Re: Hiding Personal Employee Information in Address Book

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

On Fri, 30 Mar 2007 17:59:07 GMT, "exx" <exx@xxxxxxxxx> wrote:

First off the environment is Exchange 2003 SP1 with Active Directory 2003.

Basically... our HR department was granted limited access to AD to fill in
user information (Home address, telephone, etc...) and I then modified the
default user ACL so that any member of "Group X" in AD was denied access to
seeing the above personal information. This worked on the Global Address
List as well....

But now there's a problem. We've been setting up users in Cached Mode, and
those users are able to see everything. I believe this has to do with the
fact that Exchange is generating the Address List and they're just
downloading it, as opposed to them querying it using their credentials.

Any thoughts on a way around this? (Other than removing all personal
information, or disabling cached mode on every machine). Is there a specific
account in Exchange that generates the address list? If so, can that account
be denied access to processing those personal attributes?

Thanks :)
Matt

This is not an Exchange question because the permissions have to be
assigned on the attributes in AD (since you will already be aware that
there is no such thing as an independent GAL like in 5.5, everything
comes from AD)

So,
By default "Auth Users" has Read to the entire directory and you can
change that and get more granular. Bad news is that you will screw
very badly with things like GPOs so whilst the narrow answer is yes, I
would suggest you treat that as a no.
.

Relevant Pages

  • Re: Replication takes so long!
    ... Or Outlook running cached mode! ... It could be an issue where Exchange only rebuilds the Offline Address Book ... Exchange MVP ... >> account shows up in our address book. ...
    (microsoft.public.exchange.admin)
  • Re: Hiding Personal Employee Information in Address Book
    ... the permissions do have to be assigned in AD. ... But in Cached Mode how ... I'm sure if I asked this in the AD group I'd be told it was an Exchange ... default user ACL so that any member of "Group X" in AD was denied access ...
    (microsoft.public.exchange.admin)
  • Hiding Personal Employee Information in Address Book
    ... First off the environment is Exchange 2003 SP1 with Active Directory 2003. ... default user ACL so that any member of "Group X" in AD was denied access to ... or disabling cached mode on every machine). ... If so, can that account ...
    (microsoft.public.exchange.admin)
  • Re: New eamil account not showing in Global Address
    ... I created an account for 3 other users to use for accounting emails. ... address accounting@xxxxxxxxxxx they get a permission denied. ... when I log them in non cached mode and they select from the Global ... Update the offline address book in Exchange and have the clients redownload ...
    (microsoft.public.exchange.admin)
  • Re: global address list issue
    ... Is Exchange running in cached mode? ... The RUS must run and stamp the user with Exchange attributes. ... Outlook 2003 must synchronize itself with the offline address book. ... I then open microsoft outlook in a client pc and set the new account ...
    (microsoft.public.exchange.admin)