission, at last, add
additional mailbox from Outlook manually, thus it will not diplay same name for the archive mailbox we access.
Remove the full access permission:
Remove-MailboxPermission –Identity “Shared_mailbox” –User “affected_user_mailbox” –AccessRights FullAccess
2.Re-add the full access permission with non-auto-mapping:
Add-MailboxPermission -Identity “Shared_mailbox”
-User “affected_user_mailbox”
-AccessRight FullAccess -InheritanceType All -Automapping $false
3. Then on the affected user mailbox outlook side,
add additional mailbox manually.
Please refer to above information and if anything unclear, feel free to let me know.
Regards, Eric Zou

Lite H.264 DVR User Permissions for certian Cameras

In our building we have a lite H.264 DVR. We have one camera that we need to share with a new user on the DVR.
I cant for the life of me know how to go about doing this.
First I thought it would be in the user permissions but within that there wasn't much in the way of setting to restrict what cameras could and couldn't be viewed.
If someone could give me some feedback on how this could be set up that would be brilliant.
This topic first appeared in the Spiceworks Community

Love marriage specialist baba, Vashikaranspecialist baba, black magic specialist baba..+91-9829791419 No1 Indian AstrologerAGHORI Ji +91-9829791419 15 time gold medalist Baba ji...inuk...usa....canada....in india..... love Vashikaran specialist ,voodoo spellget your love back by Vashikaran, blackmagic love Vashikaran specialist, bringyour love back, get back your lost love, win your lost love back, spells andtips to get your love back,Vashikaran WORLD FAMOUS BEST INDIAN molvi baba JIINDIA / AMERICA / CANADA / AUSTRALIA / UK / USA/INTERNATIONAL SERVICE WITHAGHORI ji 50 YRS EXPERIENCE.... love mantra to get back your lost love, Vashikaranspecialist to bring love back, solve love problems, bring your love back bytantra and ilam, powerful Vashikaran mantra to win the the about black magicspecialist molvi baba ji love back, indian hindu...

User permissions for shared mailbox

Similar Messages

Maybe you are looking for