Exchange 2010 SP1 Mailbox Access Auditing Part II – Delegate Access Bug

In the previous article, we learned how to set mailbox access audit for delegate access and find corresponding information in the audit log.  In those tests we used EMC to grant some user account Full Mailbox permission on another person’s mailbox.
Let’s check now how we can revoke Full Access permission from a mailbox. To make this test more interesting I’ll grant Administrator user account the same Full Access mailbox permission on User2’s mailbox so there’re two user accounts – User1 and Administrator – with FA permission on User2’s mailbox:
  1. Let’s try to revoke FA permission on User2’ mailbox from User1 in EMC,
  2. …start Outlook as User1 and make sure there’s no additional (User2’s) mailbox in the left pane:

    As we can see User1 does not have access to User2′s mailbox any more – exactly what we expected!

  3. Now let’s revoke FA permission on User2’s mailbox from Administrator user account,
  4. …start Outlook as Administrator and check whether User2’s mailbox has disappeared or not:Look! Administrator user account does not have any permission on User2’s mailbox; nevertheless, it still can access it!
  5. Now let’s look at User2 attributes in ADSI Editor:Please don’t forget to click Filter and tick “Show only attributes that have values”.
  6. As we can see msExchDelegateListLinkvalue is still there – after removing it Administrator user account should stop having access to User2’s mailbox.
  7. Let’s once again start Outlook as Administrator and see there’s no User2’ mailbox in the left pane:
    In this article we found a way to circumvent the bug in EMC and remove Full Access permission from an administrative user account.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: